From d5cc9c5f120d19339952ecea4edb7cc791f13237 Mon Sep 17 00:00:00 2001
From: cruizba <carlos.ruizbal@gmail.com>
Date: Wed, 25 Mar 2026 17:52:57 +0100
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs

---
 .github/workflows/openvidu-ce-test.yml        |  6 ++---
 .../openvidu-components-angular-E2E.yml       | 24 +++++++++----------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/openvidu-ce-test.yml b/.github/workflows/openvidu-ce-test.yml
index 8b05df906..f31be7675 100644
--- a/.github/workflows/openvidu-ce-test.yml
+++ b/.github/workflows/openvidu-ce-test.yml
@@ -59,7 +59,7 @@ jobs:
       FIREFOX_VERSION: ${{ inputs.FIREFOX_VERSION || 'latest' }}
       EDGE_VERSION: ${{ inputs.EDGE_VERSION || 'latest' }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Setup scripts
         run: |
           curl -sOJ --output-dir /opt https://raw.githubusercontent.com/OpenVidu/openvidu/v2/ci-scripts/commons/build.sh
@@ -100,12 +100,12 @@ jobs:
       - name: OpenVidu E2E Tests Kurento
         run: /opt/openvidu-e2e-tests.sh --openvidu-e2e-tests-kurento
       - name: Test reports
-        uses: mikepenz/action-junit-report@v3
+        uses: mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058 # v3.8.0
         if: always() # always run even if the previous step fails
         with:
           report_paths: "**/target/surefire-reports/TEST-*.xml"
       - name: Upload logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always() # always run even if the previous step fails
         with:
           name: Logs
diff --git a/.github/workflows/openvidu-components-angular-E2E.yml b/.github/workflows/openvidu-components-angular-E2E.yml
index 0054b1f4a..b9e2aedf9 100644
--- a/.github/workflows/openvidu-components-angular-E2E.yml
+++ b/.github/workflows/openvidu-components-angular-E2E.yml
@@ -24,10 +24,10 @@ jobs:
     name: Test setup
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: ${{ inputs.commit_sha || github.sha }}
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20'
     - name: Commit URL
@@ -51,7 +51,7 @@ jobs:
         npm install
         npm run build && \
         npm pack
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: openvidu-browser
         path: openvidu-browser/openvidu-browser-*.tgz
@@ -62,13 +62,13 @@ jobs:
     name: OpenVidu Angular E2E tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: ${{ inputs.commit_sha || github.sha }}
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20'
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: openvidu-browser
         path: openvidu-components-angular
@@ -97,13 +97,13 @@ jobs:
     name: Webcomponent E2E CE tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: ${{ inputs.commit_sha || github.sha }}
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20'
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: openvidu-browser
         path: openvidu-components-angular
@@ -133,11 +133,11 @@ jobs:
     name: Webcomponent E2E PRO tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20'
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: openvidu-browser
         path: openvidu-components-angular