security: pin all GitHub Actions to commit SHAs (GHSA-f9f8-rm49-7jv2)

.github/workflows/functional-tests.yml

@@ -23,7 +23,12 @@ jobs:
           MYSQL_DATABASE: magento
         ports:
           - 3306:3306
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -pmagento --silent"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+          --health-start-period=30s
 
       opensearch:
         image: opensearchproject/opensearch:2.11.0
@@ -42,7 +47,7 @@ jobs:
           path: mageforge
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f
         with:
           php-version: "8.4"
           extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets

.github/workflows/label.yml

@@ -17,6 +17,6 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/magento-compatibility.yml

@@ -7,6 +7,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   magento-compatibility-matrix:
     name: Magento ${{ matrix.magento-version }} with PHP ${{ matrix.php-version }}
@@ -15,16 +18,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - magento-version: "2.4.7-p9"
+          - magento-version: "2.4.7-p10"
             php-version: "8.3"
             search-engine-name: "opensearch"
-          - magento-version: "2.4.8-p4"
-            php-version: "8.4"
-            search-engine-name: "opensearch"
-          - magento-version: "2.4.9-beta1"
+          - magento-version: "2.4.8-p5"
             php-version: "8.4"
             search-engine-name: "opensearch"
-          - magento-version: "2.4.9-beta1"
+          - magento-version: "2.4.9"
             php-version: "8.5"
             search-engine-name: "opensearch"
 
@@ -60,7 +60,7 @@ jobs:
           path: mageforge
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f
         with:
           php-version: ${{ matrix.php-version }}
           extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets

.github/workflows/phpcs.yml

@@ -14,12 +14,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ env.PHP_VERSION }}
+          tools: composer:v2
 
       - name: Install Magento Coding Standard
         run: composer create-project magento/magento-coding-standard --stability=dev /tmp/magento-coding-standard

.github/workflows/phpstan.yml

@@ -37,20 +37,20 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           path: mageforge
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: "8.4"
           extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets
           tools: composer:v2
 
       - name: Cache Composer packages
         id: composer-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.composer/cache/files
           key: ${{ runner.os }}-composer-2.4.8-${{ hashFiles('**/composer.json') }}

.github/workflows/release-please.yml

@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run Release Please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         with:
           # The GitHub token for creating releases and pull requests
           token: ${{ secrets.GITHUB_TOKEN }}
-          
+
           # Path to release-please-config.json
           config-file: release-please-config.json
-          
+
           # Path to .release-please-manifest.json
           manifest-file: .release-please-manifest.json