fix: pin GitHub Actions to commit hashes

.github/workflows/benchmark.yaml

@@ -33,12 +33,12 @@ jobs:
     runs-on: ubuntu-large
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.27"
 
@@ -94,7 +94,7 @@ jobs:
           echo "After image will be loaded by dedup-bench.sh"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
 
@@ -125,7 +125,7 @@ jobs:
             "${{ github.workspace }}/benchmark-output/after"
 
       - name: Comment on PR
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         if: github.event_name == 'pull_request' && always()
         continue-on-error: true
         with:
@@ -134,7 +134,7 @@ jobs:
           comment-tag: benchmark-results
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: benchmark-results

.github/workflows/bypass.yaml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Get build number
         id: get-build
-        uses: mlilback/build-number@v1
+        uses: mlilback/build-number@81a5eb0abae9b77d036138284ba1094d49acbc32 # v1
         with:
           base: 254
           run-id: ${{ github.run_number }}

.github/workflows/check-ig-pin.yaml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Check inspektor-gadget replace pin
         env:

.github/workflows/component-tests.yaml

@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Login to Quay.io
         if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: quay.io/kubescape
           username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Upload image artifact for fork PR
         if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: node-agent-image
           path: node-agent-image.tar
@@ -111,11 +111,11 @@ jobs:
         ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download fork PR image
         if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: node-agent-image
 
@@ -166,7 +166,7 @@ jobs:
       - name: Set up Go
         env:
           CGO_ENABLED: 0
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
         with:
           go-version: "1.27"
       - name: Set unlimited memlock limit

.github/workflows/go-basic-tests.yaml

@@ -79,11 +79,11 @@ jobs:
     #   matrix:
     #     os: ${{ fromJSON(needs.Setup-Environment.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         name: Setup Go
         with:
           go-version: '${{ inputs.GO_VERSION }}'
@@ -104,17 +104,17 @@ jobs:
 
       - name: Initialize CodeQL
         continue-on-error: true
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
         with:
           languages: go
 
       - name: Autobuild
         continue-on-error: true
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
 
       - name: Perform CodeQL Analysis
         continue-on-error: true
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
 
       # - name: Test go build
       #   run: go build -v ${{ inputs.BUILD_PATH }}

.github/workflows/incluster-comp-pr-merged.yaml

@@ -79,13 +79,13 @@ jobs:
       #   if: github.ref == 'master'
       #   run: exit -1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         name: Checkout
         with:
           fetch-depth: 0
         #   submodules: recursive
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         name: Installing go
         with:
           go-version: "${{ inputs.GO_VERSION }}"
@@ -97,10 +97,10 @@ jobs:
         run: make gadgets
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Set prerelease image tag
         id: image-prerelease-tag
@@ -111,15 +111,15 @@ jobs:
         run: go test -exec sudo -v ./...
 
       - name: Login to Quay
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: quay.io
           username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
           password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: build/Dockerfile
@@ -138,7 +138,7 @@ jobs:
           push-to-registry: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@main
+        uses: sigstore/cosign-installer@af595e623eec1ede52d6322f53b635d5def0a95a # main
         with:
           cosign-release: "v2.2.2"
 
@@ -186,7 +186,7 @@ jobs:
 
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.E2E_DISPATCH_APP_ID }}
           private-key: ${{ secrets.E2E_DISPATCH_APP_PRIVATE_KEY }}
@@ -339,7 +339,7 @@ jobs:
 
       - name: Upload failed step logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: failed-e2e-logs-attempt-${{ github.run_attempt }}
           path: failed_*.txt
@@ -364,10 +364,10 @@ jobs:
       contents: write
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Quay
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: quay.io
           username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
@@ -388,7 +388,7 @@ jobs:
 
       - name: Create Release
         id: create_release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.IMAGE_TAG }}
@@ -399,7 +399,7 @@ jobs:
 
       - name: Trigger helm chart workflow
         if: ${{ inputs.TRIGGER_HELM_CICD == true }}
-        uses: benc-uk/workflow-dispatch@v1
+        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1
         with:
           workflow: 00-cicd.yaml
           repo: kubescape/helm-charts

.github/workflows/pr-merged.yaml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Get build number
         id: get-build
-        uses: mlilback/build-number@v1
+        uses: mlilback/build-number@81a5eb0abae9b77d036138284ba1094d49acbc32 # v1
         with:
           base: -550
           run-id: ${{ github.run_number }}

.github/workflows/scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@v2.4.0
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -59,14 +59,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
         with:
           sarif_file: results.sarif