ICU-23473 Action for Automated CLDR Import

- update action a bit

Author: srl295

.github/workflows/cldr-integration.yml

@@ -7,6 +7,8 @@ env:
   TOOLS_ROOT: ${{ github.workspace }}/icu/tools
   ICU4J_DIR: ${{ github.workspace }}/icu/icu4j
   CLDR_DATA_DIR: ${{ github.workspace }}/cldr-prod
+  JDK_VERSION: 21
+  JDK_DISTRO: temurin
 
 on:
   workflow_dispatch:
@@ -34,18 +36,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone CLDR
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.inputs.cldr-ref }}
           lfs: false
           repository: ${{ github.event.inputs.cldr-repo }}
+          persist-credentials: false
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
-          java-version: 21
-          distribution: 'temurin'
+          java-version: ${{ env.JDK_VERSION }}
+          distribution: ${{ env.JDK_DISTRO }}
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('tools/**/pom.xml') }}
@@ -58,7 +61,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload cldr-code
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.4.0
         with:
           name: cldr-code
           path: tools/cldr-code/target/cldr-code.jar
@@ -73,7 +76,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload cldr-prod
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.4.0
         with:
           name: cldr-prod
           path: target/cldr-prod.zip
@@ -98,12 +101,12 @@ jobs:
           name: cldr-code
           path: cldr-code
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
-          java-version: 21
-          distribution: 'temurin'
+          java-version: ${{ env.JDK_VERSION }}
+          distribution: ${{ env.JDK_DISTRO }}
       - name: Setup Maven Settings
-        uses: s4u/maven-settings-action@v2.8.0
+        uses: s4u/maven-settings-action@60912582505985be4cc55d2b890eb32767f8de5f # v2.8.0
         with:
           servers: |
             [{
@@ -122,21 +125,23 @@ jobs:
       - name: Create empty CLDR dir, unpack cldr-prod
         run: mkdir -p cldr cldr-prod && cd cldr-prod && unzip ../cldr-prod.zip
       - name: Clone CLDR
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.inputs.cldr-ref }}
           lfs: false
           repository: ${{ github.event.inputs.cldr-repo }}
           path: cldr
+          persist-credentials: false
       - name: Clone ICU
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.event.inputs.icu-repo }}
           ref: ${{ github.event.inputs.icu-ref }}
           lfs: false # not needed here
           path: icu
+          persist-credentials: false
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('icu/tools/**/pom.xml') }}
@@ -189,11 +194,12 @@ jobs:
     needs: genicudata
     steps:
       - name: Clone ICU
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.event.inputs.icu-repo }}
           ref: ${{ github.event.inputs.icu-ref }}
           lfs: false
+          persist-credentials: false
       - name: Download icu-data.zip
         uses: actions/download-artifact@v4
         with:
@@ -233,11 +239,12 @@ jobs:
     needs: genicudata
     steps:
       - name: Clone ICU
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.event.inputs.icu-repo }}
           ref: ${{ github.event.inputs.icu-ref }}
           lfs: true
+          persist-credentials: false
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Download icu-data.zip
@@ -249,10 +256,10 @@ jobs:
         run: cd icu4c/source && rm -rf data && unzip -o ../../icu-data.zip
       - name: Generate ICU4J data
         run: cd icu4c/source && ./runConfigureICU Linux && make -j2 && make -C data icu4j-data-install ICU4J_ROOT=$(cd ../../icu4j ; pwd)
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
-          java-version: '21' # For ICU4J
-          distribution: 'temurin'
+          java-version: ${{ env.JDK_VERSION }}
+          distribution: ${{ env.JDK_DISTRO }}
       - name: ICU4J Build
         run: |
           cd icu4j;