chore: pin GitHub Actions to commit shas BED-7914

.github/workflows/build.yml

@@ -2,20 +2,20 @@ name: Build
 
 on:
   pull_request:
-    branches: [ 2.X ]
+    branches: [2.X]
 
 jobs:
   build:
     runs-on: windows-latest
 
     steps:
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # ratchet:actions/setup-dotnet@v5
         with:
           dotnet-version: 10.0.x
 
       - name: Checkout repository
-        uses: actions/checkout@v6
-        
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+
       - name: Build
-        run: dotnet build -p:CommonSource=Dev
+        run: dotnet build -p:CommonSource=Dev

.github/workflows/cla.yml

@@ -41,7 +41,7 @@ jobs:
 
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.6.1
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # ratchet:contributor-assistant/github-action@v2.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PERSONAL_ACCESS_TOKEN: ${{ secrets.REPO_SCOPE }}

.github/workflows/publish.yml

@@ -1,53 +1,53 @@
-name: Publish
-
-on:
-  push: 
-    tags:
-      - v[0-9]+.[0-9]+.[0-9]+*
-
-jobs:
-  build:
-    runs-on: windows-latest
-    defaults:
-      run:
-        shell: bash
-
-    strategy:
-      matrix:
-        release:
-          - type: Debug
-            suffix: '+debug'
-          - type: Release
-            suffix: ''
-
-    name: Build (${{ matrix.release.type }})
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: 10.0.x
-
-      - name: Restore Dependencies
-        run: dotnet restore
-
-      - name: Build
-        run: |
-          VERSION=${{ github.ref_name }}
-          dotnet build -c ${{ matrix.release.type }} -p:Version=${VERSION:1} -p:CommonLibSource=Release
-
-      - name: Zip
-        run: 7z a -tzip -mx9 SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip $PWD/bin/${{ matrix.release.type }}/net472/*
-
-      - name: Checksum zip files
-        run: |
-          sha256sum SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip > SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip.sha256
-
-      - name: Upload to Release
-        uses: softprops/action-gh-release@v1
-        with:
-          files: |
-            SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip
-            SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip.sha256
+name: Publish
+
+on:
+  push:
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+*
+
+jobs:
+  build:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+
+    strategy:
+      matrix:
+        release:
+          - type: Debug
+            suffix: '+debug'
+          - type: Release
+            suffix: ''
+
+    name: Build (${{ matrix.release.type }})
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # ratchet:actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Restore Dependencies
+        run: dotnet restore
+
+      - name: Build
+        run: |
+          VERSION=${{ github.ref_name }}
+          dotnet build -c ${{ matrix.release.type }} -p:Version=${VERSION:1} -p:CommonLibSource=Release
+
+      - name: Zip
+        run: 7z a -tzip -mx9 SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip $PWD/bin/${{ matrix.release.type }}/net472/*
+
+      - name: Checksum zip files
+        run: |
+          sha256sum SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip > SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip.sha256
+
+      - name: Upload to Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # ratchet:softprops/action-gh-release@v3
+        with:
+          files: |
+            SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip
+            SharpHound_${{ github.ref_name }}${{ matrix.release.suffix }}_windows_x86.zip.sha256