pin GitHub Actions to full-length commit SHA

.github/workflows/add_assignee_to_pr.yml

@@ -16,7 +16,7 @@
 #   add-assignee-to-pr:
 #     permissions:
 #       pull-requests: write
-#     uses: route06/actions/.github/workflows/add_assignee_to_pr.yml@v2
+#     uses: route06/actions/.github/workflows/add_assignee_to_pr.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 
 name: Add assignee to PR
 

.github/workflows/add_discussion_comment.yml

@@ -13,14 +13,14 @@
 #
 # jobs:
 #   get_next_meeting_date:
-#     uses: route06/actions/.github/workflows/calc_next_date.yml@v2
+#     uses: route06/actions/.github/workflows/calc_next_date.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       interval: weekly
 #       target_day: wednesday # NOTE: MTG開催曜日に合わせて変更してください
 #
 #   create_discussion:
 #     needs: get_next_meeting_date
-#     uses: route06/actions/.github/workflows/create_gh_discussion.yml@v2
+#     uses: route06/actions/.github/workflows/create_gh_discussion.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       # NOTE: 作成するDiscussionのタイトルを指定
 #       title: ${{ needs.get_next_meeting_date.outputs.next_date }} Meeting Title
@@ -32,7 +32,7 @@
 #   # 作成した Discussion にコメントを追加する
 #   add_comment:
 #     needs: create_discussion
-#     uses: route06/actions/.github/workflows/add_discussion_comment.yml@v2
+#     uses: route06/actions/.github/workflows/add_discussion_comment.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     permissions:
 #       contents: read
 #       discussions: write
@@ -43,7 +43,7 @@
 #   # 追加したコメントに返信する
 #   reply_to_comment:
 #     needs: add_comment
-#     uses: route06/actions/.github/workflows/add_discussion_comment.yml@v2
+#     uses: route06/actions/.github/workflows/add_discussion_comment.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     permissions:
 #       contents: read
 #       discussions: write
@@ -81,14 +81,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Add Comment
         id: add_comment
         env:
           DISCUSSION_ID: ${{ inputs.discussion_id }}
           COMMENT_TEMPLATE_PATH: ${{ inputs.comment_template_path }}
           REPLY_TO_COMMENT_ID: ${{ inputs.reply_to_comment_id }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const fs = require("fs");

.github/workflows/calc_next_date.yml

@@ -11,7 +11,7 @@
 #
 # jobs:
 #   calc_next_weekly_date:
-#     uses: route06/actions/.github/workflows/calc_next_date.yml@v2
+#     uses: route06/actions/.github/workflows/calc_next_date.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       interval: weekly
 #       target_day: wednesday

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@
 #
 # jobs:
 #   codeql:
-#     uses: route06/actions/.github/workflows/codeql.yml@v2
+#     uses: route06/actions/.github/workflows/codeql.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 
 # ## Usage note
 #
@@ -58,7 +58,7 @@ jobs:
       languages: ${{ steps.format.outputs.languages }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       # GitHub Actions組み込みのpathsによるフィルタでは、そのymlで実行する複数のjobそれぞれでpathsによる分岐ができない
       # そのため https://github.com/dorny/paths-filter を使い、フィルタのjob → 各jobの順で実行することで複数jobの分岐を実現する
@@ -123,7 +123,7 @@ jobs:
               - added|modified: '**/*.xib'
       - name: Format filtered languages
         id: format
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const outputs = {

.github/workflows/codeql_core.yml

@@ -23,26 +23,26 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       # TODO: CodeQL が動作しないため暫定対応
       # 理想は inputs に java-version を持たせ引数にする
       - name: Set up JDK 17
         if: ${{ inputs.language == 'java' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '17'
           distribution: 'corretto'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
         with:
           languages: ${{ inputs.language }}
 
       # コンパイルされた言語を解析するために必要
       # コンパイルされていない言語の場合は直ちに正常終了する
       - name: Auto build
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3

.github/workflows/create_gh_discussion.yml

@@ -13,14 +13,14 @@
 #
 # jobs:
 #   get_next_meeting_date:
-#     uses: route06/actions/.github/workflows/calc_next_date.yml@v2
+#     uses: route06/actions/.github/workflows/calc_next_date.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       interval: weekly
 #       target_day: wednesday # NOTE: MTG開催曜日に合わせて変更してください
 #
 #   create_discussion:
 #     needs: get_next_meeting_date
-#     uses: route06/actions/.github/workflows/create_gh_discussion.yml@v2
+#     uses: route06/actions/.github/workflows/create_gh_discussion.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       # NOTE: 作成するDiscussionのタイトルを指定
 #       title: ${{ needs.get_next_meeting_date.outputs.next_date }} Meeting Title
@@ -65,7 +65,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Run script
         id: create_discussion
@@ -74,7 +74,7 @@ jobs:
           CATEGORY_SLUG: ${{ inputs.category_slug }}
           TITLE: ${{ inputs.title }}
           DESCRIPTION_TEMPLATE_PATH: ${{ inputs.description_template_path }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const fs = require("fs");

.github/workflows/create_gh_issue.yml

@@ -13,7 +13,7 @@
 #
 # jobs:
 #   create_issue:
-#     uses: route06/actions/.github/workflows/create_gh_issue.yml@v2
+#     uses: route06/actions/.github/workflows/create_gh_issue.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     permissions:
 #       contents: read
 #       issues: write
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Create a issue
         run: |
           gh issue create \

.github/workflows/dependency_review.yml

@@ -14,7 +14,7 @@
 #
 # jobs:
 #   dependency_review:
-#     uses: route06/actions/.github/workflows/dependency_review.yml@v2
+#     uses: route06/actions/.github/workflows/dependency_review.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 
 # ## Reference
 #
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
         with:
           comment-summary-in-pr: ${{ inputs.comment-summary-in-pr }}

.github/workflows/get_last_discussion_url.yml

@@ -8,7 +8,7 @@
 #
 # jobs:
 #   get-last-discussion-url:
-#     uses: route06/actions/.github/workflows/get_last_discussion_url.yml@v2
+#     uses: route06/actions/.github/workflows/get_last_discussion_url.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       title: Weekly meeting
 #       repo: route06/my-repo
@@ -54,7 +54,7 @@ jobs:
     steps:
       - id: get_last_discussion
         name: Get Last discussion
-        uses: octokit/graphql-action@v2.x
+        uses: octokit/graphql-action@f7836e89a7e5bac63911bbe9653c21147b3d9bc3 # v2.x
         with:
           query: |
             query LastDiscussion {

.github/workflows/gh_discussion_comment_to_slack.yml

@@ -20,7 +20,7 @@
 # jobs:
 #   discussion_commented:
 #     if: github.event.discussion && github.event.comment
-#     uses: route06/actions/.github/workflows/gh_discussion_comment_to_slack.yml@v2
+#     uses: route06/actions/.github/workflows/gh_discussion_comment_to_slack.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     secrets:
 #       slack-webhook-url: ${{ secrets.SLACK_XXX_WEBHOOK_URL }} # Set this secret
 

.github/workflows/my_codeql.yml

@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   codeql:
-    uses: route06/actions/.github/workflows/codeql.yml@v2
+    uses: route06/actions/.github/workflows/codeql.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2

.github/workflows/my_release.yml

@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         id: app-token
         with:
           app-id: ${{ vars.ACTIONS_CI_APP_ID }}
           private-key: ${{ secrets.ACTIONS_CI_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           token: ${{ steps.app-token.outputs.token }}
       - name: tagpr
@@ -42,7 +42,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-tags: true
       - name: Git config

.github/workflows/my_test.yml

@@ -17,7 +17,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Run actionlint with reviewdog
         uses: reviewdog/action-actionlint@e37e2ca68a70112d21e135229272da28ce2d0d5a # v1.66.1
         with:
@@ -30,5 +30,5 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: ls-lint/action@02e380fe8733d499cbfc9e22276de5085508a5bd # v2.3.1

.github/workflows/notify_slack_on_ci_failed.yml

@@ -8,7 +8,7 @@
 #
 # jobs:
 #   notify:
-#     uses: route06/actions/.github/workflows/notify_slack_on_ci_failed.yml@v2
+#     uses: route06/actions/.github/workflows/notify_slack_on_ci_failed.yml@3bcea5bf834ff2e0e6c912c1167fcc1fe05e49c2 # v2
 #     with:
 #       title: CI failed / ci.yml
 #     secrets: