Address issues raised by plumber (#103)

* Pin actions to commit SHA

* npm audit fix

* Update publish workflow to use app token

* Update common-utils

Author: mcafaro

.github/workflows/bat.yml

@@ -8,13 +8,13 @@ jobs:
     name: Build and Test
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       - name: Perform npm tasks
         run: npm run ci
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: built-action
           path: |
@@ -29,11 +29,11 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest, macos-14]
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: built-action
       - name: Perform 'setup-matlab'
-        uses: matlab-actions/setup-matlab@v3
+        uses: matlab-actions/setup-matlab@a0180c939fb1a28de13f44f7b778b912384ced1f # v3.0.1
         with:
           products: |
             MATLAB_Test
@@ -63,7 +63,7 @@ jobs:
           grep "1 Incomplete" output.log
         shell: bash
       - name: Generate Model
-        uses: matlab-actions/run-command@v3
+        uses: matlab-actions/run-command@bcd446a219949c24051c1d04a4b4e0274c42f23b # v3.2.0
         with:
           command: cd('sample'),createSampleModel('temp_model'),sltest.testmanager.createTestsFromModel('sltestfile', 'temp_model');
       - name: Set up diary for logging
@@ -111,18 +111,18 @@ jobs:
     needs: bat
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: built-action
       - name: Perform 'setup-matlab' without MATLAB Test
-        uses: matlab-actions/setup-matlab@v3
+        uses: matlab-actions/setup-matlab@a0180c939fb1a28de13f44f7b778b912384ced1f # v3.0.1
       - name: Run MATLAB Tests without MATLAB Test # Test Case 1: Without MATLAB Test, no view is shown
         uses: ./
         with:
           source-folder: sample
           code-coverage-metric-level: mcdc
       - name: Perform 'setup-matlab' with MATLAB Test
-        uses: matlab-actions/setup-matlab@v3
+        uses: matlab-actions/setup-matlab@a0180c939fb1a28de13f44f7b778b912384ced1f # v3.0.1
         with:
           products: |
             MATLAB_Test

.github/workflows/publish.yml

@@ -15,12 +15,19 @@ jobs:
     outputs:
       tag: ${{ steps.update-package-version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        id: app-token
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_KEY }}
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
       - name: Configure git
         run: |
           git config user.name 'Release Action'
           git config user.email '<>'
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
@@ -41,7 +48,7 @@ jobs:
         run: npm run ci
 
       - name: Generate signed attestations for workflow artifacts
-        uses: actions/attest@v4
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-path: dist/bin/**/run-matlab-command*