Pin dependencies

.github/actions/gradle-task/action.yml

@@ -26,7 +26,7 @@ runs :
   steps :
 
     - name : Set up JDK
-      uses : actions/setup-java@v3
+      uses : actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3
       with :
         distribution : ${{inputs.distribution}}
         java-version : ${{inputs.java-version}}
@@ -36,7 +36,7 @@ runs :
       uses : ./.github/actions/gradle-args
 
     - name : Gradle build action
-      uses : gradle/gradle-build-action@v2
+      uses : gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2
       with :
         cache-read-only : false
         gradle-home-cache-cleanup : true
@@ -59,7 +59,7 @@ runs :
     - name : restore cache for ${{inputs.write-cache-key}}
       id : restore-write-cache
       if : inputs.write-cache-key != 'null'
-      uses : actions/cache/restore@v4
+      uses : actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4
       with :
         path : |
           ~/.gradle/caches/build-cache-1
@@ -77,7 +77,7 @@ runs :
     # Skipped if the restore-cache-key wasn't set, or if the write-cache-key restore had an exact match.
     - name : restore cache for ${{inputs.restore-cache-key}}
       if : inputs.restore-cache-key != 'null' && steps.restore-write-cache.outputs.cache-hit != 'true'
-      uses : actions/cache/restore@v4
+      uses : actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4
       with :
         path : |
           ~/.gradle/caches/build-cache-1
@@ -91,11 +91,11 @@ runs :
           ${{runner.os}}-${{inputs.restore-cache-key}}-${{steps.hashes.outputs.lib_versions}}
           ${{runner.os}}-${{inputs.restore-cache-key}}
 
-    - uses : gradle/wrapper-validation-action@v1
+    - uses : gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # v1
 
     # Run the actual task.  Note that this still uses gradle-build-action for more fine-grained caching.
     - name : Run ${{inputs.task}}
-      uses : gradle/gradle-build-action@v2
+      uses : gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2
       with :
         # These arguments need to be on a single line. If they're defined with wrapping (using `|`),
         # something along the way to the actual CLI invocation gets confused and the jvmargs list
@@ -110,7 +110,7 @@ runs :
     # Windows runners are welcome to *read* the cross-OS cache, but the directories get weird if
     # they try to write to it.
     - name : save the '${{inputs.write-cache-key}}' cache
-      uses : actions/cache/save@v4
+      uses : actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4
       id : save-write-cache-key
       if : inputs.write-cache-key != 'null' && steps.restore-write-cache.outputs.cache-hit != 'true'
       with :
@@ -123,7 +123,7 @@ runs :
 
     - name : Upload heap dump
       if : failure()
-      uses : actions/upload-artifact@v3
+      uses : actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
       with :
         name : heap-dump
         path : ${{github.workspace}}/**/*{.hprof,.log}

.github/actions/gradle-tasks-with-emulator/action.yml

@@ -53,7 +53,7 @@ runs :
 
     # Get the AVD if it's already cached.
     - name : AVD cache
-      uses : actions/cache/restore@v4
+      uses : actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4
       id : restore-avd-cache
       with :
         path : |
@@ -64,7 +64,7 @@ runs :
     # If the AVD cache didn't exist, create an AVD
     - name : create AVD and generate snapshot for caching
       if : steps.restore-avd-cache.outputs.cache-hit != 'true'
-      uses : reactivecircus/android-emulator-runner@v2
+      uses : reactivecircus/android-emulator-runner@6b0df4b0efb23bb0ec63d881db79aefbc976e4b2 # v2
       with :
         api-level : ${{ inputs.api-level }}
         arch : x86_64
@@ -80,7 +80,7 @@ runs :
     - name : cache new AVD before tests
       if : steps.restore-avd-cache.outputs.cache-hit != 'true'
       id : save-avd-cache
-      uses : actions/cache/save@v4
+      uses : actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4
       with :
         path : |
           ~/.android/avd/*
@@ -90,7 +90,7 @@ runs :
     # Run the actual emulator tests.
     # At this point every task should be up-to-date and the AVD should be ready to go.
     - name : run tests
-      uses : reactivecircus/android-emulator-runner@v2
+      uses : reactivecircus/android-emulator-runner@6b0df4b0efb23bb0ec63d881db79aefbc976e4b2 # v2
       with :
         api-level : ${{ inputs.api-level }}
         arch : x86_64
@@ -102,7 +102,7 @@ runs :
 
     - name : Upload results
       if : ${{ always() }}
-      uses : actions/upload-artifact@v3
+      uses : actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
       with :
         name : instrumentation-test-results
         path : ./**/build/reports/androidTests/connected/**

.github/workflows/kotlin.yml

@@ -183,7 +183,7 @@ jobs :
 
       # Report as GitHub Pull Request Check.
       - name : Publish Test Report
-        uses : mikepenz/action-junit-report@v3
+        uses : mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3
         if : always() # always run even if the previous step fails
         with :
           report_paths : '**/build/test-results/test/TEST-*.xml'
@@ -222,7 +222,7 @@ jobs :
 
       # Report as GitHub Pull Request Check.
       - name : Publish Test Report
-        uses : mikepenz/action-junit-report@v3
+        uses : mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3
         if : always() # always run even if the previous step fails
         with :
           report_paths : '**/build/test-results/test/TEST-*.xml'
@@ -244,7 +244,7 @@ jobs :
 
       # Report as GitHub Pull Request Check.
       - name : Publish Test Report
-        uses : mikepenz/action-junit-report@v3
+        uses : mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3
         if : always() # always run even if the previous step fails
         with :
           report_paths : '**/build/test-results/test/TEST-*.xml'
@@ -266,7 +266,7 @@ jobs :
 
       # Report as GitHub Pull Request Check.
       - name : Publish Test Report
-        uses : mikepenz/action-junit-report@v3
+        uses : mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3
         if : always() # always run even if the previous step fails
         with :
           report_paths : '**/build/test-results/test/TEST-*.xml'
@@ -288,7 +288,7 @@ jobs :
 
       # Report as GitHub Pull Request Check.
       - name : Publish Test Report
-        uses : mikepenz/action-junit-report@v3
+        uses : mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3
         if : always() # always run even if the previous step fails
         with :
           report_paths : '**/build/test-results/test/TEST-*.xml'
@@ -312,7 +312,7 @@ jobs :
 
       # Report as GitHub Pull Request Check.
       - name : Publish Test Report
-        uses : mikepenz/action-junit-report@v3
+        uses : mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3
         if : always() # always run even if the previous step fails
         with :
           report_paths : '**/build/test-results/test/TEST-*.xml'

.github/workflows/publish-release.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # v1
 
       - name: Ensure this isn't a -SNAPSHOT version
         uses: ./.github/actions/gradle-task

.github/workflows/publish-snapshot.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # v1
 
       - name: Check for -SNAPSHOT version
         uses: ./.github/actions/gradle-task