Reference github actions by commit hash (#3989)

.github/workflows/common-integration-test.yaml

@@ -19,26 +19,26 @@ jobs:
     runs-on: "${{ matrix.os }}"
     steps:
       - name: Check out repository to use the build.gradle.kts as a hash file
-        uses: actions/[email protected]
+        uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11" # v4.1.1
         with:
           path: code
       - name: Download ${{ inputs.distribution }} libraries as an additional hash file
-        uses: actions/[email protected].1
+        uses: "actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427" # v4.1.4
         with:
           name: ${{ inputs.distribution }} installer libraries
           path: "${{ github.workspace }}/code/libraries.json"
       - name: "Setup JDK ${{ matrix.java }}"
-        uses: actions/setup-java@v4.0.0
+        uses: "actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9" # v4.2.1
         with:
           distribution: temurin
           java-version: "${{ matrix.java }}"
-      - uses: actions/[email protected].0
+      - uses: "actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9" # v4.0.2
         with:
           path: "${{ github.workspace}}/libraries"
           key: "${{runner.os}}-${{matrix.java}}-it-libraries-${{ hashFiles('code/build.gradle.kts') }}-${{ github.workspace }}/code/libraries.json"
           restore-keys: "${{runner.os}}-${{matrix.java}}-it-libraries-"
       - name: Download ${{ inputs.distribution }} server
-        uses: actions/[email protected].1
+        uses: "actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427" # v4.1.4
         with:
           name: ${{ inputs.distribution }} Production Jar
       - name: Run ${{ inputs.distribution }} Test (windows)

.github/workflows/common-run-build.yaml

@@ -19,7 +19,7 @@ jobs:
           runtime_version: 17
           publishing_branch_regex: 'api-\d+'
       - name: setup / cache minecraft dependencies
-        uses: actions/[email protected].0
+        uses: "actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9" # v4.0.2
         with:
           path: |
             ${{ github.workspace}}/buildSrc/.gradle/
@@ -37,7 +37,7 @@ jobs:
         env:
           CI_SYSTEM: Github Actions
       - name: Archive artifacts for build
-        uses: actions/upload-artifact@v4.2.0
+        uses: "actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3" # v4.3.1
         with:
           name: Sponge Jars
           path: |
@@ -46,17 +46,17 @@ jobs:
             ${{ github.workspace }}/vanilla/build/libs/*.jar
             ${{ github.workspace }}/forge/build/libs/*.jar
       - name: SpongeVanilla Production Jar
-        uses: actions/upload-artifact@v4.2.0
+        uses: "actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3" # v4.3.1
         with:
           name: SpongeVanilla Production Jar
           path: "${{ github.workspace }}/vanilla/build/libs/*-universal.jar"
       - name: SpongeForge Production Jar
-        uses: actions/upload-artifact@v4.2.0
+        uses: "actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3" # v4.3.1
         with:
           name: SpongeForge Production Jar
           path: "${{ github.workspace }}/forge/build/libs/*-universal.jar"
       - name: SpongeVanilla libraries
-        uses: actions/upload-artifact@v4.2.0
+        uses: "actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3" # v4.3.1
         with:
           name: SpongeVanilla installer libraries
           path: "${{ github.workspace }}/vanilla/build/resources/installer/libraries.json"

.github/workflows/deploy.yaml

@@ -29,7 +29,7 @@ jobs:
         with:
           runtime_version: 17
       - name: setup / minecraft cache
-        uses: actions/cache@v3
+        uses: "actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9" # v4.0.2
         with:
           path: |
             ${{ github.workspace}}/buildSrc/.gradle/