Fix/code scanning alerts

.github/workflows/baas-ci.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule

.github/workflows/baas-cli-publish.yml

@@ -48,7 +48,7 @@ jobs:
     name: Build · smoke-test · pack (never publishes)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -58,7 +58,7 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "20"
           cache: npm
@@ -86,7 +86,7 @@ jobs:
             || { echo "::error::the publishable tarball would not include the baas CLI"; exit 1; }
           tar -tzf ./*.tgz | grep -E 'package/dist/index\.js' \
             || { echo "::error::the publishable tarball would not include the SDK entrypoint"; exit 1; }
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: npm-tarball
           path: apps/grobase/sdks/js/*.tgz
@@ -104,7 +104,7 @@ jobs:
       contents: read
       id-token: write # npm provenance
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -114,7 +114,7 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"

.github/workflows/baas-release.yml

@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: version
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -89,7 +89,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -99,14 +99,14 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       # Docker Hub — where the images go (public by default on push).
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
       # GHCR — layer-cache push only (cache-to refs in docker-bake.hcl).
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -136,7 +136,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -146,8 +146,8 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
@@ -180,7 +180,7 @@ jobs:
               > "binocle-${ed}-${VERSION}-linux-amd64.tar.gz.sha256"
           done
           sha256sum binocle-*-"${VERSION}"-linux-amd64.tar.gz > checksums.txt
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: binocle-binaries
           path: |
@@ -197,7 +197,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
       - name: Check out grobase submodule
@@ -207,7 +207,7 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: binocle-binaries
           path: release-assets/
@@ -219,7 +219,7 @@ jobs:
           sed -E 's#^VERSION="\$\{BINOCLE_VERSION:-[^}]*\}"#VERSION="${BINOCLE_VERSION:-'"$VER"'}"#' \
             apps/grobase/scripts/ci/install.sh > release-assets/install.sh
           grep '^VERSION=' release-assets/install.sh
-      - uses: softprops/action-gh-release@v3
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           name: "Grobase BaaS ${{ github.ref_name }}"
           prerelease: ${{ needs.version.outputs.prerelease == 'true' }}

.github/workflows/drawnosaurus-edge.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: nginx from mirror.gcr.io under its public.ecr.aws name
         # Same reason as graph-studio.yml: public.ecr.aws rate-limits anonymous pulls per runner IP.
         run: |

.github/workflows/fresh-machine.yml

@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: grobase + opposite-osiris + osionos app + scripts checkout (vault-restore.sh, the web/gateway Dockerfiles, the bridge image closure and the vault42 CLI are under test)
         run: |
           git config --global --add url."https://github.com/".insteadOf "git@github.com:"
@@ -160,7 +160,7 @@ jobs:
           git config --global --get-all url."https://github.com/".insteadOf
 
       - name: git clone (root only — submodules are next, explicitly)
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 1
 
@@ -270,8 +270,8 @@ jobs:
           msc=$(docker exec mini-baas-mssql sh -lc '/opt/mssql-tools18/bin/sqlcmd -C -S localhost -U sa -P "$MSSQL_SA_PASSWORD" -h-1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM finance.sys.tables"' 2>/dev/null | tr -d '[:space:]')
           echo "mssql finance tables = ${msc:-<none>}"; gt0 "$msc" || { echo "::error::mssql finance empty"; fail=1; }
           # 5 dynamodb (table count)
-          ddc=$(docker run --rm --network mini-baas_mini-baas -e AWS_ACCESS_KEY_ID=local -e AWS_SECRET_ACCESS_KEY=local -e AWS_DEFAULT_REGION=us-east-1 amazon/aws-cli dynamodb list-tables --endpoint-url http://mini-baas-dynamodb-local:8000 --output text --query 'length(TableNames)' 2>/dev/null | tr -d '[:space:]')
-          echo "dynamodb tables = ${ddc:-<none>}"; gt0 "$ddc" || { echo "::error::dynamodb empty"; fail=1; }
+          ddc=$(docker run --rm --network mini-baas_mini-baas -e AWS_ACCESS_KEY_ID=local -e AWS_SECRET_ACCESS_KEY=local -e AWS_DEFAULT_REGION=us-east-1 amazon/aws-cli dynamodb list-tables --endpoint-url http://mini-baas-dynamodb-local:8000 --output text --query 'length(TableNames)' 2>/dev/null | tr -d '[:space:]') # NOSONAR S5332: docker-network endpoint inside the CI runner
+          echo "dynamodb tables = ${ddc:-<none>}"; gt0 "$ddc" || { echo "::error::dynamodb empty"; fail=1; } # NOSONAR S5332: docker-network endpoint inside the CI runner
           # 6 minio (object count)
           mnc=$(docker exec mini-baas-minio sh -c 'find /data -type f -not -path "*/.minio.sys/*" 2>/dev/null | wc -l' 2>/dev/null | tr -d '[:space:]')
           echo "minio objects = ${mnc:-<none>}"; gt0 "$mnc" || { echo "::error::minio objects empty"; fail=1; }
@@ -351,7 +351,7 @@ jobs:
 
       - name: Upload the e2e results
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: e2e-test-results
           path: tests/e2e/test-results

.github/workflows/gitleaks.yml

@@ -19,6 +19,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: make secrets-scan
         run: make secrets-scan

.github/workflows/graph-studio-contract.yml

@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: fetch graph_render at the gitlink (the submodule is update = none)
         run: |
           pin="$(git ls-tree HEAD apps/graph_render | awk '$2 == "commit" { print $3 }')"
@@ -73,7 +73,7 @@ jobs:
       # tests/e2e/Dockerfile's base, pinned by digest (v1.63.0-noble = @playwright/test in the lockfile)
       PW_IMAGE: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: fetch the pinned pack by digest (no docker) and verify it
         run: tests/graph-studio-contract/fetch-pack.sh "$RUNNER_TEMP/pack"
       # C7 (c7-hierarchy.spec.ts) runs osionos's own graph adapter, not a copy of it.

.github/workflows/graph-studio.yml

@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: osionos checkout (the build context, with its nested packages)
         run: |
           git config --global url."https://github.com/".insteadOf "git@github.com:"