chore: pin GitHub Actions to SHA for supply chain security

Pin all external GitHub Actions to specific commit SHAs. Changes: - actions/checkout@v4 → pinned to SHA - actions/setup-node@v4 → pinned to SHA - actions/github-script@v6 → pinned to SHA Co-authored-by: Ona <[email protected]>

Author: jespino

.github/workflows/ci.yml

@@ -19,10 +19,10 @@ jobs:
 runs-on: ${{github.repository == 'stainless-sdks/gitpod-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest'}}
 if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
 steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4
 
  - name: Set up Node
-uses: actions/setup-node@v4
+uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #v4
 with:
 node-version: '20'
 
@@ -41,10 +41,10 @@ jobs:
 contents: read
 id-token: write
 steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4
 
  - name: Set up Node
-uses: actions/setup-node@v4
+uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #v4
 with:
 node-version: '20'
 
@@ -57,7 +57,7 @@ jobs:
  - name: Get GitHub OIDC Token
 if: github.repository == 'stainless-sdks/gitpod-typescript'
 id: github-oidc
-uses: actions/github-script@v6
+uses: actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325 #v6
 with:
 script: core.setOutput('github_token', await core.getIDToken());
 
@@ -74,10 +74,10 @@ jobs:
 runs-on: ${{github.repository == 'stainless-sdks/gitpod-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest'}}
 if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
 steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4
 
  - name: Set up Node
-uses: actions/setup-node@v4
+uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #v4
 with:
 node-version: '20'
 

.github/workflows/publish-npm.yml

@@ -23,10 +23,10 @@ jobs:
 id-token: write
 
 steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4
 
  - name: Set up Node
-uses: actions/setup-node@v4
+uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #v4
 with:
 node-version: '24'
 registry-url: 'https://registry.npmjs.org'

.github/workflows/release-doctor.yml

@@ -12,7 +12,7 @@ jobs:
 if: github.repository == 'gitpod-io/gitpod-sdk-typescript' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
 steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4
 
  - name: Check release environment
 run: |