pr review: pin commit hashes

.github/workflows/alpha-npm.yml

@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/

.github/workflows/docs-ci.yml

@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
@@ -44,7 +44,7 @@ jobs:
               docsGenerator: typedoc-markdown
 
       - name: Save Artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3a #v3.1.3
         if: always()
         with:
           name: tbdocs-reporter-output

.github/workflows/docs-publish.yml

@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
@@ -48,7 +48,7 @@ jobs:
           curl -o docs/favicon.ico https://developer.tbd.website/img/favicon.ico
 
       - name: Upload documentation artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3a #v3.1.3
         with:
           name: jsdoc
           path: ./docs
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Setup Pages
         uses: actions/configure-pages@v3

.github/workflows/release-npm.yml

@@ -37,10 +37,10 @@ jobs:
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/

.github/workflows/scorecard.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
         with:
           persist-credentials: false
 
@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3a #v3.1.3
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/security.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
         with:
           ref: ${{ github.head_ref }}
 
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
         with:
           ref: ${{ github.head_ref }}
 

.github/workflows/tests-ci.yml

@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           cache: "npm"
@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
@@ -81,10 +81,10 @@ jobs:
             packages: "--workspace packages/common --workspace packages/crypto --workspace packages/credentials --workspace packages/user-agent --workspace packages/proxy-agent --workspace packages/api --workspace packages/identity-agent"
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@5ef044f #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
@@ -102,7 +102,7 @@ jobs:
 
       - name: Restore Cached Playwright Browsers
         id: cache-playwright-restore
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@84995e0 #v3.3.2
         with:
           path: ~/Library/Caches/ms-playwright
           key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
@@ -112,7 +112,7 @@ jobs:
         run: npx playwright install --with-deps
 
       - name: Save Playwright Cache (if no cache)
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@e083308 #v3.3.2
         id: cache-playwright-save
         if: steps.cache-playwright-restore.outputs.cache-hit != 'true'
         with:
@@ -140,5 +140,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde6 #v4.1.1
       - uses: TBD54566975/[email protected]