CCM-14499: Pinning all GitHub Actions to SHAs

damientobin1 · damientobin1 · commit cfadb7e1d883 · 2026-03-31T13:52:40.000+01:00
diff --git a/.github/actions/acceptance-tests/action.yml b/.github/actions/acceptance-tests/action.yml
@@ -24,8 +24,7 @@ runs:
 
   steps:
     - name: Fetch terraform output
-      uses: actions/download-artifact@v5
-      with:
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5      with:
         name: terraform-output-${{ inputs.targetComponent }}
 
     - name: Get Node version
diff --git a/.github/actions/build-docs/action.yml b/.github/actions/build-docs/action.yml
@@ -11,8 +11,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4    - uses: actions/setup-node@v4
       with:
         node-version: 22
         registry-url: 'https://npm.pkg.github.com'
@@ -23,16 +22,14 @@ runs:
       run: npm ci
       shell: bash
     - name: Setup Ruby
-      uses: ruby/setup-ruby@v1.180.1
-      with:
+      uses: ruby/setup-ruby@3783f195e29b74ae398d7caca108814bbafde90e # v1.180.1      with:
         ruby-version: "3.2" # Not needed with a .ruby-version file
         bundler-cache: true # runs 'bundle install' and caches installed gems automatically
         cache-version: 0 # Increment this number if you need to re-download cached gems
         working-directory: "./docs"
     - name: Setup Pages
       id: pages
-      uses: actions/configure-pages@v5
-    - name: Build with Jekyll
+      uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5    - name: Build with Jekyll
       working-directory: ./docs
       # Outputs to the './_site' directory by default
       shell: bash
@@ -43,7 +40,6 @@ runs:
 
     - name: Upload artifact
       # Automatically uploads an artifact from the './_site' directory by default
-      uses: actions/upload-pages-artifact@v3
-      with:
+      uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3      with:
         path: "docs/_site/"
         name: jekyll-docs-${{ inputs.version }}
diff --git a/.github/actions/build-libraries/action.yml b/.github/actions/build-libraries/action.yml
@@ -11,8 +11,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4    - uses: actions/setup-node@v4
       with:
         node-version: 22
         registry-url: 'https://npm.pkg.github.com'
@@ -31,42 +30,36 @@ runs:
         make build VERSION="${{ inputs.version }}"
 
     - name: Upload abstractions artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "src/server/abstractions/bin/Release"
         name: libs-abstractions-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Upload data artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "src/server/data/bin/Release"
         name: libs-data-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Upload letter artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "src/server/letter/bin/Release"
         name: libs-letter-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Upload host artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "src/server/host/bin/Release"
         name: libs-host-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
     - run: mkdir -p ${{ runner.temp }}/myimage
       shell: bash
 
     - name: Build and export
-      uses: docker/build-push-action@v6
-      with:
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6      with:
         context: src/server
         file: src/server/Dockerfile
         tags: |
@@ -75,7 +68,6 @@ runs:
         outputs: type=docker,dest=${{ runner.temp }}/myimage/myimage.tar
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         name: libs-host-docker-${{ inputs.version }}
         path: ${{ runner.temp }}/myimage
diff --git a/.github/actions/build-oas-spec/action.yml b/.github/actions/build-oas-spec/action.yml
@@ -24,15 +24,13 @@ runs:
 
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4    - uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.nodejs_version }}
         registry-url: 'https://npm.pkg.github.com'
 
     - name: "Cache node_modules"
-      uses: actions/cache@v4
-      with:
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4      with:
         path: |
           **/node_modules
         key: ${{ runner.os }}-node-${{ inputs.nodejs_version }}-${{ hashFiles('**/package-lock.json') }}
@@ -68,7 +66,6 @@ runs:
         fi
 
     - name: Upload API OAS specification artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "build"
         name: api-oas-specification-${{ inputs.apimEnv }}${{ inputs.version != '' && format('-{0}', inputs.version) || '' }}
diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml
@@ -36,8 +36,7 @@ runs:
   steps:
     - name: Download OAS Spec artifact from workflow
       if: ${{ inputs.isRelease == 'false' }}
-      uses: actions/download-artifact@v4
-      with:
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4      with:
         name: api-oas-specification-${{ inputs.apimEnv }}${{ inputs.version != '' && format('-{0}', inputs.version) || '' }}
         path: ./build
 
@@ -96,8 +95,7 @@ runs:
         echo "APIM_ENV=$APIM_ENV" >> $GITHUB_ENV
 
     - name: Upload OAS Spec
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         name: ${{ env.APIM_ENV }}-build-output
         path: ./build
 
diff --git a/.github/actions/build-sandbox/action.yml b/.github/actions/build-sandbox/action.yml
@@ -13,8 +13,7 @@ runs:
 
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4    - uses: actions/setup-node@v4
       with:
         node-version: 22
         registry-url: 'https://npm.pkg.github.com'
diff --git a/.github/actions/build-sdk/action.yml b/.github/actions/build-sdk/action.yml
@@ -11,8 +11,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4    - uses: actions/setup-node@v4
       with:
         node-version: 22
         registry-url: 'https://npm.pkg.github.com'
@@ -56,43 +55,36 @@ runs:
         make build VERSION="${{ inputs.version }}"
 
     - name: Upload html artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "sdk/html"
         name: sdk-html-${{ inputs.version }}
 
     - name: Upload swagger artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "sdk/swagger"
         name: sdk-swagger-${{ inputs.version }}
 
     - name: Upload ts artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "sdk/typescript"
         name: sdk-ts-${{ inputs.version }}
 
     - name: Upload python artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "sdk/python"
         name: sdk-python-${{ inputs.version }}
 
     - name: Upload csharp artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "sdk/csharp"
         name: sdk-csharp-${{ inputs.version }}
 
     - name: Upload artifact
-      uses: actions/upload-pages-artifact@v3
-      with:
+      uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3      with:
         path: "sdk/html/"
         name: sdk-html-docs-${{ inputs.version }}
 
     - name: Upload swagger pages artifact
-      uses: actions/upload-pages-artifact@v3
-      with:
+      uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3      with:
         path: "sdk/swagger/"
         name: sdk-swagger-docs-${{ inputs.version }}
diff --git a/.github/actions/build-server/action.yml b/.github/actions/build-server/action.yml
@@ -11,8 +11,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4    - uses: actions/setup-node@v4
       with:
         node-version: 22
         registry-url: 'https://npm.pkg.github.com'
@@ -36,13 +35,11 @@ runs:
         make build VERSION="${{ inputs.version }}"
 
     - name: Upload csharp-server artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "server/csharp-server"
         name: server-csharp-${{ inputs.version }}
 
     - name: Upload csharp-server docker artifact
-      uses: actions/upload-artifact@v6
-      with:
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6      with:
         path: "server/Dockerfile"
         name: server-csharp-docker-${{ inputs.version }}
diff --git a/.github/actions/node-install/action.yaml b/.github/actions/node-install/action.yaml
@@ -10,8 +10,7 @@ runs:
   using: 'composite'
   steps:
     - name: 'Use Node.js'
-      uses: actions/setup-node@v6
-      with:
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6      with:
         node-version-file: '.tool-versions'
         registry-url: 'https://npm.pkg.github.com'
         scope: '@nhsdigital'
diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml
@@ -33,8 +33,7 @@ jobs:
       deploy_proxy: ${{ steps.deploy_proxy.outputs.deploy_proxy }}
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
-      - name: "Set CI/CD variables"
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5      - name: "Set CI/CD variables"
         id: variables
         run: |
           datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
diff --git a/.github/workflows/cicd-3-deploy.yaml b/.github/workflows/cicd-3-deploy.yaml
@@ -37,8 +37,7 @@ jobs:
       # tag: ${{ steps.variables.outputs.tag }}
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
-      - name: "Set CI/CD variables"
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5      - name: "Set CI/CD variables"
         id: variables
         run: |
           datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
@@ -70,8 +69,7 @@ jobs:
     needs: metadata
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
-
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: "Get version"
         id: get-asset-version
         shell: bash
@@ -110,6 +108,5 @@ jobs:
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
-        with:
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4        with:
           artifact_name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}
diff --git a/.github/workflows/manual-combine-dependabot-prs.yaml b/.github/workflows/manual-combine-dependabot-prs.yaml
@@ -15,8 +15,7 @@ jobs:
     steps:
       - name: combine-prs
         id: combine-prs
-        uses: github/combine-prs@v5.2.0
-        with:
+        uses: github/combine-prs@e6d37110da1b512313419ba6992492dad622139f # v5.2.0        with:
           ci_required: false
           labels: dependencies
           pr_title: Combined Dependabot PRs
diff --git a/.github/workflows/manual-proxy-environment-deploy.yaml b/.github/workflows/manual-proxy-environment-deploy.yaml
@@ -29,8 +29,7 @@ jobs:
     name: Deploy to Environment
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-node@v6
         with:
           node-version: 22
diff --git a/.github/workflows/pr_closed.yaml b/.github/workflows/pr_closed.yaml
@@ -48,8 +48,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
-
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Updating Main Environment
         env:
           APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
@@ -75,11 +74,9 @@ jobs:
       packages: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
-
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.0
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
-        with:
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4        with:
           node-version-file: '.tool-versions'
           registry-url: 'https://npm.pkg.github.com'
 
@@ -112,8 +109,7 @@ jobs:
       packages: read
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5.0.0
-      - name: "Repo setup"
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.0      - name: "Repo setup"
         uses: ./.github/actions/node-install
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -135,11 +131,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
-
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.0
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
-        with:
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4        with:
           node-version-file: '.tool-versions'
           registry-url: 'https://npm.pkg.github.com'
 
diff --git a/.github/workflows/release_created.yaml b/.github/workflows/release_created.yaml
@@ -26,8 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
-
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Deploy Nonprod Environment
         env:
           APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
@@ -58,8 +57,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
-
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: "Build proxies"
         uses: ./.github/actions/build-proxies
         with:
diff --git a/.github/workflows/scheduled-repository-template-sync.yaml b/.github/workflows/scheduled-repository-template-sync.yaml
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml
diff --git a/.github/workflows/stage-2-test.yaml b/.github/workflows/stage-2-test.yaml
diff --git a/.github/workflows/stage-3-build.yaml b/.github/workflows/stage-3-build.yaml
diff --git a/.github/workflows/stage-4-acceptance.yaml b/.github/workflows/stage-4-acceptance.yaml
diff --git a/.github/workflows/stage-5-publish.yaml b/.github/workflows/stage-5-publish.yaml
