[StepSecurity] ci: Harden GitHub Actions

.github/actions/publish-site-report/action.yml

@@ -32,7 +32,7 @@ runs:
       shell: bash
       run: mvn -B surefire-report:report-only -f pom.xml -Daggregate=true -Denforcer.skip=true
     - name: Publish Site Report
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ inputs.output-zip-file }}
         path: |

.github/workflows/bigtable-pr.yml

@@ -107,7 +107,7 @@ jobs:
           ./cicd/run-unit-tests \
           --modules-to-build="BIGTABLE"
       - name: Upload Unit Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-unit-test-results
@@ -117,7 +117,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v6.0.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: GoogleCloudPlatform/DataflowTemplates
@@ -145,7 +145,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Smoke Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-smoke-test-results
@@ -177,7 +177,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Integration Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-integration-test-results
@@ -187,7 +187,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 10 # Increased retention similar to Spanner
       - name: Integration Test report on GitHub
-        uses: dorny/test-reporter@v3
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: always()
         with:
           name: Integration Test report on GitHub

.github/workflows/bqmonitor-pr.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
       - name: Install dependencies and run tests
@@ -99,7 +99,7 @@ jobs:
           --it-private-connectivity="datastream-connect-2" \
           --test="BigQueryAnomalyDetectionIT"
       - name: Upload Integration Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: surefire-integration-test-results

.github/workflows/cleanup-spanner-test-infra.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
       - name: Install dependencies
@@ -63,7 +63,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
       - name: Install dependencies

.github/workflows/datastream-pr.yml

@@ -110,7 +110,7 @@ jobs:
           ./cicd/run-unit-tests \
           --modules-to-build="DATASTREAM"
       - name: Upload Unit Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-unit-test-results
@@ -120,7 +120,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v6.0.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: GoogleCloudPlatform/DataflowTemplates
@@ -148,7 +148,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Smoke Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-smoke-test-results
@@ -180,7 +180,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Integration Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-integration-test-results
@@ -190,7 +190,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Integration Test report on GitHub
-        uses: dorny/test-reporter@v3
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: always()
         with:
           name: Integration Test report on GitHub

.github/workflows/java-pr.yml

@@ -114,7 +114,7 @@ jobs:
       - name: Run Unit Tests
         run: ./cicd/run-unit-tests
       - name: Upload Unit Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-unit-test-results
@@ -124,7 +124,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v6.0.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: GoogleCloudPlatform/DataflowTemplates
@@ -153,7 +153,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Smoke Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-smoke-test-results
@@ -188,7 +188,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Integration Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-integration-test-results
@@ -198,7 +198,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Integration Test report on GitHub
-        uses: dorny/test-reporter@v3
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: always()
         with:
           name: Integration Test report on GitHub

.github/workflows/kafka-pr.yml

@@ -110,7 +110,7 @@ jobs:
           ./cicd/run-unit-tests \
           --modules-to-build="KAFKA"
       - name: Upload Unit Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-unit-test-results
@@ -120,7 +120,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v6.0.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: GoogleCloudPlatform/DataflowTemplates
@@ -148,7 +148,7 @@ jobs:
           --it-artifact-bucket="cloud-teleport-testing-it-gitactions" \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Smoke Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-smoke-test-results
@@ -181,7 +181,7 @@ jobs:
           --it-integration-test-parallelism=4 \
           --it-private-connectivity="datastream-connect-2"
       - name: Upload Integration Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-integration-test-results
@@ -191,7 +191,7 @@ jobs:
             **/surefire-reports/html/**
           retention-days: 1
       - name: Integration Test report on GitHub
-        uses: dorny/test-reporter@v3
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: always()
         with:
           name: Integration Test report on GitHub

.github/workflows/label-dependabot-prs.yml

@@ -29,7 +29,7 @@ jobs:
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Add extra labels to Dependabot PRs
-        uses: actions-ecosystem/action-add-labels@v1.1.3
+        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           labels: ignore-for-release

.github/workflows/load-tests.yml

@@ -42,15 +42,15 @@ jobs:
         HOST_IP: ${{ steps.variables.outputs.hostIP }}
     - name: Create Github issue on failure
       if: failure()
-      uses: JasonEtco/create-an-issue@v2
+      uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         DATE: ${{ steps.date.outputs.date }}
       with:
         filename: .github/ISSUE_TEMPLATE/load-test-failure-issue-template.md
     - name: Upload Load Tests Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-test-results
@@ -60,7 +60,7 @@ jobs:
             **/surefire-reports/html/**
         retention-days: 1
     - name: Integration Test report on GitHub
-      uses: dorny/test-reporter@v3
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       if: always()
       with:
         name: Integration Test report on GitHub

.github/workflows/run-it-tests-beam-snapshots.yml

@@ -134,7 +134,7 @@ jobs:
         shell: bash
 
       - name: Upload Integration Tests Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # always run even if the previous step fails
         with:
           name: surefire-integration-test-results-beam-snapshots

.github/workflows/spanner-failure-injection-tests.yml

@@ -48,7 +48,7 @@ jobs:
         --it-cloud-proxy-host="10.128.0.16" \
         --test="${{ github.event.inputs.test_name }}"
     - name: Upload Test Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-test-results
@@ -58,7 +58,7 @@ jobs:
           **/surefire-reports/html/**
         retention-days: 20
     - name: Failure Injection Test report on GitHub
-      uses: dorny/test-reporter@v3
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       if: always()
       with:
         name: Failure Injection Test report on GitHub

.github/workflows/spanner-load-tests.yml

@@ -59,7 +59,7 @@ jobs:
         --lt-export-table="template_performance_metrics" \
         --test="${{ github.event.inputs.specific_test }}"
     - name: Upload Load Tests Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-load-test-results
@@ -69,7 +69,7 @@ jobs:
             **/surefire-reports/html/**
         retention-days: 30
     - name: Load Test report on GitHub
-      uses: dorny/test-reporter@v3
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       if: always()
       with:
         name: Load Test report on GitHub
@@ -111,7 +111,7 @@ jobs:
         --lt-export-table="template_performance_metrics" \
         --test="${{ github.event.inputs.specific_test }}"
     - name: Upload Load Test Observer Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-observer-test-results

.github/workflows/spanner-pr.yml

@@ -123,7 +123,7 @@ jobs:
         ./cicd/run-unit-tests \
         --modules-to-build="SPANNER"
     - name: Upload Unit Tests Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-unit-test-results
@@ -133,7 +133,7 @@ jobs:
             **/surefire-reports/html/**
         retention-days: 1
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@v6.0.1
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         slug: GoogleCloudPlatform/DataflowTemplates
@@ -164,7 +164,7 @@ jobs:
         --it-private-connectivity="datastream-connect-2" \
         --it-cloud-proxy-host="10.128.0.16"
     - name: Upload Smoke Tests Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-smoke-test-results
@@ -204,7 +204,7 @@ jobs:
         --it-cloud-proxy-host="10.128.0.16" \
         --test="${{ github.event.inputs.specific_test }}"
     - name: Upload Integration Tests Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-integration-test-results
@@ -214,7 +214,7 @@ jobs:
           **/surefire-reports/html/**
         retention-days: 10
     - name: Integration Test report on GitHub
-      uses: dorny/test-reporter@v3
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       if: always()
       with:
         name: Integration Test report on GitHub

.github/workflows/spanner-staging-tests.yml

@@ -64,7 +64,7 @@ jobs:
         --it-artifact-bucket="dataflow-testing-it-spanner-staging" \
         --it-spanner-host=${{ inputs.spannerHost }}
     - name: Upload Integration Tests Report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() # always run even if the previous step fails
       with:
         name: surefire-test-results
@@ -74,7 +74,7 @@ jobs:
             **/surefire-reports/html/**
         retention-days: 20
     - name: Integration Test report on GitHub
-      uses: dorny/test-reporter@v3
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       if: always()
       with:
         name: Integration Test report on GitHub

.github/workflows/spanner-terraform-validator.yml

@@ -28,11 +28,11 @@ jobs:
           - v2/spanner-to-sourcedb/terraform/samples
           - v2/cdc-data-generator/terraform/samples
     steps:
-      - uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
       - name: Checkout Code
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Verify Terraform formatting
-        uses: dflook/terraform-fmt-check@v2
+        uses: dflook/terraform-fmt-check@59168426e242f665bf7b70644d706224e665056a # v2.2.3-dockerhub
         with:
           path: ${{ matrix.terraform_paths }}
       - name: Verify Terraform template and required structure