CI: pin third-party GitHub Actions to commit SHAs

.changeset/ci-pin-third-party-actions.md

@@ -0,0 +1,4 @@
+---
+---
+
+Third-party GitHub Actions are now pinned to full commit SHAs instead of mutable tags (the tag stays as a trailing comment). A moved or compromised tag would otherwise run new code with whatever the step holds — here the release GitHub App private key (workflow-application-token-action), Docker Hub and AWS credentials, and write tokens. First-party `actions/*` and `github/*` are left on tags.

.github/workflows/android-webview.yml

@@ -49,7 +49,7 @@ jobs:
           java-version: "17"
 
       - name: Set up Android SDK
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4
         with:
           # Drop the action's default `tools platform-tools`. `tools` is an
           # obsolete SDK package that Google has removed from the repository,

.github/workflows/create_release_pr.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       - name: Get token for gh app
         id: app_token
-        uses: peter-murray/workflow-application-token-action@v5
+        uses: peter-murray/workflow-application-token-action@dad2b81e50ce3edeb5f3b7ffbd79f731368bd668 # v5
         with:
           application_id: ${{ vars.PROSOPONATOR_APP_ID }}
           application_private_key: ${{ secrets.PROSOPONATOR_APP_PRIVATE_KEY }}

.github/workflows/cypress-baselines.yml

@@ -129,7 +129,7 @@ jobs:
           EOF
 
       - name: Open PR with regenerated baselines
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.PROSOPONATOR_PAT }}
           add-paths: |

.github/workflows/provider_image.yml

@@ -82,14 +82,14 @@ jobs:
       - run: NODE_ENV="production" npx turbo run @prosopo/cli#bundle
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
       # We cannot create the images in a single step because the output of buildx is not compatible with
       # `docker load`. https://stackoverflow.com/a/72952846/1178971
 
       # create the provider image for AMD64
       - name: Build the Provider Container
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: ${{github.workspace}}
           file: ${{github.workspace}}/packages/cli/Dockerfile

.github/workflows/publish_release.yml

@@ -45,7 +45,7 @@ jobs:
     steps:
       - name: Get token for gh app
         id: app_token
-        uses: peter-murray/workflow-application-token-action@v5
+        uses: peter-murray/workflow-application-token-action@dad2b81e50ce3edeb5f3b7ffbd79f731368bd668 # v5
         with:
           application_id: ${{ vars.PROSOPONATOR_APP_ID }}
           application_private_key: ${{ secrets.PROSOPONATOR_APP_PRIVATE_KEY }}
@@ -63,7 +63,7 @@ jobs:
           cache: 'npm'
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/tag_release.yml

@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Get token for gh app
         id: app_token
-        uses: peter-murray/workflow-application-token-action@v5
+        uses: peter-murray/workflow-application-token-action@dad2b81e50ce3edeb5f3b7ffbd79f731368bd668 # v5
         with:
           application_id: ${{ vars.PROSOPONATOR_APP_ID }}
           application_private_key: ${{ secrets.PROSOPONATOR_APP_PRIVATE_KEY }}