refactor:[M3-7278] - SAST Scan Findings: Third party action not pinned to commit SHA

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -63,7 +63,7 @@ jobs:
     needs: build-validation
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -83,7 +83,7 @@ jobs:
     needs: build-validation
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -107,7 +107,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -148,7 +148,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -171,7 +171,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -186,7 +186,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -202,7 +202,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -222,7 +222,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -242,7 +242,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -266,7 +266,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -282,7 +282,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -302,7 +302,7 @@ jobs:
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -316,13 +316,13 @@ jobs:
           path: packages/api-v4/lib
       - run: pnpm install --frozen-lockfile
       - run: pnpm run --filter @linode/queries typecheck
-    
+
   typecheck-shared:
     runs-on: ubuntu-latest
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -340,13 +340,13 @@ jobs:
           path: packages/validation/lib
       - run: pnpm install --frozen-lockfile
       - run: pnpm run --filter @linode/shared typecheck
-    
+
   typecheck-manager:
     runs-on: ubuntu-latest
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -375,7 +375,7 @@ jobs:
       - validate-sdk
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -397,7 +397,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
       - run: pnpm publish -r --filter @linode/api-v4 --filter @linode/validation --no-git-checks --access public
       - name: slack-notify
-        uses: rtCamp/action-slack-notify@master
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
         env:
           SLACK_CHANNEL: api-js-client
           SLACK_TITLE: "Packages published"
@@ -413,7 +413,7 @@ jobs:
       NODE_OPTIONS: --max-old-space-size=4096
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -446,7 +446,7 @@ jobs:
         with:
           name: storybook-build
           path: storybook/build
-      - uses: jakejarvis/s3-sync-action@master
+      - uses: jakejarvis/s3-sync-action@be0c4ab89158cac4278689ebedd8407dd5f35a83 # v0.5.1
         with:
           args: --acl public-read --follow-symlinks --delete
         env:

.github/workflows/coverage_badge.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10

.github/workflows/docs.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Setup Pages
         uses: actions/configure-pages@v5
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.0.21
 

.github/workflows/e2e_schedule_and_push.yml

@@ -31,13 +31,13 @@ jobs:
       fail-fast: false
       matrix:
         user:
-          - { index: 1, name: 'USER_1' }
-          - { index: 2, name: 'USER_2' }
-          - { index: 3, name: 'USER_3' }
-          - { index: 4, name: 'USER_4' }
+          - { index: 1, name: "USER_1" }
+          - { index: 2, name: "USER_2" }
+          - { index: 3, name: "USER_3" }
+          - { index: 4, name: "USER_4" }
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
           version: 10
@@ -59,7 +59,7 @@ jobs:
       - run: pnpm run --filter @linode/validation build
       - run: pnpm run --filter @linode/api-v4 build
       - name: Run tests
-        uses: cypress-io/github-action@v6
+        uses: cypress-io/github-action@b8ba51a856ba5f4c15cf39007636d4ab04f23e3c # v6.10.2
         with:
           working-directory: packages/manager
           wait-on: "http://localhost:3000"

.github/workflows/eslint_review.yml

@@ -12,7 +12,7 @@ jobs:
         package: [manager, api-v4, queries, shared, ui, utilities, validation]
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b # v2.4.1
         with:
           run_install: false
           version: 10
@@ -26,5 +26,5 @@ jobs:
           workdir: packages/${{ matrix.package }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           reporter: github-pr-check
-          level: warning  # This will report both warnings and errors
-          filter_mode: added  # Only comment on new/modified lines
+          level: warning # This will report both warnings and errors
+          filter_mode: added # Only comment on new/modified lines

.github/workflows/security_scan.yml

@@ -15,22 +15,22 @@ jobs:
     container:
       image: returntocorp/semgrep
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      # Perform scanning using Semgrep
-      # Pass even when it identifies issues or encounters errors.
-    - name: Run SAST scan
-      if: always()
-      run: semgrep ci || true
-      env:
-         SEMGREP_RULES: p/default
+        # Perform scanning using Semgrep
+        # Pass even when it identifies issues or encounters errors.
+      - name: Run SAST scan
+        if: always()
+        run: semgrep ci || true
+        env:
+          SEMGREP_RULES: p/default
 
-      # Post results to Slack notification channel.
-    - name: slack-notify
-      uses: rtCamp/action-slack-notify@master
-      env:
+        # Post results to Slack notification channel.
+      - name: slack-notify
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_SAST_WEBHOOK }}
           SLACK_MESSAGE: "Message: ${{ github.event.head_commit.message }} \nRepository: ${{ github.event.repository.url }}"
           SLACK_COLOR: ${{ job.status }}
-          SLACK_FOOTER: ''
+          SLACK_FOOTER: ""
           MSG_MINIMAL: event,actions url,commit

packages/manager/.changeset/pr-12649-tech-stories-1754511442121.md

@@ -0,0 +1,5 @@
+---
+"@linode/manager": Tech Stories
+---
+
+Pin third-party GitHub Actions to commit SHAs for security ([#12649](https://github.com/linode/manager/pull/12649))