chore: pin GitHub Actions to commit SHAs

.github/actions/add-item-to-project/action.yml

@@ -23,7 +23,7 @@ runs:
   using: composite
   steps:
     - name: Add item to project board
-      uses: actions/add-to-project@v1.0.2
+      uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
       # If filtering is disabled, the condition is always true.
       # If filtering is enabled, then:
       #   - For PRs, check that the PR either has the specified team in requested_team

.github/actions/check-changelog/action.yml

@@ -45,7 +45,7 @@ runs:
 
     - name: Check out target repository
       if: ${{ steps.label-check.outputs.skip_check != 'true' }}
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.repo }}
         ref: ${{ inputs.head-ref }}
@@ -64,7 +64,7 @@ runs:
 
     - name: Checkout GitHub tools repository
       if: ${{ steps.label-check.outputs.skip_check != 'true' }}
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
@@ -78,7 +78,7 @@ runs:
 
     - name: Set up Node.js
       if: ${{ steps.label-check.outputs.skip_check != 'true' }}
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version-file: ./.github-tools/.nvmrc
         cache-dependency-path: ./.github-tools/yarn.lock

.github/actions/check-skip-merge-queue/action.yml

@@ -41,7 +41,7 @@ runs:
     - name: Get pull request details
       continue-on-error: true
       id: pr-details
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         HEAD_REF: ${{ inputs.head-ref }}
       with:
@@ -85,7 +85,7 @@ runs:
     - name: Check if pull request is up-to-date with base branch
       continue-on-error: true
       id: up-to-date
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         BASE_REF: ${{ inputs.base-ref }}
         PR_BRANCH: ${{ steps.pr-details.outputs.pr-branch }}

.github/actions/create-release-pr/action.yml

@@ -62,23 +62,23 @@ runs:
   steps:
     # Step 1: Checkout invoking repository (metamask-mobile | metamask-extension )
     - name: Checkout invoking repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         fetch-depth: 0
         ref: ${{ inputs.checkout-base-branch }}
         token: ${{ inputs.github-token }}
 
     # Step 2: Checkout github-tools repository
     - name: Checkout github-tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: github-tools
 
     # Step 3: Setup environment
     - name: Checkout and setup environment
-      uses: MetaMask/action-checkout-and-setup@v3
+      uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0
       with:
         is-high-risk-environment: true
 
@@ -151,7 +151,7 @@ runs:
     # Step 6: Upload commits.csv as artifact (if generated)
     - name: Upload commits.csv artifact
       if: ${{ hashFiles('commits.csv') != '' }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: commits-csv
         path: commits.csv

.github/actions/flaky-test-report/action.yml

@@ -27,14 +27,14 @@ runs:
   using: composite
   steps:
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: ./github-tools
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version-file: ./github-tools/.nvmrc
         cache-dependency-path: ./github-tools/yarn.lock

.github/actions/get-release-timelines/action.yml

@@ -27,7 +27,7 @@ runs:
   using: composite
   steps:
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
@@ -45,7 +45,7 @@ runs:
       run: ./github-tools/.github/scripts/get-release-timelines.sh
 
     - name: Upload artifact release-timelines-${{ inputs.version }}.csv
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: release-timelines-${{ inputs.version }}.csv
         path: release-timelines-${{ inputs.version }}.csv

.github/actions/get-token/action.yml

@@ -23,7 +23,7 @@ runs:
   steps:
     - name: Get OIDC token
       id: oidc-token
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const token = await core.getIDToken('api://token-exchange-service');
@@ -32,7 +32,7 @@ runs:
 
     - name: Exchange OIDC token
       id: access-token
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         OIDC_TOKEN: ${{ steps.oidc-token.outputs.token }}
         TOKEN_EXCHANGE_URL: ${{ inputs.token-exchange-url }}

.github/actions/merge-approved-pr/action.yml

@@ -60,7 +60,7 @@ runs:
 
     # Fetch PR metadata (head and base branches) using the GitHub API
     - name: Get PR Details
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
       with:
@@ -97,7 +97,7 @@ runs:
     # Check if the PR has the required approval status
     - name: Verify Approval
       if: steps.verify-branches.outputs.should_skip != 'true'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
       with:
@@ -164,7 +164,7 @@ runs:
     # - the version change is a valid semver bump
     - name: Verify a version bump
       if: ${{ steps.verify-branches.outputs.should_skip != 'true' && inputs.verify-version-bump == 'true' }}
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
       with:
@@ -250,7 +250,7 @@ runs:
     # Execute the merge if all checks pass
     - name: Merge PR
       if: steps.verify-branches.outputs.should_skip != 'true'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
         MERGE_METHOD: ${{ inputs.merge-method }}

.github/actions/merge-previous-releases/action.yml

@@ -21,14 +21,14 @@ runs:
   using: composite
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         ref: ${{ inputs.new-release-branch }}
         fetch-depth: 0
         token: ${{ inputs.github-token }}
 
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}

.github/actions/playwright-test-health-report/action.yml

@@ -71,12 +71,12 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: ./github-tools
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version-file: ./github-tools/.nvmrc
         cache: yarn

.github/actions/post-gh-rca/action.yml

@@ -40,7 +40,7 @@ runs:
   using: composite
   steps:
     - name: Post RCA Form Link
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         GOOGLE_FORM_BASE_URL: ${{ inputs.google-form-base-url }}
         ISSUE_LABELS: ${{ inputs.issue-labels }}

.github/actions/post-merge-validation/action.yml

@@ -35,14 +35,14 @@ runs:
   using: composite
   steps:
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: ./github-tools
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version-file: ./github-tools/.nvmrc
         cache-dependency-path: ./github-tools/yarn.lock

.github/actions/pr-line-check/action.yml

@@ -34,7 +34,7 @@ runs:
     # checkout, base-branch resolution or history fetching is needed, and a
     # webhook payload that lags a base retarget cannot skew the count.
     - name: Count changed lines and apply size label
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         IGNORE_PATTERNS: ${{ inputs.ignore-patterns }}
         MAX_LINES: ${{ inputs.max-lines }}

.github/actions/publish-slack-release-testing-status/action.yml

@@ -34,14 +34,14 @@ runs:
   using: composite
   steps:
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: ./github-tools
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version-file: ./github-tools/.nvmrc
         cache-dependency-path: ./github-tools/yarn.lock

.github/actions/release-branch-sync/action.yml

@@ -21,13 +21,13 @@ runs:
   using: composite
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         fetch-depth: 0
         token: ${{ inputs.github-token }}
 
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}

.github/actions/remove-rca-needed-label-sheets/action.yml

@@ -32,19 +32,19 @@ runs:
   using: composite
   steps:
     - name: Checkout consuming repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         token: ${{ inputs.github-token }}
 
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: ./github-tools
 
     - name: Setup Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '20'
 

.github/actions/setup-e2e-env/action.yml

@@ -188,7 +188,7 @@ runs:
     ## Node.js & JavaScript Dependencies Setup ##
 
     - name: Setup Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: ${{ inputs.node-version }}
 
@@ -212,7 +212,7 @@ runs:
         command: ${{ steps.get-corepack-command.outputs.COREPACK_COMMAND }}
 
     - name: Restore Yarn cache
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: |
           node_modules
@@ -268,7 +268,7 @@ runs:
     # Restore cached Ruby gems
     - name: Restore Bundler cache
       if: ${{ inputs.platform == 'ios' }}
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ios/vendor/bundle
         key: ${{ inputs.cache-prefix }}-bundler-${{ inputs.platform }}-${{ runner.os }}-${{ hashFiles('ios/Gemfile.lock') }}
@@ -330,7 +330,7 @@ runs:
     - name: Restore CocoaPods specs cache
       if: ${{ inputs.platform == 'ios' }}
       id: cocoapods-specs-cache
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ~/.cocoapods/repos
         key: ${{ runner.os }}-cocoapods-specs-${{ hashFiles('ios/Podfile.lock') }}

.github/actions/stable-sync/action.yml

@@ -28,27 +28,27 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         fetch-depth: 0
         token: ${{ inputs.github-token }}
 
     - name: Checkout GitHub tools repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.github-tools-repository }}
         ref: ${{ inputs.github-tools-ref }}
         path: ./github-tools
 
     - name: Setup Node.js Mobile
       if: ${{ inputs.repo-type == 'mobile' }}
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '18'
 
     - name: Setup Node.js Extension
       if: ${{ inputs.repo-type == 'extension' }}
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '22.15'
 
@@ -64,7 +64,7 @@ runs:
 
     - name: Check if PR exists
       id: check-pr
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const { data: prs } = await github.rest.pulls.list({

.github/actions/stale-issue-pr/action.yml

@@ -62,7 +62,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
       with:
         stale-issue-message: ${{ inputs.stale-issue-message }}
         close-issue-message: ${{ inputs.close-issue-message }}