Pin composite actions SHA

.github/actions/node/action.yml

@@ -8,7 +8,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
       with:
         node-version: ${{ inputs.version == 'eol' && '16' || inputs.version == 'oldest' && '18' || inputs.version == 'maintenance' && '20' || inputs.version == 'active' && '22' || inputs.version }}
         check-latest: true

.github/actions/plugins/test-and-upstream/action.yml

@@ -15,7 +15,7 @@ runs:
       shell: bash
     - run: yarn test:plugins:upstream
       shell: bash
-    - uses: codecov/codecov-action@v5
+    - uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:

.github/actions/plugins/test/action.yml

@@ -11,7 +11,7 @@ runs:
     - uses: ./.github/actions/node/active-lts
     - run: yarn test:plugins:ci
       shell: bash
-    - uses: codecov/codecov-action@v5
+    - uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:

.github/actions/plugins/upstream/action.yml

@@ -11,7 +11,7 @@ runs:
     - uses: ./.github/actions/node/active-lts
     - run: yarn test:plugins:upstream
       shell: bash
-    - uses: codecov/codecov-action@v5
+    - uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:

.github/actions/testagent/logs/action.yml

@@ -10,7 +10,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Create Artifacts Directories
       run: |
         mkdir -p "./artifacts/logs"
@@ -28,7 +28,7 @@ runs:
       shell: bash
     - name: Archive Test Agent Logs
       if:  runner.debug == '1' # only create test agent log artifacts if the github action has been re-run with debug mode
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: "test_agent_logs_${{ inputs.suffix }}"
         path: "./artifacts/logs"
@@ -48,7 +48,7 @@ runs:
         rm "$headers"
       shell: bash
     - name: Archive Test Agent Tested Versions Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: supported-integrations-${{ inputs.suffix }}
-        path: ./artifacts
+        path: ./artifacts

.github/actions/testagent/start/action.yml

@@ -3,6 +3,6 @@ description: "Starts the APM Test Agent image with environment."
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - run: docker compose up -d testagent || docker compose up -d testagent
       shell: bash

.github/dependabot.yml

@@ -6,7 +6,10 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
+      - "/.github/actions/*/*"
     schedule:
       interval: "monthly"
     groups: