ci: update and pin GitHub actions

.github/workflows/_regression-job.yml

@@ -25,13 +25,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Setup GCP credentials
         if: inputs.platform == 'gcp'
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
           credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_JSON }}
 
@@ -50,7 +51,7 @@ jobs:
           echo "AWS_DEFAULT_REGION=${{ secrets.AWS_DEFAULT_REGION || 'us-east-1' }}" >> $GITHUB_ENV
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Create virtual environment and install SeBS
         run: |
@@ -90,7 +91,7 @@ jobs:
 
       - name: Upload test summary
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-summary-${{ inputs.platform }}-${{ inputs.language }}-${{ inputs.version }}
           path: test-summary.txt
@@ -105,17 +106,16 @@ jobs:
 
       - name: Upload regression results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: results-${{ inputs.platform }}-${{ inputs.language }}-${{ inputs.version }}
           path: results/
           if-no-files-found: ignore
 
       - name: Upload cache snapshot
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cache-snapshot-${{ inputs.platform }}-${{ inputs.language }}-${{ inputs.version }}
           path: regression-cache/
           if-no-files-found: ignore
-

.github/workflows/lint.yml

@@ -11,27 +11,25 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.10
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.10'
+          python-version: "3.10"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          cache-dependency-glob: |
+            requirements.txt
+            pyproject.toml
 
       - name: Install system dependencies
         run: sudo apt update && sudo apt install -y libcurl4-openssl-dev
 
-      - name: Cache uv dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/uv
-          key: uv-${{ runner.os }}-${{ hashFiles('requirements.txt', 'pyproject.toml') }}
-          restore-keys: |
-            uv-${{ runner.os }}-
-
       - name: Install SeBS with dev dependencies
         run: uv sync --extra dev
 
@@ -49,7 +47,7 @@ jobs:
 
       - name: Upload flake8 reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: flake-reports
           path: flake-reports

.github/workflows/regression-whisk.yml

@@ -5,7 +5,7 @@ on:
   push:
     branches:
       - master
-      - 'feature/**'
+      - "feature/**"
 
 jobs:
   regression:
@@ -43,9 +43,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
+          persist-credentials: false
 
       #- name: Reclaim disk
       #  run: |
@@ -68,7 +69,7 @@ jobs:
           kubectl version --client
 
       - name: Install helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: latest
 
@@ -80,7 +81,7 @@ jobs:
           sudo install -m 0755 wsk /usr/local/bin/wsk
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Create virtual environment and install SeBS
         run: |
@@ -260,7 +261,7 @@ jobs:
 
       - name: Upload regression artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: openwhisk-regression-artifacts-${{ matrix.language }}-${{ matrix.version }}-${{ matrix.architecture }}
           path: |

.github/workflows/regression.yml

@@ -82,7 +82,7 @@ jobs:
             architecture: "x64"
       fail-fast: false
 
-    uses: ./.github/workflows/_regression-job.yml
+    uses: $/.github/workflows/_regression-job.yml
     with:
       platform: ${{ matrix.platform }}
       language: ${{ matrix.language }}