ci: pin third-party GitHub Actions to commit SHAs

Pins all 35 third-party action references currently on mutable tags
to the commit each tag resolves to, across 9 workflow files, keeping
a # tag comment. Ref-only, no behavior change.

.github/workflows/budibase_ci.yml

@@ -187,7 +187,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Use Node.js 22.x
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
       - run: cd charts/budibase && helm lint .
 
   test-libraries:
@@ -447,7 +447,7 @@ jobs:
       - name: Load dotenv
         if: needs.compute-affected-jobs.outputs.run_server_tests == 'true'
         id: dotenv
-        uses: falti/dotenv-action@v1.2.0
+        uses: falti/dotenv-action@73fafca04177425fd3e0a0849257015ae9d42034  # v1.2.0
         with:
           path: ./packages/server/images-sha.env
 

.github/workflows/cla.yml

@@ -14,7 +14,7 @@ jobs:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         # Beta Release
-        uses: cla-assistant/github-action@v2.1.2-beta
+        uses: cla-assistant/github-action@948230deb0d44dd38957592f08c6bd934d96d0cf  # v2.1.2-beta
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret

.github/workflows/close-featurebranch.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: passeidireto/trigger-external-workflow-action@main
+      - uses: passeidireto/trigger-external-workflow-action@d78a1f58cb96f3a637e37da56b8714f5a92c9d34  # main
         env:
           PAYLOAD_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.BRANCH || github.head_ref }}
           PAYLOAD_PR_NUMBER: ${{ github.event.pull_request.number }}

.github/workflows/deploy-featurebranch.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: passeidireto/trigger-external-workflow-action@main
+      - uses: passeidireto/trigger-external-workflow-action@d78a1f58cb96f3a637e37da56b8714f5a92c9d34  # main
         with:
           repository: budibase/featurebranches
           event: featurebranch-qa-deploy

.github/workflows/deploy-qa.yml

@@ -10,7 +10,7 @@ jobs:
   trigger-deploy-to-qa-env:
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/repository-dispatch@v2
+      - uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570  # v2
         with:
           repository: budibase/budibase-deploys
           event-type: budicloud-qa-deploy

.github/workflows/force-release.yml

@@ -35,7 +35,7 @@ jobs:
     needs: [ensure-is-master-tag]
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/repository-dispatch@v2
+      - uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570  # v2
         with:
           repository: budibase/budibase-deploys
           event-type: release-prod

.github/workflows/helm-validate.yml

@@ -15,7 +15,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
@@ -51,12 +51,12 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f  # v2
 
       - name: Add helm repositories
         run: helm repo add couchdb https://apache.github.io/couchdb-helm
@@ -87,7 +87,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
@@ -116,7 +116,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 

.github/workflows/pr-labeler.yml

@@ -12,7 +12,7 @@ jobs:
   size-labeler:
     runs-on: ubuntu-latest
     steps:
-      - uses: codelytv/pr-size-labeler@v1
+      - uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9  # v1
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           xs_max_size: "10"

.github/workflows/tag-release.yml

@@ -56,7 +56,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: peter-evans/repository-dispatch@v2
+      - uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570  # v2
         with:
           repository: budibase/budibase-deploys
           event-type: release-prod