Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/android.yml

@@ -17,13 +17,13 @@ jobs:
       run:
         working-directory: build
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Create build directory
         run: mkdir -p build
         working-directory: .
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 8
           distribution: zulu

.github/workflows/clang-format.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Install the exact clang-format binary
       - name: Install clang-format

.github/workflows/cmake_find_package.yml

@@ -13,7 +13,7 @@ jobs:
       matrix:
         os: [ ubuntu-latest, macos-latest ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: lukka/get-cmake@latest
         with:
           cmakeVersion: 3.14.0

.github/workflows/compilers.yml

@@ -30,7 +30,7 @@ jobs:
             cxx_version: 23
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Run CMake (configure, build, test)
         uses: ./.github/workflows/cmake
@@ -51,7 +51,7 @@ jobs:
             cxx_version: 23
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Run CMake (configure, build, test)
         uses: ./.github/workflows/cmake
@@ -66,7 +66,7 @@ jobs:
         cxx_version: [ 14, 17, 20, 23 ]
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: select xcode version
         run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app
@@ -93,9 +93,9 @@ jobs:
             generator_override: '-G "Visual Studio 17 2022" -T ClangCL'
     runs-on: ${{ matrix.image }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: microsoft/setup-msbuild@v3
-      - uses: ilammy/msvc-dev-cmd@v1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
 
       - name: Run CMake (configure, build, test)
         uses: ./.github/workflows/cmake

.github/workflows/copilot-setup-steps.yml

@@ -9,7 +9,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install Build Dependencies
         run: sudo apt-get update && sudo apt-get install -y clang cmake make

.github/workflows/shell-script-linter.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Install the needed binaries
       - name: Install shfmt and shellcheck