chore(deps): update github actions

.github/workflows/cd.yml

@@ -780,7 +780,7 @@
 
   ci:
     name: CI
-    uses: grafana/plugin-ci-workflows/.github/workflows/ci.yml@main
+    uses: grafana/plugin-ci-workflows/.github/workflows/ci.yml@62d4239b0781e59478a07866e0c721388e3c0d53 # main
     needs:
       - setup
     with:
@@ -998,7 +998,7 @@
 
       - name: Check and create stub
         id: check-and-create-stub
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/publish/check-and-create-stub@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/publish/check-and-create-stub@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         if: ${{ matrix.environment != 'prod' && matrix.environment != 'prod-canary' }}
         with:
           plugin-id: ${{ fromJSON(needs.ci.outputs.plugin).id }}
@@ -1008,13 +1008,13 @@
 
       - name: Check artifact ZIP(s)
         id: check-artifact-zips
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/publish/check-artifacts@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/publish/check-artifacts@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           zips: ${{ needs.upload-to-gcs-release.outputs.gcs-zip-urls }}
           plugin-id: ${{ fromJSON(needs.ci.outputs.plugin).id }}
 
       - name: Publish to catalog
-        uses: grafana/plugin-ci-workflows/actions/plugins/publish/publish@main
+        uses: grafana/plugin-ci-workflows/actions/plugins/publish/publish@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           zips: ${{ needs.upload-to-gcs-release.outputs.gcs-zip-urls }}
           environment: ${{ matrix.environment == 'prod-canary' && 'prod' || matrix.environment }}
@@ -1323,7 +1323,7 @@
           permission_set: website-docs
 
       - name: Publish docs
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/docs/publish@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/docs/publish@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           id: ${{ fromJSON(needs.ci.outputs.plugin).id }}
           version: ${{ fromJSON(needs.ci.outputs.plugin).version }}
@@ -1372,7 +1372,7 @@
 
       - name: Parse changelog
         id: changelog
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/changelog@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/changelog@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           changelog-path: ${{ inputs.plugin-directory }}/CHANGELOG.md
 
@@ -1403,7 +1403,7 @@
           PLUGIN_VERSION: ${{ fromJSON(needs.ci.outputs.plugin).version }}
 
       - name: Create Github release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: ${{ inputs.github-draft-release }}
           name: ${{ fromJSON(needs.ci.outputs.plugin).id }} v${{ fromJSON(needs.ci.outputs.plugin).version }}

.github/workflows/ci.yml

@@ -380,7 +380,7 @@
 jobs:
   check-for-release-channel:
     name: Check for release channel
-    uses: grafana/plugin-ci-workflows/.github/workflows/check-release-channel.yml@main
+    uses: grafana/plugin-ci-workflows/.github/workflows/check-release-channel.yml@62d4239b0781e59478a07866e0c721388e3c0d53 # main
     with:
       DO-NOT-USE-allow-pinned-commit-hashes: ${{ inputs.DO-NOT-USE-allow-pinned-commit-hashes }}
 
@@ -487,7 +487,7 @@
 
       - name: Setup
         id: setup
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/setup@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/setup@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           plugin-directory: ${{ inputs.plugin-directory }}
           node-version: ${{ fromJson(steps.tooling-versions.outputs.result).nodeVersion }}
@@ -557,7 +557,7 @@
 
       - name: Test and build frontend
         id: frontend
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/frontend@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/frontend@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           plugin-directory: ${{ inputs.plugin-directory }}
           secrets: ${{ (fromJson(steps.workflow-context.outputs.result).isTrusted && inputs.frontend-secrets != '') && inputs.frontend-secrets || '' }}
@@ -566,7 +566,7 @@
       - name: Test and build backend
         id: backend
         if: ${{ steps.check-for-backend.outputs.has-backend == 'true' }}
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/backend@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/backend@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           github-token: ${{ steps.generate-github-token.outputs.token || '' }}
           plugin-directory: ${{ inputs.plugin-directory }}
@@ -575,7 +575,7 @@
 
       - name: Package universal ZIP
         id: universal-zip
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/package@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/package@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           universal: "true"
           dist-folder: ${{ inputs.plugin-directory }}/dist
@@ -586,7 +586,7 @@
 
       - name: Package os/arch ZIPs
         id: os-arch-zips
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/package@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/package@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           universal: "false"
           dist-folder: ${{ inputs.plugin-directory }}/dist
@@ -597,7 +597,7 @@
 
       - name: Trufflehog secrets scanning
         if: ${{ inputs.run-trufflehog == true }}
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/trufflehog@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/trufflehog@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           trufflehog-version: ${{ inputs.trufflehog-version || env.DEFAULT_TRUFFLEHOG_VERSION }}
           folder: ${{ inputs.plugin-directory }}/dist-artifacts
@@ -744,11 +744,11 @@
         shell: bash
 
       - name: Test docs
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/docs/test@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/docs/test@62d4239b0781e59478a07866e0c721388e3c0d53 # main
 
   playwright:
     name: Playwright E2E tests
-    uses: grafana/plugin-ci-workflows/.github/workflows/playwright.yml@main
+    uses: grafana/plugin-ci-workflows/.github/workflows/playwright.yml@62d4239b0781e59478a07866e0c721388e3c0d53 # main
     if: ${{ inputs.run-playwright == true }}
     needs:
       - test-and-build
@@ -775,7 +775,7 @@
 
   playwright-docker:
     name: Plugins - Dockerized Playwright E2E tests
-    uses: grafana/plugin-ci-workflows/.github/workflows/playwright-docker.yml@main
+    uses: grafana/plugin-ci-workflows/.github/workflows/playwright-docker.yml@62d4239b0781e59478a07866e0c721388e3c0d53 # main
     if: ${{ inputs.run-playwright-docker == true }}
     needs:
       - test-and-build

.github/workflows/playwright-docker.yml

@@ -187,6 +187,6 @@ jobs:
     if: always()
     steps:
       - name: Check matrix job status
-        uses: grafana/plugin-ci-workflows/actions/internal/check-matrix-status@main
+        uses: grafana/plugin-ci-workflows/actions/internal/check-matrix-status@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           results: ${{ needs.playwright-tests.result }}

.github/workflows/playwright.yml

@@ -153,7 +153,7 @@ jobs:
 
       - name: Setup
         id: setup
-        uses: grafana/plugin-ci-workflows/actions/internal/plugins/setup@main
+        uses: grafana/plugin-ci-workflows/actions/internal/plugins/setup@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           plugin-directory: ${{ inputs.plugin-directory }}
           node-version: ${{ inputs.node-version }}
@@ -363,6 +363,6 @@ jobs:
     if: always()
     steps:
       - name: Check matrix job status
-        uses: grafana/plugin-ci-workflows/actions/internal/check-matrix-status@main
+        uses: grafana/plugin-ci-workflows/actions/internal/check-matrix-status@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           results: ${{ needs.playwright-tests.result }}

.github/workflows/pr-checks-examples-readmes.yml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: examples/base/go.mod
 

.github/workflows/pr-checks-lint.yml

@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: ${{ matrix.directory }}/go.mod
           cache-dependency-path: ${{ matrix.directory == 'tests/act' && 'tests/act/go.sum' || '' }}

.github/workflows/pr-checks-test-ci.yml

@@ -26,7 +26,7 @@ jobs:
       relevant: ${{ steps.changed.outputs.any_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true
           fetch-depth: 2
@@ -89,7 +89,7 @@ jobs:
         shell: bash
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: tests/act/go.mod
           cache-dependency-path: tests/act/go.sum

.github/workflows/pr-checks-workflow-references.yml

@@ -29,7 +29,7 @@ jobs:
 
       - name: Switch references
         id: switch-references
-        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@main
+        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           repository: grafana/plugin-ci-workflows
           ref: main

.github/workflows/release-please-pr-update-tagged-references.yml

@@ -108,7 +108,7 @@ jobs:
       # This is to ensure that the tag is completely hermetic.
       - name: Switch references (actions and workflows)
         id: switch-references
-        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@main
+        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           repository: grafana/plugin-ci-workflows
           ref: ${{ steps.component-name.outputs.component }}/v${{ steps.get-version.outputs.version }}
@@ -124,7 +124,7 @@ jobs:
       # This way we update only the examples relevant to the new component being released.
       - name: Switch references (examples)
         id: switch-references-examples
-        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@main
+        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           repository: grafana/plugin-ci-workflows
           # Prefix to update only the relevant examples

.github/workflows/release-please-restore-rolling-release.yml

@@ -52,7 +52,7 @@ jobs:
       # (we want to encourage using tagged releases in docs)
       - name: Switch references
         id: switch-references
-        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@main
+        uses: grafana/plugin-ci-workflows/actions/internal/switch-references@62d4239b0781e59478a07866e0c721388e3c0d53 # main
         with:
           repository: grafana/plugin-ci-workflows
           ref: main

actions/internal/plugins/setup/action.yml

@@ -89,7 +89,7 @@ runs:
 
     - name: Install pnpm
       if: ${{ inputs.act-cache-warmup != 'true' && steps.package-manager.outputs.name == 'pnpm' }}
-      uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       with:
         package_json_file: ${{ inputs.plugin-directory }}/package.json
 
@@ -116,7 +116,7 @@ runs:
     - name: Go
       if: ${{ inputs.frontend-only != 'true' }}
       id: go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: "${{ inputs.go-version }}"
         go-version-file: "${{ inputs.go-version-file }}"