ci: pin GitHub Actions to full commit SHAs

.github/workflows/auto_releases.yml

@@ -33,7 +33,7 @@ jobs:
           EOF
           echo "DRY_RUN=true" >> "$GITHUB_ENV"
       - name: Check out repository code
-        uses: ClickHouse/checkout@v1
+        uses: ClickHouse/checkout@be8c5ea830d63118a450b6d01b7aec11c033abd3 # v1.2.0
         with:
           fetch-depth: 0  # full history needed
       - name: Debug Info

.github/workflows/backport_branches.yml

@@ -27,7 +27,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -65,7 +65,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -103,7 +103,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -141,7 +141,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -179,7 +179,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -217,7 +217,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -255,7 +255,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -293,7 +293,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -331,7 +331,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -369,7 +369,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -407,7 +407,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -445,7 +445,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -483,7 +483,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -521,7 +521,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -559,7 +559,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -597,7 +597,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -635,7 +635,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -673,7 +673,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -711,7 +711,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -749,7 +749,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -787,7 +787,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -825,7 +825,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -863,7 +863,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -901,7 +901,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -939,7 +939,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -977,7 +977,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -1015,7 +1015,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -1053,7 +1053,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -1091,7 +1091,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -1129,7 +1129,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -1167,7 +1167,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -1205,7 +1205,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 

.github/workflows/cherry_pick.yml

@@ -28,7 +28,7 @@ jobs:
           REPO_TEAM=core
           EOF
       - name: Check out repository code
-        uses: ClickHouse/checkout@v1
+        uses: ClickHouse/checkout@be8c5ea830d63118a450b6d01b7aec11c033abd3 # v1.2.0
         with:
           clear-repository: true
           token: ${{secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN}}

.github/workflows/create_release.yml

@@ -70,7 +70,7 @@ jobs:
     runs-on: [self-hosted, release-maker]
     steps:
       - name: Check out repository code
-        uses: ClickHouse/checkout@v1
+        uses: ClickHouse/checkout@be8c5ea830d63118a450b6d01b7aec11c033abd3 # v1.2.0
         with:
           token: ${{secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN}}
           fetch-depth: 0
@@ -149,7 +149,7 @@ jobs:
           git diff HEAD
       - name: Create ChangeLog PR
         if: ${{ inputs.type == 'patch' && ! inputs.dry-run && ! inputs.only-repo && ! inputs.only-docker }}
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
         with:
           author: "robot-clickhouse <robot-clickhouse@users.noreply.github.com>"
           token: ${{ secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN }}

.github/workflows/hourly.yml

@@ -24,7 +24,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}
 
@@ -61,7 +61,7 @@ jobs:
       pipeline_status: ${{ steps.run.outputs.pipeline_status }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.CHECKOUT_REF }}