Pin dependencies

.github/workflows/codeql.yml

@@ -38,11 +38,11 @@ jobs:
 
  steps:
  - name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
 
  # Initializes the CodeQL tools for scanning.
  - name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b # v3
  with:
  languages: ${{ matrix.language }}
  # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
  # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
  # If this step fails, then you should remove it and run the build manually (see below)
  - name: Autobuild
- uses: github/codeql-action/autobuild@v3
+ uses: github/codeql-action/autobuild@f779452ac5af1c261dce0346a8f964149f49322b # v3
 
  # ℹ️ Command-line programs to run using the OS shell.
  # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +67,4 @@ jobs:
  # make release
 
  - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b # v3

.github/workflows/gradle.yml

@@ -19,14 +19,14 @@ jobs:
  java: [17]
  steps:
  - name: "📥 Checkout repository"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: ${{ matrix.java }}
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "🔨 Build project"
@@ -43,14 +43,14 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: "📥 Checkout repository"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: 17
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "📤 Publish Snapshot Artifacts to Artifactory (repo.grails.org/libs-snapshot-local)"

.github/workflows/groovy-joint-workflow.yml

@@ -16,17 +16,17 @@ jobs:
  groovyVersion: ${{ steps.groovy-version.outputs.value }}
  steps:
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: 17
  - name: "🗄️ Cache local Maven repository"
- uses: actions/cache@v4
+ uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4
  with:
  path: ~/.m2/repository
  key: cache-local-maven-${{ github.sha }}
  - name: "📥 Checkout Grails Core to fetch Gradle Plugin versions it uses"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  with:
  sparse-checkout-cone-mode: false
  sparse-checkout: settings.gradle
@@ -43,7 +43,7 @@ jobs:
  - name: "📥 Checkout Groovy 4_0_X (Grails 7 and later)"
  run: git clone --depth 1 https://github.com/apache/groovy.git -b GROOVY_4_0_X --single-branch
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "📝 Store Groovy version to use when building Grails"
@@ -117,18 +117,18 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: "📥 Checkout project"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: 17
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "🗄️ Restore local Maven repository from cache"
- uses: actions/cache@v4
+ uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4
  with:
  path: ~/.m2/repository
  key: cache-local-maven-${{ github.sha }}

.github/workflows/release-notes.yml

@@ -19,6 +19,6 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: "📝 Update Release Draft"
- uses: release-drafter/release-drafter@v6
+ uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # v6
  env:
  GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

.github/workflows/release.yml

@@ -17,14 +17,14 @@ jobs:
  GIT_USER_EMAIL: '[email protected]'
  steps:
  - name: "📥 Checkout repository"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: 17
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "📝 Store the target branch"
@@ -90,17 +90,17 @@ jobs:
  contents: read # limit to read access
  steps:
  - name: "📥 Checkout repository"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  with:
  token: ${{ secrets.GH_TOKEN }}
  ref: v${{ needs.publish.outputs.release_version }}
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: 17
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "🚪 Nexus Staging Close And Release"

.github/workflows/retry-release.yml

@@ -20,7 +20,7 @@ jobs:
  GIT_USER_EMAIL: '[email protected]'
  steps:
  - name: "📥 Checkout repository"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  with:
  ref: "v${{ github.event.inputs.release }}"
  token: ${{ secrets.GH_TOKEN }}
@@ -30,7 +30,7 @@ jobs:
  distribution: temurin
  java-version: 17
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "📝 Store the target branch"

.github/workflows/sdkman.yml

@@ -12,17 +12,17 @@ jobs:
  contents: read
  steps:
  - name: "📥 Checkout repository"
- uses: actions/checkout@v4
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
  with:
  token: ${{ secrets.GH_TOKEN }}
  ref: v${{ github.event.inputs.version }}
  - name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
  with:
  distribution: temurin
  java-version: 17
  - name: "🐘 Setup Gradle"
- uses: gradle/actions/setup-gradle@v4
+ uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
  with:
  develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
  - name: "🏆 Grails SDK Minor Release"