Pin actions (#81)

Author: ladvoc

.github/workflows/build.yml

@@ -15,12 +15,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with: { submodules: recursive }
       - name: Build All
-        uses: espressif/esp-idf-ci-action@v1
+        uses: espressif/esp-idf-ci-action@9d38657f3d789ca759b2b37aaf5ceffbc42c4f0d # v1
         with:
           esp_idf_version: ${{ matrix.idf_version }}
           command: |
             pip install idf-build-apps
-            idf-build-apps build --recursive --target ${{ matrix.target }}
+            idf-build-apps build --recursive --target ${{ matrix.target }}

.github/workflows/docs.yml

@@ -12,17 +12,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Install Doxygen
-        uses: ssciwr/doxygen-install@v1
+        uses: ssciwr/doxygen-install@f13be1686235deee0aeb6cdf56640170691dc96b # v1
         with: { version: "1.14.0" }
       - name: Build
         run: cd docs && doxygen
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Upload Generated Docs
         if: ${{ inputs.deploy }}
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with: { path: docs/output/html }
   deploy-docs:
     name: Deploy Documentation
@@ -38,4 +38,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/esp_registry.yml

@@ -21,26 +21,26 @@ jobs:
         nanopb:./components/third_party/nanopb
         khash:./components/third_party/khash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with: { submodules: recursive }
       - name: Upload Components (Dry Run)
-        uses: espressif/upload-components-ci-action@v2
+        uses: espressif/upload-components-ci-action@2ce17d73e35473317c1419dbd4f007aacb593040 # v2.2.1
         if: ${{ inputs.dry_run }}
         with:
           components: ${{ env.COMPONENTS }}
           namespace: livekit
           dry_run: true
       - name: Upload Components
-        uses: espressif/upload-components-ci-action@v2
+        uses: espressif/upload-components-ci-action@2ce17d73e35473317c1419dbd4f007aacb593040 # v2.2.1
         if: ${{ !inputs.dry_run }}
         with:
           components: ${{ env.COMPONENTS }}
           namespace: livekit
           api_token: ${{ secrets.ESP_REGISTRY_TOKEN }}
       - name: Save Archives
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: archives
           path: components/**/*.tgz
-          if-no-files-found: error
+          if-no-files-found: error

.github/workflows/license_check.yml

@@ -10,7 +10,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Check License Headers
         shell: bash
         run: |
@@ -22,4 +22,4 @@ jobs:
             -ignore "components/third_party/**/*" \
             -ignore "components/**/examples/**/*" \
             -ignore "components/livekit/protocol/**/*" \
-             components/**/*.{c,h}
+             components/**/*.{c,h}

.github/workflows/link_check.yml

@@ -10,15 +10,15 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Restore lychee cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .lycheecache
           key: cache-lychee-${{ github.sha }}
           restore-keys: cache-lychee-
       - name: Run lychee
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
         with:
           args: "--verbose --no-progress --cache --max-cache-age 1d ."
-          fail: true
+          fail: true

.github/workflows/pin_check.yml

@@ -0,0 +1,16 @@
+name: Pin Check
+on:
+  workflow_dispatch:
+  pull_request: { paths: [.github/**] }
+jobs:
+  pin-check:
+    name: Pin Check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Pin Check
+        uses: suzuki-shunsuke/pinact-action@cf51507d80d4d6522a07348e3d58790290eaf0b6 # v2.0.0
+        with: { skip_push: true }