Use final version tags for standard GH actions, and SHA1 commit references to community GH actions.

.github/workflows/jacoco.yml

@@ -26,29 +26,32 @@ on:
 
 jobs:
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         include:
-          - scala: 2.12.18
+          - scala: 2.12.20
             scala_short: 2.12
-            spark: 3.4.1
+            spark: 3.4.4
             overall: 80.0
             changed: 80.0
     name: Test Coverage on Scala ${{matrix.scala}}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Setup Scala
-        uses: olafurpg/setup-scala@v10
+        uses: actions/checkout@v6.0.2
+      - name: Setup JDK
+        uses: actions/setup-java@v5.1.0
         with:
-          java-version: "adopt@1.8"
+          distribution: temurin
+          java-version: 8
+          cache: sbt
       - name: Build and run tests
         working-directory: ./pramen
         run: sbt -DSPARK_VERSION=${{matrix.spark}} ++${{matrix.scala}} jacoco
       - name: Add coverage to PR
         id: jacoco
-        uses: madrapps/jacoco-report@v1.7.1
+        # gh api repos/madrapps/jacoco-report/commits/v1.7.2 --jq '.sha'
+        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848
         with:
           paths: >
             ${{ github.workspace }}/pramen/core/target/scala-${{ matrix.scala_short }}/jacoco/report/jacoco.xml,
@@ -65,7 +68,7 @@ jobs:
           echo "Changed Files coverage ${{ steps.jacoco.outputs.coverage-changed-files }}"
       - name: Fail PR if unit test coverage is less than ${{ matrix.overall }}%
         if: (steps.jacoco.outputs.coverage-overall < matrix.overall)
-        uses: actions/github-script@v6
+        uses: actions/github-script@v6.4.1
         with:
           script: |
             core.setFailed('Unit test coverage is less than ${{ matrix.overall }}%!')

.github/workflows/python.yml

@@ -25,12 +25,13 @@ jobs:
         os-name: [ ubuntu-22.04 ]
     runs-on: ${{ matrix.os-name }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: setup poetry
-        uses: abatilo/actions-poetry@v3.0.2
+        # gh api repos/abatilo/actions-poetry/commits/v3.0.2 --jq '.sha'
+        uses: abatilo/actions-poetry@65c61eae400c65c9510a584af85138c1ae19bbc0
         with:
           poetry-version: 2.1.3
       - name: install dependencies
@@ -44,12 +45,13 @@ jobs:
         os-name: [ ubuntu-22.04 ]
     runs-on: ${{ matrix.os-name }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: setup poetry
-        uses: abatilo/actions-poetry@v3.0.2
+        # gh api repos/abatilo/actions-poetry/commits/v3.0.2 --jq '.sha'
+        uses: abatilo/actions-poetry@65c61eae400c65c9510a584af85138c1ae19bbc0
         with:
           poetry-version: 2.1.3
       - name: install dependencies

.github/workflows/release.yml

@@ -30,7 +30,7 @@ jobs:
   publish:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - uses: actions/setup-java@v4.2.1

.github/workflows/scala.yml

@@ -38,10 +38,10 @@ jobs:
     name: Test Spark ${{matrix.spark}} on Scala ${{matrix.scala}}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.2
       - uses: coursier/cache-action@v6
       - name: Setup JDK and sbt
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v4.2.1
         with:
           distribution: temurin
           java-version: 8