[SINT-3848] 🔒 Pin GitHub Actions to specific SHA versions for enhanced security

.github/workflows/_finish.yml

@@ -36,7 +36,7 @@ jobs:
       actions: read
       contents: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Incoming data
       id: needs
       with:
@@ -87,21 +87,21 @@ jobs:
                    summary: "Check has finished",
                    text: $text}}}}
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Print summary
       with:
         input: ${{ toJSON(steps.needs.outputs.value).summary-title }}
         filter: |
           "## \(.)"
         options: -Rr
         output-path: GITHUB_STEP_SUMMARY
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Update check
       with:
         action: update

.github/workflows/_load.yml

@@ -91,7 +91,7 @@ jobs:
     # Handle any failure in triggering job
     # Remove any `checks` we dont care about
     # Prepare a check request
-    - uses: envoyproxy/toolshed/gh-actions/github/env/load@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/env/load@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Load env
       id: data
       with:
@@ -102,21 +102,21 @@ jobs:
         GH_TOKEN: ${{ github.token }}
 
     #  Update the check
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Update check
       if: ${{ fromJSON(steps.data.outputs.data).data.check.action == 'RUN' }}
       with:
         action: update
         checks: ${{ toJSON(fromJSON(steps.data.outputs.data).checks) }}
         token: ${{ steps.appauth.outputs.token }}
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Print request summary
       with:
         input: |
@@ -136,7 +136,7 @@ jobs:
           | $summary.summary as $summary
           | "${{ inputs.template-request-summary }}"
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: request-output
       name: Load request
       with:

.github/workflows/_load_env.yml

@@ -63,18 +63,18 @@ jobs:
       request: ${{ steps.env.outputs.data }}
       trusted: true
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
     - name: Generate environment variables
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/env@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/env@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: env
       with:
         branch-name: ${{ inputs.branch-name }}
@@ -86,7 +86,7 @@ jobs:
 
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/env/summary@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}

.github/workflows/_request.yml

@@ -40,14 +40,14 @@ jobs:
       env: ${{ steps.data.outputs.value }}
       config: ${{ steps.config.outputs.config }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -60,7 +60,7 @@ jobs:
     # *ALL* variables collected should be treated as untrusted and should be sanitized before
     # use
     - name: Generate environment variables from commit
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/request@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/request@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: env
       with:
         branch-name: ${{ steps.checkout.outputs.branch-name }}
@@ -71,7 +71,7 @@ jobs:
         vars: ${{ toJSON(vars) }}
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/env/summary@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}
@@ -87,7 +87,7 @@ jobs:
         target-branch: ${{ fromJSON(steps.env.outputs.data).request.target-branch }}
 
     - name: Environment data
-      uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: data
       with:
         input: |

.github/workflows/_run.yml

@@ -158,15 +158,15 @@ jobs:
     name: ${{ inputs.command }} ${{ inputs.target }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
     # This controls which input vars are exposed to the run action (and related steps)
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Context
       id: context
       with:
@@ -187,11 +187,11 @@ jobs:
           | . * {$config, $check}
     - if: ${{ inputs.cache-build-image }}
       name: Restore Docker cache ${{ inputs.cache-build-image && format('({0})', inputs.cache-build-image) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         image_tag: ${{ inputs.cache-build-image }}
 
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: appauth
       name: Appauth
       if: ${{ inputs.trusted }}
@@ -202,7 +202,7 @@ jobs:
         # - the workaround is to allow the token to be passed through.
         token: ${{ github.token }}
         token-ok: true
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -219,15 +219,15 @@ jobs:
         token: ${{ inputs.trusted && steps.appauth.outputs.token || github.token }}
 
     # This is currently only use by mobile-docs and can be removed once they are updated to the newer website
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout-extra
       name: Checkout extra repository (for publishing)
       if: ${{ inputs.checkout-extra }}
       with:
         config: ${{ inputs.checkout-extra }}
         ssh-key: ${{ inputs.trusted && inputs.ssh-key-extra || '' }}
 
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/run@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:
         args: ${{ inputs.args != '--' && inputs.args || inputs.target }}

.github/workflows/codeql-daily.yml

@@ -30,7 +30,7 @@ jobs:
       uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
 
     - name: Free disk space
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/diskspace@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         to_remove: |
           /usr/local/lib/android

.github/workflows/codeql-push.yml

@@ -61,7 +61,7 @@ jobs:
 
     - name: Free disk space
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/diskspace@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         to_remove: |
           /usr/local/lib/android

.github/workflows/command.yml

@@ -28,7 +28,7 @@ jobs:
          && github.actor != 'dependabot[bot]'
       }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/github/command@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/command@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Parse command from comment
       id: command
       with:
@@ -37,14 +37,14 @@ jobs:
           ^/(retest)
 
     # /retest
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       if: ${{ steps.command.outputs.command == 'retest' }}
       id: appauth-retest
       name: Appauth (retest)
       with:
         key: ${{ secrets.ENVOY_CI_APP_KEY }}
         app_id: ${{ secrets.ENVOY_CI_APP_ID }}
-    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/retest@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       if: ${{ steps.command.outputs.command == 'retest' }}
       name: Retest
       with:

.github/workflows/envoy-dependency.yml

@@ -53,16 +53,16 @@ jobs:
     steps:
     - id: appauth
       name: Appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_DEP_APP_ID }}
         key: ${{ secrets.ENVOY_CI_DEP_APP_KEY }}
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         token: ${{ steps.appauth.outputs.token }}
-    - uses: envoyproxy/toolshed/gh-actions/bson@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/bson@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: update
       name: Update dependency (${{ inputs.dependency }})
       with:
@@ -97,13 +97,13 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - uses: envoyproxy/toolshed/gh-actions/upload/diff@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/upload/diff@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Upload diff
       with:
         name: ${{ inputs.dependency }}-${{ steps.update.outputs.output }}
     - name: Create a PR
       if: ${{ inputs.pr }}
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/pr@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         base: main
         body: |
@@ -134,11 +134,11 @@ jobs:
     steps:
     - id: appauth
       name: Appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_DEP_APP_ID }}
         key: ${{ secrets.ENVOY_CI_DEP_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -180,7 +180,7 @@ jobs:
 
     - name: Check Docker SHAs
       id: build-images
-      uses: envoyproxy/toolshed/gh-actions/docker/shas@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/docker/shas@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         images: |
            sha: envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
@@ -209,7 +209,7 @@ jobs:
       name: Update SHAs
       working-directory: envoy
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/pr@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         base: main
         body: Created by Envoy dependency bot