.github/workflows/codeql_analysis.yml

@@ -23,7 +23,7 @@ jobs:
       security-events: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Initialize CodeQL
       uses: https://github.com/github/codeql-action/init@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12

.github/workflows/deploy_github_releases.yml

@@ -11,7 +11,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Decrypt secrets
       shell: bash
@@ -26,19 +26,19 @@ jobs:
         SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
 
     - name: Upload non-free release APK
-      uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+      uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
       with:
         name: APS Non-Free Release APK
         path: app/build/outputs/apk/nonFree/release/app-nonFree-release.apk
 
     - name: Upload non-free release Bundle
-      uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+      uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
       with:
         name: APS Non-Free Release Bundle
         path: app/build/outputs/bundle/nonFreeRelease/app-nonFree-release.aab
 
     - name: Upload free release APK
-      uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+      uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
       with:
         name: APS Free Release APK
         path: app/build/outputs/apk/free/release/app-free-release.apk

.github/workflows/deploy_library_releases.yml

@@ -10,7 +10,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Upload binaries
       shell: bash

.github/workflows/deploy_snapshot.yml

@@ -20,7 +20,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Decrypt secrets
       shell: bash
@@ -41,7 +41,7 @@ jobs:
       run: scripts/signing-cleanup.sh
 
     - name: Deploy snapshot
-      uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+      uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
       with:
         name: snapshot.zip
         path: app/build/outputs/

.github/workflows/draft_new_release.yml

@@ -34,7 +34,7 @@ jobs:
           echo "PR_HEAD=release-prep" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Update changelog
         uses: https://github.com/thomaseizinger/keep-a-changelog-new-release@f62c3c390716df5af712ba5d94f4f4a8efc1306d # 3.1.0

.github/workflows/pull_request.yml

@@ -17,7 +17,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Check codestyle
         shell: bash
@@ -25,7 +25,7 @@ jobs:
 
       - name: Upload Kotlin build report
         if: "${{ always() }}"
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Build report (check-codestyle)
           path: build/reports/kotlin-build/
@@ -35,7 +35,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Run unit tests
         shell: bash
@@ -43,14 +43,14 @@ jobs:
 
       - name: (Fail-only) Upload test report
         if: "${{ failure() }}"
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Test report (unit-tests)
           path: app/build/reports
 
       - name: Upload Kotlin build report
         if: "${{ always() }}"
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Build report (unit-tests)
           path: build/reports/kotlin-build/
@@ -60,21 +60,21 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Build debug APKs
         shell: bash
         run: ./gradlew assembleFreeDebug assembleNonFreeDebug assembleNonFreeRelease
 
       - name: Upload built APKs
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Built APKs
           path: app/build/outputs/
 
       - name: Upload Kotlin build report
         if: "${{ always() }}"
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Build report (build-apks)
           path: build/reports/kotlin-build/
@@ -84,7 +84,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Check library API
         shell: bash
@@ -92,7 +92,7 @@ jobs:
 
       - name: Upload Kotlin build report
         if: "${{ always() }}"
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Build report (check-api)
           path: build/reports/kotlin-build/
@@ -102,7 +102,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Run Lint
         shell: bash
@@ -110,7 +110,7 @@ jobs:
 
       - name: Upload Kotlin build report
         if: "${{ always() }}"
-        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/forgejo/upload-artifact@16871d9e8cfcf27ff31822cac382bbb5450f1e1e # v4
         with:
           name: Build report (lint)
           path: build/reports/kotlin-build/

.github/workflows/shadow_job.yml

@@ -29,7 +29,7 @@ jobs:
     name: Run AGP-${{ matrix.agp-version }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Run checks
       shell: bash

.github/workflows/sync_crowdin.yml

@@ -8,7 +8,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Sync translations to/from Crowdin
         id: crowdin

.github/workflows/update_publicsuffix_data.yml

@@ -10,7 +10,7 @@ jobs:
       image: cimg/android:2025.03.1-node
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Download new publicsuffix data
         shell: bash