chore: update workflows to improve security

Author: ewaostrowska

.github/workflows/codeql-analysis.yml

@@ -54,7 +54,7 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-jdk11-maven-v2-
     - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       with:
         cache-provider: basic
     - name: Build with Maven

.github/workflows/maven-pulls.yml

@@ -30,7 +30,7 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-jdk${{ matrix.java }}-maven-v2-
     - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       with:
         cache-provider: basic
     - name: Check swagger-bom version matches root version

.github/workflows/maven.yml

@@ -30,7 +30,7 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-jdk${{ matrix.java }}-maven-v2-
     - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       with:
         cache-provider: basic
     - name: Check swagger-bom version matches root version

.github/workflows/prepare-release.yml

@@ -60,15 +60,14 @@ jobs:
         echo "SC_VERSION=$SC_VERSION" >> $GITHUB_ENV
         echo "SC_NEXT_VERSION=$SC_NEXT_VERSION" >> $GITHUB_ENV
     - name: Create Prepare Release Pull Request
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       if: env.PREPARE_RELEASE_OK == 'yes'
       with:
         token: ${{ steps.generate-token.outputs.token }}
         commit-message: prepare release ${{ env.SC_VERSION }}
         title: 'prepare release ${{ env.SC_VERSION }}'
         branch: prepare-release-${{ env.SC_VERSION }}
     env:
-      ACTIONS_ALLOW_UNSECURE_COMMANDS:  true
       MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
       MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -103,7 +103,7 @@ jobs:
       run: |
         . ./CI/post-release.sh
     - name: Create Next Snapshot Pull Request
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       if: env.RELEASE_OK == 'yes'
       with:
         token: ${{ steps.generate-token.outputs.token }}
@@ -122,7 +122,7 @@ jobs:
         TMPDIR="$(dirname -- "${0}")"
         . $TMPDIR/update-v1-readme.sh ${{ env.SC_LAST_RELEASE }} ${{ env.SC_VERSION }}
     - name: Create Update V1 Readme Pull Request
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       if: env.RELEASE_OK == 'yes'
       with:
         token: ${{ steps.generate-token.outputs.token }}
@@ -151,7 +151,6 @@ jobs:
         fetch-depth: 0
 
     env:
-      ACTIONS_ALLOW_UNSECURE_COMMANDS:  true
       MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
       MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}