ci: pin github action versions to commit hash

.github/workflows/admin-eslint.yml

@@ -35,17 +35,17 @@ jobs:
         id: version
         if: ${{ inputs.shopwareVersion == '.auto' || inputs.shopwareVersion == '' }}
       - name: Clone Shopware
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ inputs.shopware-repository || 'shopware/shopware' }}
           ref: ${{ steps.version.outputs.shopware-version || inputs.shopwareVersion }}
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.x'
 

.github/workflows/admin-jest.yml

@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload Coverage
         if: inputs.uploadCoverage == true
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         env:
           CODECOV_TOKEN: ${{ secrets.codecovToken }}
         with:

.github/workflows/build-docker-image.yml

@@ -26,7 +26,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
         - name: Checkout Repository
-          uses: actions/checkout@v6
+          uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
         - name: Login into Github Docker Registery
           run: echo "${{ secrets.ghToken }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
@@ -35,13 +35,13 @@ jobs:
           uses: shopware/shopware-cli-action@v3
 
         - name: Install Bun
-          uses: oven-sh/setup-bun@v2
+          uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
           if: inputs.use-bun == true
           with:
             bun-version: ${{ inputs.bun-version }}
 
         - name: Setup PHP
-          uses: shivammathur/setup-php@v2
+          uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
           with:
             php-version: '${{ inputs.php-version }}'
             extensions: ${{ inputs.php-extensions }}
@@ -53,7 +53,7 @@ jobs:
 
         - name: Cache Composer
           id: composer
-          uses: actions/cache@v5
+          uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
           with:
             path: ${{ steps.composer-cache.outputs.dir }}
             key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -78,7 +78,7 @@ jobs:
             GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
 
         - name: Build and push
-          uses: docker/build-push-action@v7
+          uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
           with:
             context: .
             file: ./docker/Dockerfile

.github/workflows/build-zip.yml

@@ -16,7 +16,7 @@ jobs:
     name: Build and Validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install shopware-cli
         uses: shopware/shopware-cli-action@v3
       - name: Build
@@ -26,7 +26,7 @@ jobs:
       - name: Validate
         run: shopware-cli extension validate ${{ inputs.extensionName }}.zip
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.extensionName }}
           path: ${{ inputs.extensionName }}.zip

.github/workflows/cs-fixer.yml

@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: 8.2
           tools: php-cs-fixer:3.63.2, cs2pr

.github/workflows/e2e.yml

@@ -73,7 +73,7 @@ jobs:
           install-admin: true
           allow-insecure-versions: true
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
       - name: Clone Dependencies
@@ -111,13 +111,13 @@ jobs:
           fi
       - name: Upload Playwright Artifacts
         if: ${{ inputs.e2eTestFramework == 'playwright' && failure() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-screenshots
           path: custom/plugins/${{ inputs.extensionName }}/${{ inputs.e2ePath }}/test-results
       - name: Upload Cypress Artifacts
         if: ${{ inputs.e2eTestFramework == 'cypress' && failure() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cypress-screenshots
           path: custom/plugins/${{ inputs.extensionName }}/${{ inputs.e2ePath }}/cypress/screenshots

.github/workflows/phpstan.yml

@@ -61,7 +61,7 @@ jobs:
           install: "true"
           allow-insecure-versions: true
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
       - name: Clone Dependencies
@@ -95,7 +95,7 @@ jobs:
         run: |
           printf "parameters:\n  tmpDir: ${{ env.SHOPWARE_TOOL_CACHE_PHPSTAN }}\nincludes:\n  - phpstan.neon.dist" > phpstan.neon
       - name: PHPStan cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.SHOPWARE_TOOL_CACHE_PHPSTAN }}
           key: ${{ runner.OS }}-${{ github.repository }}-phpstan-${{ github.sha }}

.github/workflows/phpunit.yml

@@ -81,7 +81,7 @@ jobs:
           php-extensions: pcov
           allow-insecure-versions: true
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
       - name: Clone Dependencies
@@ -110,7 +110,7 @@ jobs:
           fi
       - name: Upload Coverage
         if: inputs.uploadCoverage == true
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         env:
           CODECOV_TOKEN: ${{ secrets.codecovToken }}
         with:

.github/workflows/store-release.yml

@@ -39,7 +39,7 @@ jobs:
     environment: ${{ inputs.environment }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # fetch all git entries for changelog generation
           fetch-depth: 0
@@ -54,15 +54,15 @@ jobs:
           shopware-cli extension zip --git-commit ${{ github.sha }} "${{ inputs.path }}" --release
           mv ${{ inputs.extensionName }}-${{ github.sha }}.zip ${{ inputs.extensionName }}.zip
       - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.extensionName }}
           path: ${{ inputs.extensionName }}.zip
       - name: Get version
         run: |
           echo "EXTENSION_VERSION=$(shopware-cli extension get-version .)" >> $GITHUB_ENV
       - name: Check Tag existence
-        uses: mukunku/tag-exists-action@v1.7.0
+        uses: mukunku/tag-exists-action@5c39604fe8aef7e65acb6fbcf96ec580f7680313 # v1.7.0
         id: checkTag
         with:
           tag: ${{ env.EXTENSION_VERSION }}
@@ -97,7 +97,7 @@ jobs:
           git push origin ${EXTENSION_VERSION}
       - name: Create a GitHub release
         if: steps.checkTag.outputs.exists != 'true' && inputs.publishOnly == false
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           artifacts: /tmp/${{ inputs.extensionName }}.zip
           tag: ${{ env.EXTENSION_VERSION }}

.github/workflows/test.yml

@@ -7,7 +7,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             - id: version
               uses: ./shopware-version
               with:
@@ -44,7 +44,7 @@ jobs:
                       expected-version: "6.7.2.x"
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             - name: Test shopware-version
               id: version
               uses: ./shopware-version

.github/workflows/theme.yml

@@ -11,8 +11,8 @@ jobs:
     name: Build Theme
     runs-on: ${{ (github.event.act || !github.event.repository.private) && 'ubuntu-latest' || format('runs-on={0}/runner=sw-amd64', github.run_id) }}
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
-      - uses: actions/checkout@v6
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Build Theme
         uses: shopware/github-actions/build-zip@main
@@ -38,7 +38,7 @@ jobs:
         volumes:
           - /dev/shm/mysql:/var/lib/mysql
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
       - name: Setup and Install Theme
         uses: shopware/github-actions/setup-extension@main
         with:
@@ -58,8 +58,8 @@ jobs:
     outputs:
       test_jest: ${{ steps.should_run.outputs.test_jest }}
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
-      - uses: actions/checkout@v6
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Determine whether to run Jest tests
         id: should_run
@@ -75,8 +75,8 @@ jobs:
     env:
       STOREFRONT_PATH: "Resources/app/storefront"
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
-      - uses: actions/checkout@v6
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Execute Jest tests
         working-directory: ${{ env.STOREFRONT_PATH }}

.gitignore

@@ -0,0 +1 @@
+.idea

admin-jest/action.yml

@@ -24,7 +24,7 @@ runs:
 
     - name: Upload Coverage
       if: inputs.uploadCoverage == true
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
       with:
         root_dir: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}
         working-directory: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}

ai-release-notes/action.yml

@@ -112,7 +112,7 @@ runs:
 
     - name: Generate raw release notes via GitHub API
       id: raw-notes
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         INPUT_PREV_TAG: "${{ steps.prev-tag.outputs.prev_tag }}"
       with:
@@ -138,7 +138,7 @@ runs:
 
     - name: Rewrite release notes with AI
       id: ai-notes
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         GITHUB_TOKEN: "${{ inputs.github-token }}"
         RAW_NOTES: "${{ steps.raw-notes.outputs.body }}"
@@ -251,7 +251,7 @@ runs:
     - name: Create GitHub release
       id: create-release
       if: inputs.create-release == 'true'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         AI_NOTES: "${{ steps.ai-notes.outputs.notes }}"
         INPUT_RELEASE_NAME: "${{ inputs.release-name }}"

build-zip/action.yml

@@ -34,7 +34,7 @@ runs:
   using: "composite"
   steps:
     - name: Clone
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       if: inputs.skipCheckout == 'false'
       with:
           # fetch all git entries for changelog generation
@@ -51,7 +51,7 @@ runs:
       shell: bash
       run: shopware-cli extension validate ${{ inputs.extensionName }}.zip
     - name: Upload artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       id: upload
       with:
         name: ${{ inputs.extensionName }}.zip

cs-fixer/action.yml

@@ -15,10 +15,10 @@ runs:
   using: "composite"
   steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
       with:
         php-version: 8.2
         tools: php-cs-fixer:3.63.2, cs2pr

downstream/action.yml

@@ -62,7 +62,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
     - uses: shopware/octo-sts-action@main

eslint/action.yml

@@ -54,19 +54,19 @@ runs:
       id: version
       if: ${{ inputs.shopwareVersion == '.auto' || inputs.shopwareVersion == '' }}
     - name: Clone Shopware
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         repository: ${{ inputs.shopware-repository || 'shopware/shopware' }}
         ref: ${{ steps.version.outputs.shopware-version || inputs.shopwareVersion }}
         token: ${{ inputs.shopware-github-token }}
 
     - name: Clone Extension
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         path: custom/plugins/${{ inputs.extensionName }}
 
     - name: Setup Node
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: "24.x"
 

phpstan/action.yml

@@ -25,7 +25,7 @@ runs:
       run: |
         printf "parameters:\n  tmpDir: ${{ inputs.cacheDir }}\nincludes:\n  - phpstan.neon.dist" > phpstan.neon
     - name: PHPStan cache
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ inputs.cacheDir }}
         key: ${{ runner.OS }}-${{ github.repository }}-phpstan-${{ github.sha }}

phpunit/action.yml

@@ -32,7 +32,7 @@ runs:
         fi
     - name: Upload Coverage
       if: inputs.uploadCoverage == true
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
       with:
         root_dir: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}
         working-directory: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}