Pin all github actions to specific Hash

.github/workflows/build-cpack-packages.yml

@@ -42,7 +42,7 @@ jobs:
     name: Linux DEB packages
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Build and test DEB packages
         run: make test-package-deb
@@ -51,7 +51,7 @@ jobs:
         if: inputs.save-artifacts
         run: make collect-package-artifacts
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: inputs.save-artifacts
         with:
           name: linux-deb-packages
@@ -77,9 +77,9 @@ jobs:
       - name: Install dependencies
         run: dnf -y install git make cmake gcc-c++ findutils rpm-build ninja-build pkgconf-pkg-config openssl-devel clang
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
 
       - name: Build and test RPM packages
         run: make test-package-rpm-native SCYLLA_HOST=scylla SKIP_DOCKER_COMPOSE=1
@@ -88,7 +88,7 @@ jobs:
         if: inputs.save-artifacts
         run: make collect-package-artifacts
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: inputs.save-artifacts
         with:
           name: linux-rpm-packages
@@ -99,9 +99,9 @@ jobs:
     name: macOS packages
     runs-on: macos-15-intel
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
 
       - name: Install GNU make
         run: brew install make
@@ -113,7 +113,7 @@ jobs:
         if: inputs.save-artifacts
         run: gmake collect-package-artifacts
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: inputs.save-artifacts
         with:
           name: macos-packages
@@ -124,7 +124,7 @@ jobs:
     name: Windows packages
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Build and test Windows packages (MSI)
         run: make test-package-windows
@@ -133,7 +133,7 @@ jobs:
         if: inputs.save-artifacts
         run: make collect-package-artifacts
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: inputs.save-artifacts
         with:
           name: windows-packages

.github/workflows/build-lint-and-test.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Update apt cache
         run: sudo apt-get update -y
@@ -48,7 +48,7 @@ jobs:
         run: make build-integration-test-bin
 
       - name: Save integration test binary
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: save-integration-test-bin
         with:
           path: ${{ env.INTEGRATION_TEST_BIN }}
@@ -67,10 +67,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
 
@@ -104,7 +104,7 @@ jobs:
           fi
 
       - name: Pull CCM image from the cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: pull-image
         with:
           path: ~/.ccm/scylla-repository
@@ -115,14 +115,14 @@ jobs:
         run: SCYLLA_VERSION="release:${{ steps.scylla-version.outputs.value }}" make download-ccm-scylla-image
 
       - name: Save CCM image cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: steps.pull-image.outputs.cache-hit != 'true'
         with:
           path: ~/.ccm/scylla-repository
           key: image-scylla-${{ runner.os }}-${{ steps.scylla-version.outputs.value }}
 
       - name: Pull integration test binary
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: restore-integration-test-bin
         with:
           path: ${{ env.INTEGRATION_TEST_BIN }}
@@ -141,14 +141,14 @@ jobs:
         run: SCYLLA_VERSION="release:${{ steps.scylla-version.outputs.value }}" make run-test-integration-scylla
 
       - name: Upload test logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: steps.run-integration-tests.outcome == 'failure'
         with:
           name: test-logs-scylla-${{ matrix.scylla-version }}
           path: ./log/*
 
       - name: Upload CCM logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: ccm-log-scylla-${{ matrix.scylla-version }}
@@ -166,16 +166,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up JDK ${{ matrix.java-version }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "adopt"
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
 
@@ -197,7 +197,7 @@ jobs:
           fi
 
       - name: Pull CCM image from the cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: pull-image
         with:
           path: ~/.ccm/repository
@@ -208,14 +208,14 @@ jobs:
         run: CASSANDRA_VERSION="${{ steps.cassandra-version.outputs.value }}" make download-ccm-cassandra-image
 
       - name: Save CCM image cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: steps.pull-image.outputs.cache-hit != 'true'
         with:
           path: ~/.ccm/repository
           key: image-cassandra-${{ runner.os }}-${{ steps.cassandra-version.outputs.value }}
 
       - name: Pull integration test binary
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: restore-integration-test-bin
         with:
           path: ${{ env.INTEGRATION_TEST_BIN }}
@@ -234,14 +234,14 @@ jobs:
         run: CASSANDRA_VERSION="${{ steps.cassandra-version.outputs.value }}" make run-test-integration-cassandra
 
       - name: Upload test logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: steps.run-integration-tests.outcome == 'failure'
         with:
           name: test-logs-cassandra-${{ matrix.cassandra-version }}
           path: ./log/*
 
       - name: Upload CCM logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: ccm-log-cassandra-${{ matrix.java-version }}-${{ matrix.cassandra-version }}

.github/workflows/release-upload-packages.yml

@@ -29,9 +29,9 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       TAG_NAME: ${{ inputs.release-tag || github.event.release.tag_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: packages