[dev] Pin Github actions to full-commit SHA (#2194)

.github/workflows/approved-with-labels.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Label when approved
-      uses: pullreminders/label-when-approved-action@master
+      uses: pullreminders/label-when-approved-action@09b41ee798957cb258b29e12f7619bf18d229109 #v1.0.7
       env:
         APPROVALS: "1"
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/e2e-tests.yml

@@ -44,7 +44,7 @@ jobs:
                   npm run test:e2e
 
             - name: Archive debug artifacts (screenshots, HTML snapshots)
-              uses: actions/upload-artifact@v3
+              uses: actions/upload-artifact@v4
               if: always()
               with:
                   name: failures-artifacts

.github/workflows/linting.yml

@@ -55,7 +55,7 @@ jobs:
                   path: eslint_report.json
             - if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
               name: Annotate Code Linting Results
-              uses: ataylorme/eslint-annotate-action@1.2.0
+              uses: ataylorme/eslint-annotate-action@a1bf7cb320a18aa53cb848a267ce9b7417221526 # v1.2.0
               with:
                   repo-token: '${{ secrets.GITHUB_TOKEN }}'
                   report-json: 'eslint_report.json'

.github/workflows/php-coding-standards.yml

@@ -42,7 +42,7 @@ jobs:
                   restore-keys: |
                       ${{ runner.os }}-composer-
             - name: Set up PHP
-              uses: shivammathur/setup-php@v2
+              uses: shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e # v2.24.1
               with:
                   php-version: '7.4'
                   coverage: none