ci: update and pin actions

.github/actions/dotnet-test-build/action.yml

@@ -5,12 +5,12 @@ runs:
   using: "composite"
 
   steps:
-  - uses: actions/setup-dotnet@v4
+  - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
     with:
       dotnet-quality: ga
       dotnet-version: 11.0.x
 
-  - uses: actions/cache@v4
+  - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
     with:
       key: ${{ runner.os }}-nuget-${{ hashFiles('net/**/*.csproj') }}
       restore-keys: ${{ runner.os }}-nuget-

.github/actions/prepare-nuget-deps/action.yml

@@ -13,7 +13,7 @@ runs:
   using: "composite"
 
   steps:
-  - uses: actions/setup-dotnet@v4
+  - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
     with:
       dotnet-quality: ga
       dotnet-version: |

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
     - run: git config --global core.autocrlf true
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     - run: curl -L https://github.com/editorconfig-checker/editorconfig-checker/releases/download/2.3.5/ec-linux-amd64.tar.gz  | tar xzf - -C /opt
     - run: /opt/bin/ec-linux-amd64 -v
@@ -57,7 +57,7 @@ jobs:
     steps:
 
     - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     - name: Build no-jquery package
       run: node build/make-nojquery
@@ -75,7 +75,7 @@ jobs:
     - run: npm run karma-bundled-nojquery
     - run: npm run karma-bundled-nojquery-cjs
 
-    - uses: codecov/codecov-action@v3
+    - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
       with:
         files: js-test/coverage/lcov.info
 
@@ -85,15 +85,15 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     - run: nuget install -Verbosity quiet -ExcludeVersion -OutputDirectory . -Version 2022.2.3 JetBrains.dotCover.CommandLineTools
 
     - uses: ./.github/actions/dotnet-test-build
 
     - run: JetBrains.dotCover.CommandLineTools\tools\dotCover cover --ReturnTargetExitCode --ReportType=DetailedXML --Filters="+:module=DevExtreme.AspNet.Data" --Output=coverage_dotnet.xml --TargetExecutable=net\dotnet-test-all.cmd
 
-    - uses: codecov/codecov-action@v4
+    - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
       with:
         files: coverage_dotnet.xml
 
@@ -107,7 +107,7 @@ jobs:
       BUILD_CONFIGURATION: ${{ (github.repository == 'DevExpress/DevExtreme.AspNet.Data' && github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)) && 'Release' || 'Debug' }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     - run: node build/make-nojquery
     - run: node build/replace-meta "${{ github.run_number }}" "${{ github.ref }}" "${{ github.repository }}"
@@ -130,7 +130,7 @@ jobs:
       shell: bash
       run: rm -f net/DevExtreme.AspNet.Data/release.snk
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: release-packages
         path: |
@@ -145,12 +145,12 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     - run: dotnet build net/DevExtreme.AspNet.Data
     - run: net\docfx\build.cmd
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: docfx-site
         path: net/docfx/build/site

.github/workflows/codeql-analysis.yml

@@ -46,11 +46,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/codeql-config.yml
@@ -67,6 +67,6 @@ jobs:
       uses: ./.github/actions/dotnet-test-build
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/publish.yml

@@ -34,11 +34,11 @@ jobs:
       BUILD_CONFIGURATION: Release
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         persist-credentials: false
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
       with:
         node-version: '24'
 
@@ -68,15 +68,15 @@ jobs:
       run: rm -f net/DevExtreme.AspNet.Data/release.snk
 
     - name: Upload npm packages as artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: npm-packages
         path: devextreme-aspnet-data-*.tgz
         retention-days: 7
         if-no-files-found: error
 
     - name: Upload NuGet packages as artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: nuget-packages
         path: net/DevExtreme.AspNet.Data/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
@@ -93,12 +93,12 @@ jobs:
       id-token: write
 
     steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
       with:
         node-version: '24'
         registry-url: 'https://registry.npmjs.org'
 
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
       with:
         name: npm-packages