chore: pin GitHub Actions to SHA hashes

.github/workflows/bump-version.yaml

@@ -16,8 +16,8 @@ jobs:
     name: 'Update snapshot version'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/bump-version@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/bump-version@0.15.0_2025-12-05_3
         name: Bump version
         with:
           target_branch: ${{ inputs.target_branch }}

.github/workflows/prepare-release.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   Prepare-Release:
-    uses: sovity/core-edc-github/.github/workflows/prepare-release.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/prepare-release.yml@0.15.0_2025-12-05_3
     secrets: inherit
     with:
       version: ${{ inputs.version }}

.github/workflows/publish-autodoc.yml

@@ -13,7 +13,7 @@ on:
 
 jobs:
   publish:
-    uses: sovity/core-edc-github/.github/workflows/publish-autodoc.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/publish-autodoc.yml@0.15.0_2025-12-05_3
     secrets: inherit
     with:
       version: ${{ github.event.inputs.version }}

.github/workflows/publish-context.yaml

@@ -36,7 +36,7 @@ jobs:
       contents: write
       pages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: copy contexts into public folder
         run: |
           mkdir -p public/context
@@ -46,7 +46,7 @@ jobs:
           mkdir -p public/schema
           cp -r extensions/common/api/management-api-schema-validator/src/main/resources/schema/management public/schema/
       - name: deploy to gh-pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./public

.github/workflows/publish-openapi-ui.yml

@@ -7,5 +7,5 @@ on:
 
 jobs:
   publish:
-    uses: sovity/core-edc-github/.github/workflows/publish-openapi-ui.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/publish-openapi-ui.yml@0.15.0_2025-12-05_3
     secrets: inherit

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
 jobs:
 
   Release:
-    uses: sovity/core-edc-github/.github/workflows/release.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/release.yml@0.15.0_2025-12-05_3
     secrets: inherit
     with:
       publish-autodoc: true

.github/workflows/scan-pull-request.yaml

@@ -11,6 +11,6 @@ concurrency:
 
 jobs:
   trigger-workflow:
-    uses: sovity/core-edc-github/.github/workflows/scan-pull-request.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/scan-pull-request.yml@0.15.0_2025-12-05_3
     secrets:
       envGH: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/trigger_snapshot.yml

@@ -9,9 +9,9 @@ on:
 jobs:
   Publish-Snapshot:
     # This workflow will abort if the required secrets don't exist
-    uses: sovity/core-edc-github/.github/workflows/publish-snapshot.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/publish-snapshot.yml@0.15.0_2025-12-05_3
     secrets: inherit
 
   Publish-Dependencies:
-    uses: sovity/core-edc-github/.github/workflows/publish-dependencies.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/publish-dependencies.yml@0.15.0_2025-12-05_3
     secrets: inherit

.github/workflows/verify.yaml

@@ -24,76 +24,76 @@ concurrency:
 
 jobs:
   CodeQL:
-    uses: sovity/core-edc-github/.github/workflows/codeql-analysis.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/codeql-analysis.yml@0.15.0_2025-12-05_3
     secrets: inherit
 
   Checkstyle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: Run Checkstyle
         run: ./gradlew checkstyleMain checkstyleTest checkstyleTestFixtures
 
   Javadoc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: Run Javadoc
         run: ./gradlew javadoc
 
   Unit-Tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: Run unit tests
         run: ./gradlew test
 
   Postgresql-Integration-Tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: Postgresql Tests
         run: ./gradlew test -DincludeTags="PostgresqlIntegrationTest"
 
   End-To-End-Tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: End to End Integration Tests
         run: ./gradlew test -DincludeTags="EndToEndTest"
 
   Component-Tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: Component Tests
         run: ./gradlew test -DincludeTags="ComponentTest"
 
   API-Tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: Component Tests
         run: ./gradlew test -DincludeTags="ApiTest"
 
   Tck-Tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: sovity/core-edc-github/.github/actions/setup-build@0.15.0_2025-12-05_3
       - name: TCK Tests
         run: ./gradlew compileJava compileTestJava test -DincludeTags="TckTest" -PverboseTest=true
 
   Verify-OpenApi:
     if: github.event_name == 'pull_request'
-    uses: sovity/core-edc-github/.github/workflows/verify-openapi.yml@0.15.0_2025-12-05_1
+    uses: sovity/core-edc-github/.github/workflows/verify-openapi.yml@0.15.0_2025-12-05_3
     secrets: inherit
 
   Publish-Artifacts:
@@ -111,7 +111,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: "Gradle: Publish to Production"
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}