diff --git a/.github/workflows/ci-3p-aiomysql.yml b/.github/workflows/ci-3p-aiomysql.yml
index 64954c60ac..a5ea98a314 100644
--- a/.github/workflows/ci-3p-aiomysql.yml
+++ b/.github/workflows/ci-3p-aiomysql.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -53,7 +53,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -83,7 +83,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -167,13 +167,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-django-framework.yml b/.github/workflows/ci-3p-django-framework.yml
index 8388417a35..0fdd3cc304 100644
--- a/.github/workflows/ci-3p-django-framework.yml
+++ b/.github/workflows/ci-3p-django-framework.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -53,7 +53,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -83,7 +83,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -185,13 +185,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-laravel-framework.yml b/.github/workflows/ci-3p-laravel-framework.yml
index 9ee67b8dc0..26cddc6323 100644
--- a/.github/workflows/ci-3p-laravel-framework.yml
+++ b/.github/workflows/ci-3p-laravel-framework.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -53,7 +53,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -83,7 +83,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -178,13 +178,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-mariadb-connector-c.yml b/.github/workflows/ci-3p-mariadb-connector-c.yml
index 0235d43f91..9ec3cdb390 100644
--- a/.github/workflows/ci-3p-mariadb-connector-c.yml
+++ b/.github/workflows/ci-3p-mariadb-connector-c.yml
@@ -40,7 +40,7 @@ jobs:
       
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -53,7 +53,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -83,7 +83,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -173,13 +173,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-mysql-connector-j.yml b/.github/workflows/ci-3p-mysql-connector-j.yml
index 6fc21a09b9..0b1ba0d59b 100644
--- a/.github/workflows/ci-3p-mysql-connector-j.yml
+++ b/.github/workflows/ci-3p-mysql-connector-j.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -53,7 +53,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -83,7 +83,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -166,13 +166,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-pgjdbc.yml b/.github/workflows/ci-3p-pgjdbc.yml
index 1e2624d131..183e01eb83 100644
--- a/.github/workflows/ci-3p-pgjdbc.yml
+++ b/.github/workflows/ci-3p-pgjdbc.yml
@@ -37,7 +37,7 @@ jobs:
       
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -50,7 +50,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -79,7 +79,7 @@ jobs:
 #        echo "Cache available '${BLDCACHE}'"
 
     - name: Cache restore bin
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -177,14 +177,14 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/proxysql
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-php-pdo-mysql.yml b/.github/workflows/ci-3p-php-pdo-mysql.yml
index 21ece15a4b..f7730e3d8a 100644
--- a/.github/workflows/ci-3p-php-pdo-mysql.yml
+++ b/.github/workflows/ci-3p-php-pdo-mysql.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -53,7 +53,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -83,7 +83,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -166,13 +166,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-php-pdo-pgsql.yml b/.github/workflows/ci-3p-php-pdo-pgsql.yml
index 00f2e01757..cd8124955a 100644
--- a/.github/workflows/ci-3p-php-pdo-pgsql.yml
+++ b/.github/workflows/ci-3p-php-pdo-pgsql.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -50,7 +50,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -80,7 +80,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -163,13 +163,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-postgresql.yml b/.github/workflows/ci-3p-postgresql.yml
index 12c60e1027..d67f47f054 100644
--- a/.github/workflows/ci-3p-postgresql.yml
+++ b/.github/workflows/ci-3p-postgresql.yml
@@ -37,7 +37,7 @@ jobs:
       
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -50,7 +50,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -79,7 +79,7 @@ jobs:
 #        echo "Cache available '${BLDCACHE}'"
 
     - name: Cache restore bin
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -173,14 +173,14 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/proxysql
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-3p-sqlalchemy.yml b/.github/workflows/ci-3p-sqlalchemy.yml
index b344342e67..d4a8766479 100644
--- a/.github/workflows/ci-3p-sqlalchemy.yml
+++ b/.github/workflows/ci-3p-sqlalchemy.yml
@@ -43,7 +43,7 @@ jobs:
         
     steps:
         
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -56,7 +56,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout proxysql_3p_testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: 'proxysql/proxysql_3p_testing'
         ref: ${{ env.TESTTREE }}
@@ -86,7 +86,7 @@ jobs:
 
     - name: Cache restore bin
       if: ${{ env.BRANCH != 'none' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}
         fail-on-cache-miss: true
@@ -180,20 +180,20 @@ jobs:
 
     - name: Summary output
       if: ${{ !cancelled() }}
-      uses: hoverkraft-tech/ci-github-common/actions/set-matrix-output@0.14.0
+      uses: hoverkraft-tech/ci-github-common/actions/set-matrix-output@d6367a8f0299d93cca9b42e287a56d2157f72060 # 0.14.0
       with:
         value: ${{ env.SUMMARY }}
         artifact-name: ${{ github.run_number }}-${{ matrix.infradb }}-summary
 
     - name: Archive artifacts logs
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-${{ matrix.infradb }}-${{ matrix.connector }}-logs-run#${{ github.run_number }}
         path: |
           proxysql_3p_testing/test_${{ env.TESTNAME }}/logs
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -214,7 +214,7 @@ jobs:
     steps:
       - name: Collect summary
         id: collect
-        uses: hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@0.14.0
+        uses: hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@d6367a8f0299d93cca9b42e287a56d2157f72060 # 0.14.0
         with:
           artifact-name: ${{ github.run_number }}-${{ matrix.infradb }}-summary
           remove-artifact: true
diff --git a/.github/workflows/ci-basictests.yml b/.github/workflows/ci-basictests.yml
index 56eb76d5bf..c3052aaeac 100644
--- a/.github/workflows/ci-basictests.yml
+++ b/.github/workflows/ci-basictests.yml
@@ -96,7 +96,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -108,7 +108,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -270,7 +270,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -278,7 +278,7 @@ jobs:
 
     - name: Archive artifacts bin
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-bin-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -385,7 +385,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-builds.yml b/.github/workflows/ci-builds.yml
index 1ed4fedbd8..a9886102b1 100644
--- a/.github/workflows/ci-builds.yml
+++ b/.github/workflows/ci-builds.yml
@@ -127,7 +127,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: ${{ inputs.trusted && always() }}
       with:
@@ -142,7 +142,7 @@ jobs:
     - name: Cache check
       id: cache-check
       if: ${{ inputs.trusted && success() }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}_bin
         enableCrossOsArchive: true
@@ -164,7 +164,7 @@ jobs:
 
     - name: Checkout repository
       if: ${{ steps.cache-check.outputs.cache-hit != 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -459,7 +459,7 @@ jobs:
     - name: Cache save bin
       id: cache-save-bin
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}_bin
         enableCrossOsArchive: true
@@ -468,7 +468,7 @@ jobs:
     - name: Cache save src
       id: cache-save-src
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-tap') }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}_src
         enableCrossOsArchive: true
@@ -524,7 +524,7 @@ jobs:
     - name: Cache save test
       id: cache-save-test
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-tap') }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}_test
         enableCrossOsArchive: true
@@ -533,7 +533,7 @@ jobs:
     - name: Cache save matrix
       id: cache-save-matrix
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-tap') }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         key: ${{ env.BLDCACHE }}_matrix
         enableCrossOsArchive: true
@@ -577,7 +577,7 @@ jobs:
 
     - name: Upload handoff (src)
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-tap') }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ci-builds-handoff-${{ env.SHA }}-${{ matrix.dist }}${{ matrix.type }}-src
         retention-days: 1
@@ -587,7 +587,7 @@ jobs:
 
     - name: Upload handoff (test)
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-tap') }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ci-builds-handoff-${{ env.SHA }}-${{ matrix.dist }}${{ matrix.type }}-test
         retention-days: 1
@@ -598,7 +598,7 @@ jobs:
 
     - name: Upload handoff (matrix)
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-tap') }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ci-builds-handoff-${{ env.SHA }}-${{ matrix.dist }}${{ matrix.type }}-matrix
         retention-days: 1
@@ -611,7 +611,7 @@ jobs:
       # Only the debian12-dbg build feeds the 3p suites, and they consume bin
       # only. bin is large (.git/ + binaries/), so don't ship it for -tap.
       if: ${{ inputs.trusted && success() && steps.cache-check.outputs.cache-hit != 'true' && contains(matrix.type,'-dbg') }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ci-builds-handoff-${{ env.SHA }}-${{ matrix.dist }}${{ matrix.type }}-bin
         retention-days: 1
@@ -630,13 +630,13 @@ jobs:
 
     - name: Archive artifacts
       if: ${{ inputs.trusted && failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ci-builds-${{ env.SHA }}-run#${{ github.run_number }}-${{ matrix.dist }}${{ matrix.type }}
         path: |
           proxysql/
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: ${{ inputs.trusted && always() }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-codeql.yml b/.github/workflows/ci-codeql.yml
index 6b14c57c79..61399cd002 100644
--- a/.github/workflows/ci-codeql.yml
+++ b/.github/workflows/ci-codeql.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -56,7 +56,7 @@ jobs:
       run: sudo apt-get -y install libssl-dev gnutls-dev libgnutls28-dev libmysqlclient-dev libboost-all-dev libunwind8 libunwind-dev uuid-dev ca-certificates
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -80,7 +80,7 @@ jobs:
 
 #    - name: Cache restore src
 #      id: cache-src
-#      uses: actions/cache/restore@v4
+#      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
 #      with:
 #        key: ${{ env.BLDCACHE }}
 #        fail-on-cache-miss: true
@@ -89,7 +89,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
       with:
         languages: ${{ matrix.language }}
 #        checkout_path: proxysql/
@@ -116,11 +116,11 @@ jobs:
         make -j$(nproc) clickhouse
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
       with:
         checkout_path: proxysql/
       
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-legacy-clickhouse-g1.yml b/.github/workflows/ci-legacy-clickhouse-g1.yml
index 878f70a534..c09a446208 100644
--- a/.github/workflows/ci-legacy-clickhouse-g1.yml
+++ b/.github/workflows/ci-legacy-clickhouse-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -221,7 +221,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -332,7 +332,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g1.yml b/.github/workflows/ci-legacy-g1.yml
index 9cc963ab95..4d70bae77a 100644
--- a/.github/workflows/ci-legacy-g1.yml
+++ b/.github/workflows/ci-legacy-g1.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g2-genai.yml b/.github/workflows/ci-legacy-g2-genai.yml
index 86251c3635..cb046cd3d0 100644
--- a/.github/workflows/ci-legacy-g2-genai.yml
+++ b/.github/workflows/ci-legacy-g2-genai.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -56,7 +56,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -226,7 +226,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -234,7 +234,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -347,7 +347,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g2.yml b/.github/workflows/ci-legacy-g2.yml
index 4d9e77c263..e008378623 100644
--- a/.github/workflows/ci-legacy-g2.yml
+++ b/.github/workflows/ci-legacy-g2.yml
@@ -93,7 +93,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -105,7 +105,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -268,7 +268,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -276,7 +276,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -373,7 +373,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-legacy-g3.yml b/.github/workflows/ci-legacy-g3.yml
index e55d2792cf..d5092e42f4 100644
--- a/.github/workflows/ci-legacy-g3.yml
+++ b/.github/workflows/ci-legacy-g3.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g4.yml b/.github/workflows/ci-legacy-g4.yml
index e14f6119ab..57f0b9fc12 100644
--- a/.github/workflows/ci-legacy-g4.yml
+++ b/.github/workflows/ci-legacy-g4.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -281,7 +281,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -289,7 +289,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -400,7 +400,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g5.yml b/.github/workflows/ci-legacy-g5.yml
index 5dee794d94..7eac3ae294 100644
--- a/.github/workflows/ci-legacy-g5.yml
+++ b/.github/workflows/ci-legacy-g5.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -278,7 +278,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -286,7 +286,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -397,7 +397,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g6.yml b/.github/workflows/ci-legacy-g6.yml
index 8572495d07..cbd9bb6c55 100644
--- a/.github/workflows/ci-legacy-g6.yml
+++ b/.github/workflows/ci-legacy-g6.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g7.yml b/.github/workflows/ci-legacy-g7.yml
index 8290122580..8e2c58497b 100644
--- a/.github/workflows/ci-legacy-g7.yml
+++ b/.github/workflows/ci-legacy-g7.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g8.yml b/.github/workflows/ci-legacy-g8.yml
index d6502e2fa7..cc14c4bed8 100644
--- a/.github/workflows/ci-legacy-g8.yml
+++ b/.github/workflows/ci-legacy-g8.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-legacy-g9.yml b/.github/workflows/ci-legacy-g9.yml
index 8cdb494a49..bed9a76ad3 100644
--- a/.github/workflows/ci-legacy-g9.yml
+++ b/.github/workflows/ci-legacy-g9.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-maketest.yml b/.github/workflows/ci-maketest.yml
index a3688f7fb9..4614af59ac 100644
--- a/.github/workflows/ci-maketest.yml
+++ b/.github/workflows/ci-maketest.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
          
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -41,7 +41,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -72,13 +72,13 @@ jobs:
         
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}-${{ matrix.target }}
         path: |
           ./build-*.log
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-mariadb10-galera-g1.yml b/.github/workflows/ci-mariadb10-galera-g1.yml
index a7ba3d3fee..fa8ccff629 100644
--- a/.github/workflows/ci-mariadb10-galera-g1.yml
+++ b/.github/workflows/ci-mariadb10-galera-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g2.yml b/.github/workflows/ci-mariadb10-galera-g2.yml
index fd42709c52..3df48c3ad2 100644
--- a/.github/workflows/ci-mariadb10-galera-g2.yml
+++ b/.github/workflows/ci-mariadb10-galera-g2.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g3.yml b/.github/workflows/ci-mariadb10-galera-g3.yml
index c7f268e71b..15b3ed0e24 100644
--- a/.github/workflows/ci-mariadb10-galera-g3.yml
+++ b/.github/workflows/ci-mariadb10-galera-g3.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g4.yml b/.github/workflows/ci-mariadb10-galera-g4.yml
index 505d405993..ddaf30f7a4 100644
--- a/.github/workflows/ci-mariadb10-galera-g4.yml
+++ b/.github/workflows/ci-mariadb10-galera-g4.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g5.yml b/.github/workflows/ci-mariadb10-galera-g5.yml
index a17c95b035..bdb4d438f8 100644
--- a/.github/workflows/ci-mariadb10-galera-g5.yml
+++ b/.github/workflows/ci-mariadb10-galera-g5.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -203,7 +203,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -211,7 +211,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -322,7 +322,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g6.yml b/.github/workflows/ci-mariadb10-galera-g6.yml
index 7e25ac0066..c3a4604abf 100644
--- a/.github/workflows/ci-mariadb10-galera-g6.yml
+++ b/.github/workflows/ci-mariadb10-galera-g6.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g7.yml b/.github/workflows/ci-mariadb10-galera-g7.yml
index 6aa2e83586..1027f2e539 100644
--- a/.github/workflows/ci-mariadb10-galera-g7.yml
+++ b/.github/workflows/ci-mariadb10-galera-g7.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g8.yml b/.github/workflows/ci-mariadb10-galera-g8.yml
index 0cda0237e0..39ce07b598 100644
--- a/.github/workflows/ci-mariadb10-galera-g8.yml
+++ b/.github/workflows/ci-mariadb10-galera-g8.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mariadb10-galera-g9.yml b/.github/workflows/ci-mariadb10-galera-g9.yml
index 1b972f7891..2b67103aad 100644
--- a/.github/workflows/ci-mariadb10-galera-g9.yml
+++ b/.github/workflows/ci-mariadb10-galera-g9.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql56-single-g1.yml b/.github/workflows/ci-mysql56-single-g1.yml
index 5471f3f82f..abe594069a 100644
--- a/.github/workflows/ci-mysql56-single-g1.yml
+++ b/.github/workflows/ci-mysql56-single-g1.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -49,7 +49,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -218,7 +218,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -226,7 +226,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -337,7 +337,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g1.yml b/.github/workflows/ci-mysql84-g1.yml
index e3afe6685c..50b1a3c20e 100644
--- a/.github/workflows/ci-mysql84-g1.yml
+++ b/.github/workflows/ci-mysql84-g1.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g2.yml b/.github/workflows/ci-mysql84-g2.yml
index aed229eff8..c409f53d1f 100644
--- a/.github/workflows/ci-mysql84-g2.yml
+++ b/.github/workflows/ci-mysql84-g2.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g3.yml b/.github/workflows/ci-mysql84-g3.yml
index 643ce8de02..527038038f 100644
--- a/.github/workflows/ci-mysql84-g3.yml
+++ b/.github/workflows/ci-mysql84-g3.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g4.yml b/.github/workflows/ci-mysql84-g4.yml
index 958241f6f5..c169906a9c 100644
--- a/.github/workflows/ci-mysql84-g4.yml
+++ b/.github/workflows/ci-mysql84-g4.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -288,7 +288,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -399,7 +399,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g5.yml b/.github/workflows/ci-mysql84-g5.yml
index 8e3a3de985..55969ff1cb 100644
--- a/.github/workflows/ci-mysql84-g5.yml
+++ b/.github/workflows/ci-mysql84-g5.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -210,7 +210,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -218,7 +218,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -329,7 +329,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g6.yml b/.github/workflows/ci-mysql84-g6.yml
index 2adf6fea25..3ebec488b6 100644
--- a/.github/workflows/ci-mysql84-g6.yml
+++ b/.github/workflows/ci-mysql84-g6.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g7.yml b/.github/workflows/ci-mysql84-g7.yml
index 3748cebff5..1c39da0cdf 100644
--- a/.github/workflows/ci-mysql84-g7.yml
+++ b/.github/workflows/ci-mysql84-g7.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g8.yml b/.github/workflows/ci-mysql84-g8.yml
index 41a5c941a4..9a0051c9c9 100644
--- a/.github/workflows/ci-mysql84-g8.yml
+++ b/.github/workflows/ci-mysql84-g8.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-g9.yml b/.github/workflows/ci-mysql84-g9.yml
index a696877473..8e704996c5 100644
--- a/.github/workflows/ci-mysql84-g9.yml
+++ b/.github/workflows/ci-mysql84-g9.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g1.yml b/.github/workflows/ci-mysql84-gr-g1.yml
index 18ffed70fe..cc978baddf 100644
--- a/.github/workflows/ci-mysql84-gr-g1.yml
+++ b/.github/workflows/ci-mysql84-gr-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g2.yml b/.github/workflows/ci-mysql84-gr-g2.yml
index 2e7f692494..d803a1835c 100644
--- a/.github/workflows/ci-mysql84-gr-g2.yml
+++ b/.github/workflows/ci-mysql84-gr-g2.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g3.yml b/.github/workflows/ci-mysql84-gr-g3.yml
index f20e2282b4..60a1c53a28 100644
--- a/.github/workflows/ci-mysql84-gr-g3.yml
+++ b/.github/workflows/ci-mysql84-gr-g3.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g4.yml b/.github/workflows/ci-mysql84-gr-g4.yml
index 19c9d20fd7..89b928e8c9 100644
--- a/.github/workflows/ci-mysql84-gr-g4.yml
+++ b/.github/workflows/ci-mysql84-gr-g4.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g5.yml b/.github/workflows/ci-mysql84-gr-g5.yml
index 22b5616396..fd3dbf314f 100644
--- a/.github/workflows/ci-mysql84-gr-g5.yml
+++ b/.github/workflows/ci-mysql84-gr-g5.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -203,7 +203,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -211,7 +211,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -322,7 +322,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g6.yml b/.github/workflows/ci-mysql84-gr-g6.yml
index 7c09a769d7..51dceeac56 100644
--- a/.github/workflows/ci-mysql84-gr-g6.yml
+++ b/.github/workflows/ci-mysql84-gr-g6.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g7.yml b/.github/workflows/ci-mysql84-gr-g7.yml
index ec5b8ae536..ad22e2eb28 100644
--- a/.github/workflows/ci-mysql84-gr-g7.yml
+++ b/.github/workflows/ci-mysql84-gr-g7.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g8.yml b/.github/workflows/ci-mysql84-gr-g8.yml
index b24941cf54..52eb245542 100644
--- a/.github/workflows/ci-mysql84-gr-g8.yml
+++ b/.github/workflows/ci-mysql84-gr-g8.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql84-gr-g9.yml b/.github/workflows/ci-mysql84-gr-g9.yml
index a8cc96d35a..403db0ffda 100644
--- a/.github/workflows/ci-mysql84-gr-g9.yml
+++ b/.github/workflows/ci-mysql84-gr-g9.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql90-gr-g1.yml b/.github/workflows/ci-mysql90-gr-g1.yml
index 258014b39f..6aa6ef42cb 100644
--- a/.github/workflows/ci-mysql90-gr-g1.yml
+++ b/.github/workflows/ci-mysql90-gr-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql93-gr-g1.yml b/.github/workflows/ci-mysql93-gr-g1.yml
index f96b351a6b..cbaadab77d 100644
--- a/.github/workflows/ci-mysql93-gr-g1.yml
+++ b/.github/workflows/ci-mysql93-gr-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysql95-gr-g1.yml b/.github/workflows/ci-mysql95-gr-g1.yml
index 7f894b9e2c..a3f086b805 100644
--- a/.github/workflows/ci-mysql95-gr-g1.yml
+++ b/.github/workflows/ci-mysql95-gr-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -205,7 +205,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -213,7 +213,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -324,7 +324,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-mysqlx.yml b/.github/workflows/ci-mysqlx.yml
index e9c24fe4b0..0eea3045ce 100644
--- a/.github/workflows/ci-mysqlx.yml
+++ b/.github/workflows/ci-mysqlx.yml
@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 120
     permissions: write-all
     steps:
-      - uses: LouisBrunner/checks-action@v2.0.0
+      - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
         id: checks
         if: always()
         with:
@@ -50,7 +50,7 @@ jobs:
           details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: ${{ github.repository }}
           ref: ${{ env.SHA }}
@@ -209,14 +209,14 @@ jobs:
 
       - name: Archive logs on failure
         if: ${{ failure() && !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ github.workflow }}-${{ env.SHA }}-${{ github.job }}-run#${{ github.run_number }}
           path: |
             proxysql/test/tap/tests/unit/*.log
           if-no-files-found: ignore
 
-      - uses: LouisBrunner/checks-action@v2.0.0
+      - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
         if: always()
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -239,7 +239,7 @@ jobs:
     needs: unit-tests
     permissions: write-all
     steps:
-      - uses: LouisBrunner/checks-action@v2.0.0
+      - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
         id: checks
         if: always()
         with:
@@ -251,7 +251,7 @@ jobs:
           details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: ${{ github.repository }}
           ref: ${{ env.SHA }}
@@ -490,7 +490,7 @@ jobs:
           VERSION=$(ls $HOME/opt/mysql/ | grep '^8\.4' | head -1 || echo "")
           [ -n "$VERSION" ] && dbdeployer delete single "$VERSION" 2>/dev/null || true
 
-      - uses: LouisBrunner/checks-action@v2.0.0
+      - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
         if: always()
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -517,7 +517,7 @@ jobs:
         connector_version: ['9.7.0', '26.7.0']
     permissions: write-all
     steps:
-      - uses: LouisBrunner/checks-action@v2.0.0
+      - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
         id: checks
         if: always()
         with:
@@ -529,7 +529,7 @@ jobs:
           details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: ${{ github.repository }}
           ref: ${{ env.SHA }}
@@ -699,13 +699,13 @@ jobs:
 
       - name: Archive logs
         if: ${{ failure() && !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ github.workflow }}-${{ env.SHA }}-${{ github.job }}-connector-${{ matrix.connector_version }}-run#${{ github.run_number }}
           path: |
             proxysql/ci_*_logs/
 
-      - uses: LouisBrunner/checks-action@v2.0.0
+      - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
         if: always()
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-no-infra-g1.yml b/.github/workflows/ci-no-infra-g1.yml
index 0e60120b41..edc4863554 100644
--- a/.github/workflows/ci-no-infra-g1.yml
+++ b/.github/workflows/ci-no-infra-g1.yml
@@ -98,7 +98,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -111,7 +111,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -279,7 +279,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -287,7 +287,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -398,7 +398,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-package-build.yml b/.github/workflows/ci-package-build.yml
index dc22578759..e1cbcc3424 100644
--- a/.github/workflows/ci-package-build.yml
+++ b/.github/workflows/ci-package-build.yml
@@ -119,7 +119,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -132,7 +132,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
     
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -153,7 +153,7 @@ jobs:
         [[ ${GIT_VERSION} == ${{ needs.clean.outputs.gitdescribe }} ]] || exit 1
         gh release upload ${{ env.BRANCH }}-head --repo ${{ github.repository }} --clobber ${{ env.BIN_PKG }}
  
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-pg-compat.yml b/.github/workflows/ci-pg-compat.yml
index 08abeed75a..873305a733 100644
--- a/.github/workflows/ci-pg-compat.yml
+++ b/.github/workflows/ci-pg-compat.yml
@@ -36,7 +36,7 @@ jobs:
     permissions: write-all
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       # Inline build (CI-3p-* model, not the CI-trigger/CI-builds cache-chain
       # model used by the TAP families): no ccache pattern exists elsewhere
@@ -95,7 +95,7 @@ jobs:
 
       - name: Publish report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: pg-compat-report
           path: ${{ github.workspace }}/pg-compat-reports/pg-compat.xml
diff --git a/.github/workflows/ci-pgsql-socket-g1.yml b/.github/workflows/ci-pgsql-socket-g1.yml
index 9ab70a3f24..7e2b6a56bc 100644
--- a/.github/workflows/ci-pgsql-socket-g1.yml
+++ b/.github/workflows/ci-pgsql-socket-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-repltests.yml b/.github/workflows/ci-repltests.yml
index 61e5cfba5b..18ae016f0d 100644
--- a/.github/workflows/ci-repltests.yml
+++ b/.github/workflows/ci-repltests.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
     
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -65,7 +65,7 @@ jobs:
       # off the private jenkins-build-scripts repo, so no GH_TOKEN_PROXYSQL PAT).
       # Sparse-checkout just that dir into proxysql/; the proxysql binary arrives
       # separately via the build handoff below (unpacked into the same proxysql/).
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -186,7 +186,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -194,7 +194,7 @@ jobs:
           
     - name: Archive artifacts bin
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-bin-run#${{ github.run_number }}
         path: |
@@ -203,7 +203,7 @@ jobs:
           proxysql/libs/
 #          proxysql/deps/
     
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-selftests.yml b/.github/workflows/ci-selftests.yml
index 95231d5626..6ea8e243d6 100644
--- a/.github/workflows/ci-selftests.yml
+++ b/.github/workflows/ci-selftests.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -200,7 +200,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -208,7 +208,7 @@ jobs:
           
     - name: Archive artifacts bin
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-bin-run#${{ github.run_number }}
         path: |
@@ -217,7 +217,7 @@ jobs:
           proxysql/libs/
 #          proxysql/deps/
           
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-set_parser_algorithm_3-g1.yml b/.github/workflows/ci-set_parser_algorithm_3-g1.yml
index 9d429df798..a0593fd874 100644
--- a/.github/workflows/ci-set_parser_algorithm_3-g1.yml
+++ b/.github/workflows/ci-set_parser_algorithm_3-g1.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -43,7 +43,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -212,7 +212,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -220,7 +220,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -331,7 +331,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-shuntest.yml b/.github/workflows/ci-shuntest.yml
index 8c587940f2..e64cb564a0 100644
--- a/.github/workflows/ci-shuntest.yml
+++ b/.github/workflows/ci-shuntest.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -65,7 +65,7 @@ jobs:
       # off the private jenkins-build-scripts repo, so no GH_TOKEN_PROXYSQL PAT).
       # Sparse-checkout just that dir into proxysql/; the proxysql binary arrives
       # separately via the build handoff below (unpacked into the same proxysql/).
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -182,7 +182,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -190,7 +190,7 @@ jobs:
           
     - name: Archive artifacts bin
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-bin-run#${{ github.run_number }}
         path: |
@@ -199,7 +199,7 @@ jobs:
           proxysql/libs/
 #          proxysql/deps/
             
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-taptests-pgsql-cluster.yml b/.github/workflows/ci-taptests-pgsql-cluster.yml
index c06264adab..c2ce3742f1 100644
--- a/.github/workflows/ci-taptests-pgsql-cluster.yml
+++ b/.github/workflows/ci-taptests-pgsql-cluster.yml
@@ -72,7 +72,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       continue-on-error: true
       if: always()
@@ -85,7 +85,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -225,7 +225,7 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
@@ -233,7 +233,7 @@ jobs:
 
     - name: Archive coverage report
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-coverage-run#${{ github.run_number }}
         path: |
@@ -330,7 +330,7 @@ jobs:
     - name: Report Codecov upload failure
       if: ${{ !cancelled() && steps.codecov_3.outcome == 'failure' }}
       run: echo "::warning::Codecov upload failed after 3 attempts; tests were unaffected."
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       continue-on-error: true
       if: ${{ always() && steps.checks.outputs.check_id != '' }}
       with:
diff --git a/.github/workflows/ci-unittests.yml b/.github/workflows/ci-unittests.yml
index 851fb2e8d3..a0dd888474 100644
--- a/.github/workflows/ci-unittests.yml
+++ b/.github/workflows/ci-unittests.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       id: checks
       if: always()
       with:
@@ -32,7 +32,7 @@ jobs:
         details_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: ${{ github.repository }}
         ref: ${{ env.SHA }}
@@ -136,13 +136,13 @@ jobs:
 
     - name: Archive artifacts logs
       if: ${{ failure() && !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: ${{ github.workflow }}-${{ env.SHA }}-logs-run#${{ github.run_number }}
         path: |
           proxysql/ci_*_logs/
 
-    - uses: LouisBrunner/checks-action@v2.0.0
+    - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       if: always()
       with:
         token: ${{ secrets.GITHUB_TOKEN }}