chore(deps): update github actions dependencies

.github/workflows/ci.yml

@@ -36,27 +36,27 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
-          java-version: '21'
-      - uses: gradle/actions/setup-gradle@v6
+          java-version: '21.0.12+8.0.LTS'
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       - name: Export OpenAPI spec
         run: ./gradlew :api:exportOpenApiSpec --no-daemon
       - name: Check committed OpenAPI spec
         run: git diff --exit-code -- client-spec/openapi/agents-api.json
-      - uses: JorisJonkers-dev/api-contract-checks@v1.0.0
+      - uses: JorisJonkers-dev/api-contract-checks@f1b324b45e4fadf3be9581c68ad0713b754f3196 # v1.1.0
         with:
           profile: agents-api
           spec-path: client-spec/openapi/agents-api.json
           export-command: ./gradlew :api:exportOpenApiSpec --no-daemon
           guidance: ./gradlew :api:exportOpenApiSpec
       - name: Fetch base OpenAPI spec
         run: git fetch --depth=1 origin ${{ github.base_ref || 'main' }}
-      - uses: oasdiff/oasdiff-action/breaking@v0
+      - uses: oasdiff/oasdiff-action/breaking@5e81b5c380accc6b523f9d32a637ca630e33620b # v0.1.17
         with:
           base: origin/${{ github.base_ref || 'main' }}:client-spec/openapi/agents-api.json
           revision: HEAD:client-spec/openapi/agents-api.json
@@ -91,10 +91,10 @@ jobs:
     # layers; the timeout covers the cold build after a tooling-pin bump.
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: Build agents-api image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: Dockerfile
@@ -151,6 +151,6 @@ jobs:
       ]
     if: ${{ always() }}
     steps:
-      - uses: re-actors/alls-green@release/v1
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # release/v1
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/publish.yml

@@ -43,7 +43,7 @@ jobs:
     outputs:
       images-lock-artifact: images-lock-${{ github.run_id }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}
 
@@ -90,7 +90,7 @@ jobs:
           esac
 
       - name: upload-image-lock
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: images-lock-${{ github.run_id }}
           path: platform/images.lock.json

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: mint-app-token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
@@ -43,7 +43,7 @@ jobs:
           fi
           echo "App token minted successfully (token prefix: ${APP_TOKEN:0:4}...)"
 
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
           token: ${{ steps.app-token.outputs.token }}