mesh-2834: update actions to use commit sha for versioning

.github/dependabot.yml

@@ -0,0 +1,19 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "MESH-2092 github actions "
+    groups:
+      dependencies:
+        patterns:
+          - "*"

.github/workflows/pull-request.yml

@@ -10,11 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'NHSDigital/mesh_validate_auth_header'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
 
-      - uses: subosito/flutter-action@v2
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: 'stable'
 
@@ -27,7 +27,7 @@ jobs:
       - run: flutter test -r expanded
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarcloud-github-action@master
+        uses: SonarSource/sonarcloud-github-action@ffc3010689be73b8e5ae0c57ce35968afd7909e8 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/release.yml

@@ -12,9 +12,9 @@ jobs:
       RELEASE_VERSION: ${{ steps.release_version.outputs.RELEASE_VERSION }}
       RELEASE_URL: ${{ steps.upload_url.outputs.RELEASE_URL }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - run: echo RELEASE_VERSION="$(grep 'version:' pubspec.yaml | sed -En 's/^version:\s(.*)\+.*$/\1/p')+${{github.run_number}}" >> $GITHUB_ENV
-      - uses: actions/create-release@v1
+      - uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         id: create_release
         continue-on-error: false
         env:
@@ -32,10 +32,10 @@ jobs:
     if: github.repository == 'NHSDigital/mesh_validate_auth_header'
     needs: create_release
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
-      - uses: subosito/flutter-action@v2
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: 'stable'
 
@@ -51,7 +51,7 @@ jobs:
           zip -r "${{ env.ZIP_NAME }}" .
 
       - name: upload bundle
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -60,7 +60,7 @@ jobs:
           asset_path: build/linux/x64/release/bundle/${{ env.ZIP_NAME }}
           asset_content_type: application/zip
 
-      - uses: fregante/setup-git-user@v1
+      - uses: fregante/setup-git-user@2e28d51939d2a84005a917d2f844090637f435f8 # v1
       - run: git checkout github-pages
       - run: git merge develop
       - run: rm -rf ./docs
@@ -76,9 +76,9 @@ jobs:
     if: github.repository == 'NHSDigital/mesh_validate_auth_header'
     needs: create_release
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
-      - uses: subosito/flutter-action@v2
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: 'stable'
 
@@ -87,14 +87,14 @@ jobs:
       - run: echo ZIP_NAME="mesh-validate-auth-windows-${{needs.create_release.outputs.RELEASE_VERSION}}.zip" >> $GITHUB_ENV
         shell: bash
 
-      - uses: thedoctor0/zip-release@main
+      - uses: thedoctor0/zip-release@b57d897cb5d60cb78b51a507f63fa184cfe35554 # v0.7.6
         with:
           directory: 'build/windows/runner/Release'
           type: 'zip'
           filename: ${{ env.ZIP_NAME }}
 
       - name: upload bundle
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/scheduled-combine-dependabot-prs.yaml

@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: combine-prs
         id: combine-prs
-        uses: github/combine-prs@v5.0.0
+        uses: github/combine-prs@a1b441298ab012db2ae25f7bf5fad0b7f78db9c4 # v5.0.0
         with:
           ci_required: ${{ inputs.ci_required == 'YES' }}
           labels: dependencies