Pin dependencies

.github/actions/action-build-image/action.yml

@@ -36,27 +36,27 @@ runs:
   using: "composite"
   steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Download a single artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
       with:
         name: ${{ inputs.artifact-name }}
     - name: Login to Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
       with:
         registry: ${{ inputs.registry }}
         username: ${{ inputs.registry-username }}
         password: ${{ inputs.registry-password }}
 
     - name: Extract metadata (tags, labels) for Docker
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5
       with:
         images: "${{ inputs.registry }}/${{ github.repository }}/${{ inputs.image-name }}"
         tags: ${{inputs.image-tags}}
         labels: ${{inputs.image-labels}}
     - name: Build and push image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6
       with:
         context: ./${{ inputs.path }}
         push: true

.github/actions/action-codeql/action.yml

@@ -31,7 +31,7 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up JDK
       if: inputs.codeql-language == 'java-kotlin' && inputs.codeql-buildmode == 'autobuild'
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
       with:
         java-version: ${{ inputs.java-version }}
         distribution: "temurin"

.github/actions/action-maven-build/action.yml

@@ -16,9 +16,9 @@ runs:
 
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Set up JDK
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
       with:
         java-version: ${{ inputs.java-version }}
         distribution: "temurin"
@@ -32,7 +32,7 @@ runs:
       shell: bash
     - id: upload-artifact
       name: "Upload Artifact"
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
       with:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/target"

.github/actions/action-maven-release/action.yml

@@ -42,9 +42,9 @@ runs:
   steps:
     # Checkout source code, set up Java, etc. Then...
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Set up JDK
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
       with:
         java-version: ${{ inputs.java-version }}
         distribution: "temurin"
@@ -74,7 +74,7 @@ runs:
       run: echo "artifact-name=${{hashFiles(format('./{0}/pom.xml', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
       shell: bash        
     - name: "Upload Artifact"
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
       with:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/target"

.github/actions/action-npm-build/action.yml

@@ -15,9 +15,9 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
       with:
         node-version: ${{ inputs.node-version }}
         cache: "npm"
@@ -38,7 +38,7 @@ runs:
       run: echo "artifact-name=${{hashFiles(format('./{0}/package.json', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
       shell: bash
     - name: "Upload Artifact"
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
       with:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/dist"

.github/workflows/deploy-pages.yml

@@ -41,23 +41,23 @@ jobs:
         working-directory: ${{ inputs.sub-path }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0 # Required for vitepress lastUpdated
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
           cache-dependency-path: "${{ inputs.sub-path }}/package-lock.json"
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Install dependencies
         run: npm ci
       - name: Build with VitePress
         run: npm run ${{ inputs.build-cmd }}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: ${{ inputs.sub-path }}/${{ inputs.dist-path }}
 
@@ -72,4 +72,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

workflow-templates/ release-maven-image.yaml

@@ -57,7 +57,7 @@ jobs:
     steps:
       - name: Create GitHub Release
         id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2
         with:
           tag_name: ${{needs.release-maven.outputs.MVN_ARTIFACT_ID}}-${{ github.event.inputs.releaseVersion }}
           draft: false

workflow-templates/dependency-review.yaml

@@ -8,8 +8,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4
         with:
           config-file: it-at-m/.github/workflow-configs/dependency_review.yaml@main

workflow-templates/maven-node-build.yaml

@@ -13,7 +13,7 @@ jobs:
           - app-path: # z. B. refarch-eai
           - app-path: # z. B. refarch-webcomponent
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - if:  ${{hashFiles(format('./{0}/package.json', matrix.app-path))!=null}}
         id: node
         uses: it-at-m/.github/.github/actions/action-npm-build@main