[paul-hristea]

Update all GitHub workflow actions to latest versions.

Fixes #485

[github-actions]

Test Results

129 files  ±0  129 suites  ±0   4m 14s ⏱️ + 1m 50s
737 tests ±0  737 ✅ ±0  0 💤 ±0  0 ❌ ±0 
827 runs  ±0  821 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit 5201eca. ± Comparison against base commit 6d348a0.

♻️ This comment has been updated with latest results.

[kryskool]

Hi @paul-hristea

to prevent supply chain attack, please use commit instead of tag

Pinning GitHub Actions to a full-length commit SHA instead of a mutable version tag (@v4) prevents supply chain attacks. Version tags can be silently moved or re-tagged by repository maintainers or attackers to point to malicious code, whereas a commit SHA is immutable

https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide

Regards,

[kryskool]

Use commit instead of tag

[tonygermano]

Pinning GitHub Actions is good advice. The document shared by @kryskool also shows how Renovate (which we already use) can be used to keep these pinned actions up to date.

[paul-hristea]

Pinned to current latest version hashes. Thanks for the suggestion!

Edit: Also added Renovate config entry for github-actions, with helpers:pinGitHubActionDigests to keep the same version pinning strategy (see docs)

[kryskool]

Now ot's ok for me, thanks @paul-hristea