Pin GitHub Actions to immutable SHA hashes

checkout/action.yml

@@ -26,13 +26,13 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout pending changes
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         ref: ${{ inputs.ref }}
 
     - name: Checkout submodules
       if: ${{ inputs.submodules }}
-      uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_seconds: 30
         retry_wait_seconds: 30

composer-setup/action.yml

@@ -29,7 +29,7 @@ runs:
     # This is the trusted path, which can upload to our cache.
     - name: Cache Composer dependencies
       if: ${{ github.event_name != 'pull_request_target' }}
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
       with:
         path: ${{ github.workspace }}/composer-cache
         key: composer-${{ runner.os }}-${{ inputs.cache-prefix }}-${{ hashFiles(format('{0}/composer.json', inputs.directory)) }}

internal/ccache-setup-windows/action.yml

@@ -32,7 +32,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup MSVC
-      uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
+      uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1.13.0
       with:
         arch: ${{ inputs.arch }}
         vsversion: ${{ inputs.vsversion }}
@@ -50,7 +50,7 @@ runs:
     - name: Setup caching of ccache download
       if: ${{ github.event_name != 'pull_request' && github.event_name != 'pull_request_target' }}
       id: ccache-cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
       with:
         path: ${{ env.CCACHE_EXE_PATH }}
         key: ccache-exe-${{ inputs.ccache-version }}

internal/docker-run/action.yml

@@ -38,7 +38,7 @@ runs:
   steps:
     - name: Validate Docker image
       if: ${{ github.event_name == 'pull_request_target' && contains(inputs.image, 'us-docker.pkg.dev/protobuf-build/release-containers/') }}
-      uses: actions/github-script@v3
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
       with:
         script: |
           core.setFailed('Pull requests from forks cannot use release Docker images.')
@@ -50,15 +50,15 @@ runs:
     - name: Setup QEMU for possible emulation
       # Most tests don't require this, so just continue if there's a network issue.
       continue-on-error: true
-      uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
       with:
         # This is mirrored for better reliability.
         image: us-docker.pkg.dev/protobuf-build/containers/test/binfmt@sha256:cf38696ffb9927c3433ad496a715b12ca94e67e67e9729ddf5dedbdb37e53b4d
 
     - name: Check docker cache
       if: ${{ inputs.docker-cache }}
       id: check-docker-cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
       with:
         path: ci/docker/
         key: ${{ inputs.image }}
@@ -79,7 +79,7 @@ runs:
     - name: Pull fresh docker image
       if: ${{ !inputs.docker-cache }}
       id: docker-pull
-      uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_minutes: 5
         retry_wait_seconds: 60

internal/gcloud-auth/action.yml

@@ -30,12 +30,12 @@ runs:
   steps:
     - name: Authenticate to Google Cloud
       id: auth
-      uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # v1.0.0
+      uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935  # v2.1.8
       if: ${{ env.CREDENTIALS_FILE == '' }}
       with:
         credentials_json: ${{ inputs.credentials }}
     - name: Set up Cloud SDK
-      uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b # v1.1.1
+      uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a  # v2.1.4
       if: ${{ env.CREDENTIALS_FILE == '' }}
       with:
         version: ">= 446.0.0"