chore: pin GitHub Actions to commit SHAs

.github/workflows/build.yml

@@ -29,11 +29,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 'Setup Go ${{ env.GO_VERSION }}'
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: 'Check out project files'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
         with:
           submodules: recursive
           path: ${{ env.WORKING_DIR }}
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Check out project files'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: 'Build docker image'
         id: build
         run: |
@@ -65,7 +65,7 @@ jobs:
           tar cfvz $output_dir/quorum-pr.tar.gz quorum-pr.tar
           echo "::set-output name=output_dir::$output_dir"
       - name: 'Upload workflow artifact - Docker image'
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@3446296876d12d4e3a0f3145a3c87e67bf0a16b5 # v1.0.0
         with:
           name: docker-image
           path: ${{ steps.build.outputs.output_dir }}
@@ -125,7 +125,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Download workflow artifact - Docker image'
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@18f0f591fbc635562c815484d73b6e8e3980482e # v1.0.0
         with:
           name: docker-image
       - name: 'Load Docker image'
@@ -237,7 +237,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Download workflow artifact - Docker image'
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@18f0f591fbc635562c815484d73b6e8e3980482e # v1.0.0
         with:
           name: docker-image
       - name: 'Load Docker image'
@@ -276,9 +276,9 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: 'Download workflow artifact - Docker image'
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@18f0f591fbc635562c815484d73b6e8e3980482e # v1.0.0
         with:
           name: docker-image
       - name: 'Load Docker image'
@@ -289,7 +289,7 @@ jobs:
           docker image tag quorumengineering/quorum:pr quorumengineering/quorum:develop
           docker image ls
       - name: Set up Java
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@91d3aa4956ec4a53e477c4907347b5e3481be8c9 # v2.5.1
         with:
           distribution: 'adopt'
           java-version: 11
@@ -299,7 +299,7 @@ jobs:
           cd build
           ./run-peeps.sh
       - name: PEEPS Test Report
-        uses: mikepenz/action-junit-report@v2
+        uses: mikepenz/action-junit-report@127c778ac944abc0f48a5103964304bab7eb208b # v2.9.1
         if: always()
         with:
           report_paths: '**/build/test-results/*/TEST-*.xml'
@@ -315,9 +315,9 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: 'Build and publish to Docker Hub'
-        uses: docker/build-push-action@v1
+        uses: docker/build-push-action@3e7a4f6646880c6f63758d73ac32392d323eaf8f # v1.1.2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
@@ -343,7 +343,7 @@ jobs:
           echo "::set-output name=gitref-path::$gitref_path"
       - name: 'Prepare Slack message with full info'
         id: status
-        uses: actions/github-script@0.8.0
+        uses: actions/github-script@80a5e943b446817466ff17e8b61cb80848641ed6 # 0.8.0
         with:
           script: |
             var gitref_path = "${{ steps.setup.outputs.gitref-path }}"
@@ -474,7 +474,7 @@ jobs:
       - name: 'Prepare Slack message with partial info'
         id: short_status
         if: failure()
-        uses: actions/github-script@0.8.0
+        uses: actions/github-script@80a5e943b446817466ff17e8b61cb80848641ed6 # 0.8.0
         with:
           script: |
             ////////////////////////////////////

.github/workflows/pr.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Setup Go ${{ env.GO_VERSION }}'
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: 'Check out project files'
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           fetch-depth: '0'
           submodules: false
@@ -38,11 +38,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 'Setup Go ${{ env.GO_VERSION }}'
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: 'Check out project files'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
         with:
           submodules: recursive
       - name: 'Prepare environment'
@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Check out project files'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: 'Build docker image'
         id: build
         run: |
@@ -70,7 +70,7 @@ jobs:
           tar cfvz $output_dir/quorum-pr.tar.gz quorum-pr.tar
           echo "::set-output name=output_dir::$output_dir"
       - name: 'Upload workflow artifact - Docker image'
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
         with:
           name: docker-image
           path: ${{ steps.build.outputs.output_dir }}
@@ -81,9 +81,9 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: 'Download workflow artifact - Docker image'
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@18f0f591fbc635562c815484d73b6e8e3980482e # v1.0.0
         with:
           name: docker-image
       - name: 'Load Docker image'
@@ -94,7 +94,7 @@ jobs:
           docker image tag quorumengineering/quorum:pr quorumengineering/quorum:develop
           docker image ls
       - name: Set up Java
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@91d3aa4956ec4a53e477c4907347b5e3481be8c9 # v2.5.1
         with:
           distribution: 'adopt'
           java-version: 11
@@ -104,7 +104,7 @@ jobs:
           cd build
           ./run-peeps.sh
       - name: PEEPS Test Report
-        uses: mikepenz/action-junit-report@v2
+        uses: mikepenz/action-junit-report@127c778ac944abc0f48a5103964304bab7eb208b # v2.9.1
         if: always()
         with:
           report_paths: '**/build/test-results/*/TEST-*.xml'
@@ -136,7 +136,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Download workflow artifact - Docker image'
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@18f0f591fbc635562c815484d73b6e8e3980482e # v1.0.0
         with:
           name: docker-image
       - name: 'Load Docker image'

.github/workflows/release.yml

@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Check out project files'
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       # https://github.com/docker/setup-qemu-action
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
       # https://github.com/docker/setup-buildx-action
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
       - name: 'Extract Docker Image Tag'
         id: extract
         run: |
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 'Setup Go ${{ env.GO_VERSION }}'
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: 'Prepare environment'
@@ -55,7 +55,7 @@ jobs:
           echo "::set-output name=key::$(go env GOOS)_$(go env GOARCH)"
           echo "::set-output name=version::${GITHUB_REF##*/}"
       - name: 'Check out project files'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
         with:
           path: ${{ env.WORKING_DIR }}
       - name: 'Build geth'
@@ -91,7 +91,7 @@ jobs:
             exit 1
           fi
       - name: 'Upload artifact'
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
         with:
           path: ${{ env.WORKING_DIR }}/build/artifact
           name: ${{ steps.env.outputs.key }}
@@ -112,7 +112,7 @@ jobs:
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
           echo "::set-output name=version::${GITHUB_REF##*/}"
       - name: 'Download artifacts'
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2.1.1
         with:
           path: artifact
       - name: 'Upload artifacts to Cloudsmith'
@@ -138,7 +138,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: 'Check out project files'
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: 'Generate release notes'
         id: release_notes
         run: |
@@ -169,7 +169,7 @@ jobs:
           content="${content//$'\r'/'%0D'}"
           echo "::set-output name=content::$content"
       - name: 'Create Github draft release'
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           # This token is provided by Actions, you do not need to create your own token
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -202,7 +202,7 @@ jobs:
           echo "::set-output name=version::${GITHUB_REF##*/}"
       - name: 'Prepare Slack message with full info'
         id: status
-        uses: actions/github-script@0.8.0
+        uses: actions/github-script@80a5e943b446817466ff17e8b61cb80848641ed6 # 0.8.0
         with:
           script: |
             var gitref_path = "${{ steps.setup.outputs.gitref-path }}"
@@ -333,7 +333,7 @@ jobs:
       - name: 'Prepare Slack message with partial info'
         id: short_status
         if: failure()
-        uses: actions/github-script@0.8.0
+        uses: actions/github-script@80a5e943b446817466ff17e8b61cb80848641ed6 # 0.8.0
         with:
           script: |
             ////////////////////////////////////

.github/workflows/upgradebot.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go 1.15
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
         with:
           go-version: 1.15
         id: go