chore(ci): pin github actions (#7480)

.github/workflows/build.yml

@@ -41,18 +41,18 @@ jobs:
 
     steps:
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v1.4.4
         with:
           node-version: ${{ env.NODE_VERSION }}
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v1.2.1
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Set up Java  ${{ env.JAVA_VERSION }}
         if: env.NODE_VERSION == '12'
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v1.4.3
         with:
           java-version: ${{ env.JAVA_VERSION }}
 
@@ -72,11 +72,11 @@ jobs:
           python --version
           echo "Yarn $(yarn --version)"
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.3
 
       - name: Cache Yarn packages
         id: yarn_cache_packages
-        uses: actions/cache@v2
+        uses: actions/cache@v2.1.2
         with:
           path: ${{ env.YARN_CACHE_FOLDER }}
           key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
@@ -98,7 +98,7 @@ jobs:
         run: yarn jest --maxWorkers=2 --ci --coverage ${{ env.coverage }}
 
       - name: Upload coverage
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v2.2.0
         if: always() && env.coverage == 'true'
         with:
           name: coverage
@@ -123,7 +123,7 @@ jobs:
 
     steps:
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v1.4.4
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -137,11 +137,11 @@ jobs:
           echo "Node $(node --version)"
           echo "Yarn $(yarn --version)"
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.3
 
       - name: Cache Yarn packages
         id: yarn_cache_packages
-        uses: actions/cache@v2
+        uses: actions/cache@v2.1.2
         with:
           path: ${{ env.YARN_CACHE_FOLDER }}
           key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
@@ -175,7 +175,7 @@ jobs:
 
     steps:
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v1.4.4
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -189,12 +189,12 @@ jobs:
           npm config set scripts-prepend-node-path true
 
       # full checkout for semantic-release
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.3
         with:
           fetch-depth: 0
 
       - name: Cache Yarn packages
-        uses: actions/cache@v2
+        uses: actions/cache@v2.1.2
         with:
           path: ${{ env.YARN_CACHE_FOLDER }}
           key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}

.github/workflows/codeql-analysis.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.3
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.

.github/workflows/release-npm.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v1.4.4
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -29,13 +29,13 @@ jobs:
           yarn config set version-git-tag false
           npm config set scripts-prepend-node-path true
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.3
         with:
           ref: ${{ github.event.client_payload.sha }}
 
       - name: Cache Yarn packages
         id: yarn_cache_packages
-        uses: actions/cache@v2
+        uses: actions/cache@v2.1.2
         with:
           path: ${{ env.YARN_CACHE_FOLDER }}
           key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}

renovate.json

@@ -63,6 +63,12 @@
         "datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sENV .*?_VERSION=(?<currentValue>.*)\\s"
       ],
       "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
+    },
+    {
+      "fileMatch": ["^\\.github/workflows/[^/]+\\.ya?ml$"],
+      "matchStrings": ["uses: (?<depName>[a-z-/]+?)@(?<currentValue>.+?)\\s"],
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "docker"
     }
   ]
 }