diff --git a/.github/actions/core-cicd/cleanup-runner/Readme.md b/.github/actions/core-cicd/cleanup-runner/Readme.md
index 6559555feeef..02761cedc32f 100644
--- a/.github/actions/core-cicd/cleanup-runner/Readme.md
+++ b/.github/actions/core-cicd/cleanup-runner/Readme.md
@@ -42,7 +42,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Your build steps here...
 
diff --git a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
index 66c13bf1c386..37ea988bd516 100644
--- a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
@@ -39,12 +39,12 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
     - name: 'Set up Node.js'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
@@ -55,8 +55,9 @@ runs:
 
     - name: 'Download all cli build artifacts.'
       id: download-cli-artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         pattern: cli-artifacts-*
         path: ${{ github.workspace }}/artifacts
         github-token: ${{ inputs.github-token }} # token with actions:read permissions on target repo
diff --git a/.github/actions/core-cicd/deployment/deploy-docker/action.yml b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
index 3f44360da617..a6c729cce87d 100644
--- a/.github/actions/core-cicd/deployment/deploy-docker/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
@@ -86,9 +86,10 @@ runs:
   using: "composite"
   steps:
     - name: Download Docker Build Context
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       if: inputs.build_run_id # Only download the artifact if a build run id is provided
       with:
+        digest-mismatch: error
         name: docker-build-context${{ inputs.artifact_suffix }}
         path: ${{ github.workspace }}
         run-id: ${{ inputs.build_run_id }}
@@ -162,14 +163,14 @@ runs:
           fi
         echo "EOF" >> $GITHUB_ENV
     - name: Docker.io login
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker_io_username }}
         password: ${{ inputs.docker_io_token }}
       if: (inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH') && inputs.do_deploy == 'true'
 
     - name: GHCR.io login
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ inputs.ghcr_io_username }}
diff --git a/.github/actions/core-cicd/deployment/deploy-javadoc/README.md b/.github/actions/core-cicd/deployment/deploy-javadoc/README.md
index 212d5484354b..8dfb52efb1f3 100644
--- a/.github/actions/core-cicd/deployment/deploy-javadoc/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-javadoc/README.md
@@ -36,7 +36,7 @@ This GitHub composite action deploys Javadoc artifacts to the GitHub Packages re
 
 ## Steps
 
-1. **Checkout**: Uses the `actions/checkout@v4` action to check out the specified branch.
+1. **Checkout**: Uses the `actions/checkout@v7.0.1` action to check out the specified branch.
 2. **Maven Clean Build**: Runs a Maven clean install to build the project (skipping tests), only if `artifact-run-id` is not provided.
 3. **Deploy Javadoc**: Runs Maven to generate Javadocs and restores classes from the specified artifact run ID if provided.
 4. **Configure AWS Credentials**: Configures AWS credentials using the `aws-actions/configure-aws-credentials@v1` action.
diff --git a/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml b/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
index a544a034dee2..b818150aaa63 100644
--- a/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
@@ -28,7 +28,7 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
diff --git a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md
index a61f1618edd2..be47eda6e3c7 100644
--- a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md
@@ -35,10 +35,10 @@ This GitHub Action is designed to automate the process of publishing dotCMS SDK
 ## Detailed Steps
 
 1. **Checkout**  
-   The action uses `actions/checkout@v4` to check out the specified branch, allowing the workflow to access the repository's contents.
+   The action uses `actions/checkout@v7.0.1` to check out the specified branch, allowing the workflow to access the repository's contents.
 
 2. **Set Up Node.js**  
-   `actions/setup-node@v4` sets up the Node.js environment, crucial for running scripts and managing dependencies.
+   `actions/setup-node@v7.0.0` sets up the Node.js environment, crucial for running scripts and managing dependencies.
 
 3. **Get Next Version**  
    This step retrieves the next version of the SDK by reading the `package.json` file from the specified directory.
diff --git a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
index a9e4952cc782..a7bb6bbdffc0 100644
--- a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
@@ -47,13 +47,13 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
         token: ${{ inputs.github-token }}
 
     - name: 'Setup Node'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version-file: 'core-web/.nvmrc'
 
@@ -106,7 +106,7 @@ runs:
       shell: bash
 
     - name: Set up pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -120,7 +120,7 @@ runs:
 
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -140,7 +140,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
diff --git a/.github/actions/core-cicd/deployment/deploy-jfrog/README.md b/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
index a9f82ac995be..ef001e49b9de 100644
--- a/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
@@ -34,7 +34,7 @@ jobs:
   deploy:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Deploy Artifact
         uses: ./.github/actions/core-cicd/deployment/deploy-jfrog
diff --git a/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml b/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
index c71f17ad4280..f3df12c28dfa 100644
--- a/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
@@ -38,7 +38,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - uses: ./.github/actions/core-cicd/maven-job
       with:
diff --git a/.github/actions/core-cicd/maven-job/README.md b/.github/actions/core-cicd/maven-job/README.md
index b9e1284d3371..d4461eb4cb6f 100644
--- a/.github/actions/core-cicd/maven-job/README.md
+++ b/.github/actions/core-cicd/maven-job/README.md
@@ -73,7 +73,7 @@ jobs:
   build-and-test:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Maven Job
         uses: ./.github/actions/core-cicd/maven-job
diff --git a/.github/actions/core-cicd/maven-job/action.yml b/.github/actions/core-cicd/maven-job/action.yml
index 61452b19e960..351e81225ea8 100644
--- a/.github/actions/core-cicd/maven-job/action.yml
+++ b/.github/actions/core-cicd/maven-job/action.yml
@@ -180,10 +180,10 @@ runs:
     # means the first one to run on a cold key repairs it for the rest.
     - id: cache-maven-wrapper
       name: Cache Maven Wrapper Distribution
-      # Pinned to a commit SHA, not the mutable v4 tag: a tag can be repointed by
+      # Pinned to a commit SHA, not the mutable v6 tag: a tag can be repointed by
       # the action owner, which is how the trivy-action and kics-github-action
       # compromises worked. Bump deliberately when updating.
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/wrapper
         # Changes only when the Maven version does, so this key is ~always a hit.
@@ -192,7 +192,7 @@ runs:
     - id: restore-cache-maven
       name: Restore Maven Repository Cache
       if: ${{ inputs.artifacts-from == '' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-mavencore-${{ hashFiles('**/pom.xml') }}
@@ -202,7 +202,7 @@ runs:
     - id: restore-cache-node
       name: Restore Node Binary Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: installs
         # hash nodejs-parent/pom.xml so the pnpm-era layout (install-node-and-npm
@@ -226,7 +226,7 @@ runs:
 
     - name: Set up pnpm
       if: ${{ inputs.requires-node == 'true' }}
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -242,7 +242,7 @@ runs:
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -254,7 +254,7 @@ runs:
     - id: cache-sonar
       name: Cache SonarQube Packages
       if: ${{ inputs.cache-sonar == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ runner.os }}-sonar
@@ -263,8 +263,9 @@ runs:
     - id: restore-artifact-maven-repo
       name: Restore Maven Build Repo
       if: ${{ inputs.artifacts-from != '' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
@@ -273,8 +274,9 @@ runs:
     - id: restore-artifact-docker-image
       name: Restore Docker Image
       if: ${{ inputs.needs-docker-image == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
         path: /tmp/docker-image
 
@@ -286,15 +288,16 @@ runs:
     - id: restore-artifact-classes
       name: Restore Classes
       if: ${{ inputs.restore-classes == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
 
     - name: Docker Hub Login
       if: ${{ inputs.docker-io-username != '' && inputs.docker-io-token != '' }}
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker-io-username }}
         password: ${{ inputs.docker-io-token }}
@@ -345,7 +348,7 @@ runs:
     - id: persist-maven-repo
       name: Persist Maven Repo
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
         path: ~/.m2/repository
@@ -353,7 +356,7 @@ runs:
     - id: persist-docker-build-context
       name: Persist Docker Build Context
       if: ${{ inputs.generate-docker == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: docker-build-context${{ steps.artifact-suffix.outputs.suffix }}
         path: dotCMS/target/docker-build.tar
@@ -399,7 +402,7 @@ runs:
 
     - id: upload-docker-image
       name: Upload Docker Image as Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: ${{ inputs.generate-docker == 'true' }}
       with:
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
@@ -408,7 +411,7 @@ runs:
     - id: persist-build-classes
       name: Persist Build Classes
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
         path: |
@@ -426,7 +429,7 @@ runs:
     - id: save-cache-maven
       name: Save Maven Repository Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-maven.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ steps.restore-cache-maven.outputs.cache-primary-key }}
@@ -434,7 +437,7 @@ runs:
     - id: save-cache-node
       name: Save Node Binary Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-node.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: installs
         key: ${{ steps.restore-cache-node.outputs.cache-primary-key }}
@@ -442,7 +445,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' && inputs.generate-artifacts == 'true' && steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
@@ -450,7 +453,7 @@ runs:
     - id: save-cache-sonar
       name: Save SonarQube Cache
       if: ${{ inputs.cache-sonar == 'true' && steps.cache-sonar.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ steps.cache-sonar.outputs.cache-primary-key }}
@@ -458,7 +461,7 @@ runs:
     # ---------------------------- Generate Reports Artifacts ----------------------------
     - id: generate-build-reports-artifact
       name: Generate Build Reports Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always()
       with:
         name: "build-reports-${{ inputs.stage-name }}"
@@ -469,7 +472,7 @@ runs:
 
     - id: create-test-reports-artifact
       name: Create Test Reports Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() && inputs.generates-test-results == 'true'
       with:
         name: "build-reports-test-${{ inputs.stage-name }}"
diff --git a/.github/actions/core-cicd/prepare-runner/README.md b/.github/actions/core-cicd/prepare-runner/README.md
index e033156247d1..b0958c12941a 100644
--- a/.github/actions/core-cicd/prepare-runner/README.md
+++ b/.github/actions/core-cicd/prepare-runner/README.md
@@ -55,7 +55,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare Runner
         uses: ./.github/actions/core-cicd/prepare-runner
diff --git a/.github/actions/core-cicd/setup-java/README.md b/.github/actions/core-cicd/setup-java/README.md
index 9042bc18403e..f13cd20c8062 100644
--- a/.github/actions/core-cicd/setup-java/README.md
+++ b/.github/actions/core-cicd/setup-java/README.md
@@ -54,7 +54,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Java
         uses: ./.github/actions/core-cicd/setup-java
diff --git a/.github/actions/core-cicd/setup-java/action.yml b/.github/actions/core-cicd/setup-java/action.yml
index bceb8670a524..9c51c4d33b8c 100644
--- a/.github/actions/core-cicd/setup-java/action.yml
+++ b/.github/actions/core-cicd/setup-java/action.yml
@@ -57,7 +57,7 @@ runs:
         echo "graalvm_version=$GRAALVM_VERSION" >> $GITHUB_OUTPUT
     - name: Restore Cache SDKMan install
       id: restore-cache-sdkman
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-install
@@ -88,14 +88,14 @@ runs:
     - name: Save Cache SDKMan install
       id: save-cache-sdkman
       if: ${{ steps.restore-cache-sdkman.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-install
 
     - name: Restore Cache Java SDK
       id: restore-cache-java
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.requested_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.requested_version }}
@@ -103,7 +103,7 @@ runs:
     - name: Restore Cache GraalVM SDK
       id: restore-cache-graalvm
       if: ${{ inputs.require-graalvm == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.graalvm_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.graalvm_version }}
@@ -168,7 +168,7 @@ runs:
         java -version
 
     - name: Save Cache Java SDK
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ steps.restore-cache-java.outputs.cache-hit != 'true' }}
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.requested_version }}
@@ -176,7 +176,7 @@ runs:
 
     - name: Save Cache GraalVM SDK
       if: ${{ inputs.require-graalvm == 'true' && steps.restore-cache-graalvm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.graalvm_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.graalvm_version }}
\ No newline at end of file
diff --git a/.github/actions/legacy-release/sbom-generator/action.yml b/.github/actions/legacy-release/sbom-generator/action.yml
index 55ca4ad6a54d..3128787ec1d5 100644
--- a/.github/actions/legacy-release/sbom-generator/action.yml
+++ b/.github/actions/legacy-release/sbom-generator/action.yml
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout core repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: dotCMS/core
         token: ${{ inputs.github_token }}
@@ -52,7 +52,7 @@ runs:
         mv core/sbom-cyclonedx.json core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
 
     - name: Upload SBOM to GitHub
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: sbom-dotcms-${{ env.DOTCMS_VERSION }}
         path: core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
diff --git a/.github/workflows/ai_claude-backend-reviewer.yml b/.github/workflows/ai_claude-backend-reviewer.yml
index 2aaceb18f7e7..3f1e6900f864 100644
--- a/.github/workflows/ai_claude-backend-reviewer.yml
+++ b/.github/workflows/ai_claude-backend-reviewer.yml
@@ -51,7 +51,7 @@ jobs:
     outputs:
       has_java: ${{ steps.check.outputs.has_java }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ai_claude-orchestrator.yml b/.github/workflows/ai_claude-orchestrator.yml
index 2b73cef6ba21..7bc13906383a 100644
--- a/.github/workflows/ai_claude-orchestrator.yml
+++ b/.github/workflows/ai_claude-orchestrator.yml
@@ -44,7 +44,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check organization membership
         id: membership-check
@@ -128,7 +128,7 @@ jobs:
     outputs:
       prompt: ${{ steps.build.outputs.prompt }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: build
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/ai_claude-post-merge-test-plan.yml b/.github/workflows/ai_claude-post-merge-test-plan.yml
index cfa3c834a942..a5c56e905cd1 100644
--- a/.github/workflows/ai_claude-post-merge-test-plan.yml
+++ b/.github/workflows/ai_claude-post-merge-test-plan.yml
@@ -105,7 +105,7 @@ jobs:
       # (that comes from the API) and never history. Sparse + shallow keeps this job seconds long
       # on a repository this size.
       - name: Checkout scripts and prompt
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           sparse-checkout: |
@@ -148,7 +148,7 @@ jobs:
 
       - name: Discover related issues
         id: discover
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           PR_NUMBER: ${{ needs.preflight.outputs.pr_number }}
           PR_BRANCH: ${{ steps.meta.outputs.branch }}
diff --git a/.github/workflows/ai_claude-rollback-safety.yml b/.github/workflows/ai_claude-rollback-safety.yml
index e64344fca2bc..6ac32af44782 100644
--- a/.github/workflows/ai_claude-rollback-safety.yml
+++ b/.github/workflows/ai_claude-rollback-safety.yml
@@ -29,7 +29,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check organization membership
         id: membership-check
diff --git a/.github/workflows/ai_claude-sdk-breaking-change.yml b/.github/workflows/ai_claude-sdk-breaking-change.yml
index 08cc46ff7440..ebc5763eb286 100644
--- a/.github/workflows/ai_claude-sdk-breaking-change.yml
+++ b/.github/workflows/ai_claude-sdk-breaking-change.yml
@@ -29,7 +29,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check organization membership
         id: membership-check
diff --git a/.github/workflows/cicd_3-trunk.yml b/.github/workflows/cicd_3-trunk.yml
index 92b2e6be6186..0e23db06afed 100644
--- a/.github/workflows/cicd_3-trunk.yml
+++ b/.github/workflows/cicd_3-trunk.yml
@@ -163,7 +163,7 @@ jobs:
       # notify-slack's action.yml (same gap already hit and fixed once in
       # cicd_release-sdk.yml's publish job).
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Compute next version'
         id: next-version
diff --git a/.github/workflows/cicd_4-nightly.yml b/.github/workflows/cicd_4-nightly.yml
index beefd081cfe1..8f0b5b8e919f 100644
--- a/.github/workflows/cicd_4-nightly.yml
+++ b/.github/workflows/cicd_4-nightly.yml
@@ -88,7 +88,7 @@ jobs:
       build-ref: ${{ steps.find-commit.outputs.build-ref }}
       tag-date: ${{ steps.find-commit.outputs.tag-date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Bounded shallow checkout: Find Build Commit walks `git log` on main
           # back to midnight UTC. The window that matters is commits landing
diff --git a/.github/workflows/cicd_5-lts.yml b/.github/workflows/cicd_5-lts.yml
index e592bcf95a93..10c65a100d2a 100644
--- a/.github/workflows/cicd_5-lts.yml
+++ b/.github/workflows/cicd_5-lts.yml
@@ -46,7 +46,7 @@ jobs:
     outputs:
       version: ${{ steps.resolve.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Resolve version from input or maven.config
         id: resolve
         env:
diff --git a/.github/workflows/cicd_6-release.yml b/.github/workflows/cicd_6-release.yml
index 9dd2a7ee3cb6..83b33f8241ba 100644
--- a/.github/workflows/cicd_6-release.yml
+++ b/.github/workflows/cicd_6-release.yml
@@ -308,11 +308,11 @@ jobs:
       group: evergreen-tracks-registry
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -355,7 +355,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           # Shallow checkout: this job only needs HEAD of main (it does its own
@@ -558,7 +558,7 @@ jobs:
     if: always()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
@@ -579,7 +579,7 @@ jobs:
           && !contains(needs.release-prepare.outputs.release_tag, '_lts_')
           && startsWith(needs.release-prepare.outputs.release_tag, 'v')
         continue-on-error: true
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/cicd_comp_ai-release-notes-phase.yml b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
index 38b5d1ac16e0..ab5d4da7009d 100644
--- a/.github/workflows/cicd_comp_ai-release-notes-phase.yml
+++ b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
@@ -63,12 +63,12 @@ jobs:
           echo "Release '${RELEASE_TAG}' found."
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/cicd_comp_build-phase.yml b/.github/workflows/cicd_comp_build-phase.yml
index 011aa3af8c3e..a277b8a5c729 100644
--- a/.github/workflows/cicd_comp_build-phase.yml
+++ b/.github/workflows/cicd_comp_build-phase.yml
@@ -87,7 +87,7 @@ jobs:
     steps:
       # Checkout code based on whether a specific ref is provided
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: inputs.ref == ''
         with:
           fetch-depth: 0
@@ -103,7 +103,7 @@ jobs:
       # expressions, collapsing the true branch to 1.
       - name: Checkout code with ref ${{ inputs.ref }}
         if: inputs.ref != ''
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: ${{ inputs.run-pr-checks && '0' || '1' }}
diff --git a/.github/workflows/cicd_comp_changelog-site-publish-phase.yml b/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
index f76193f5d933..3c444feb55c4 100644
--- a/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
+++ b/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
@@ -79,7 +79,7 @@ jobs:
       && startsWith(inputs.release_tag, 'v')
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/cicd_comp_cli-native-build-phase.yml b/.github/workflows/cicd_comp_cli-native-build-phase.yml
index 42a4ba7a7612..a8b7f3340edc 100644
--- a/.github/workflows/cicd_comp_cli-native-build-phase.yml
+++ b/.github/workflows/cicd_comp_cli-native-build-phase.yml
@@ -87,7 +87,7 @@ jobs:
       artifact-url: ${{ steps.upload-artifact.outputs.artifact-url }}
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.BRANCH }}
 
@@ -107,7 +107,7 @@ jobs:
       # Upload the built distribution as an artifact
       - name: 'Upload built distribution'
         id: upload-artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cli-artifacts-${{ matrix.platform }}
           path: |
diff --git a/.github/workflows/cicd_comp_deployment-phase.yml b/.github/workflows/cicd_comp_deployment-phase.yml
index 7b9850ddcfa7..148ebcc109c3 100644
--- a/.github/workflows/cicd_comp_deployment-phase.yml
+++ b/.github/workflows/cicd_comp_deployment-phase.yml
@@ -143,7 +143,7 @@ jobs:
       formatted_tags: ${{ steps.format-tags.outputs.formatted_tags }}
     steps:
       # Checkout the repository
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow checkout: nothing in this job reads git history (no git
           # commands after checkout; Docker/NPM publishing works from the
diff --git a/.github/workflows/cicd_comp_finalize-phase.yml b/.github/workflows/cicd_comp_finalize-phase.yml
index 95e51bd22892..56e295a03a92 100644
--- a/.github/workflows/cicd_comp_finalize-phase.yml
+++ b/.github/workflows/cicd_comp_finalize-phase.yml
@@ -36,8 +36,9 @@ jobs:
       # Download build reports from previous steps
       - name: Download build reports
         id: download-artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           path: /tmp/build-step-reports
           pattern: build-reports-*
           merge-multiple: false
@@ -227,7 +228,7 @@ jobs:
           echo "aggregate_status=${AGGREGATE_STATUS}" >> $GITHUB_OUTPUT
       # Upload the final workflow data report as an artifact
       - name: Upload workflow data
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: workflow-data
           path: ./workflow-data.json
diff --git a/.github/workflows/cicd_comp_initialize-phase.yml b/.github/workflows/cicd_comp_initialize-phase.yml
index aae04e712f82..cb813169f24b 100644
--- a/.github/workflows/cicd_comp_initialize-phase.yml
+++ b/.github/workflows/cicd_comp_initialize-phase.yml
@@ -84,7 +84,7 @@ jobs:
     steps:
       - name: Download Build Artifact
         id: data-download
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         if: ${{ inputs.reuse-previous-build == true }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -128,12 +128,12 @@ jobs:
       # JSON array of filter names that matched (from dorny/paths-filter)
       changes: ${{ steps.filter.outputs.changes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ inputs.change-detection == 'enabled' }}
 
       # Execute the paths-filter step to determine changes
       # For PRs, paths-filter automatically uses GitHub API to get changed files
-      - uses: dorny/paths-filter@v3.0.1
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         if: ${{ inputs.change-detection == 'enabled' }}
         id: filter
         with:
diff --git a/.github/workflows/cicd_comp_pr-area-labeler.yml b/.github/workflows/cicd_comp_pr-area-labeler.yml
index 36f98dfca5f0..c6e434ca600c 100644
--- a/.github/workflows/cicd_comp_pr-area-labeler.yml
+++ b/.github/workflows/cicd_comp_pr-area-labeler.yml
@@ -31,13 +31,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout for config
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: .github/area-labels.yml
           sparse-checkout-cone-mode: false
 
       - name: Apply Area Labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/cicd_comp_publish-pr-test-image.yml b/.github/workflows/cicd_comp_publish-pr-test-image.yml
index 17898f57fddd..0383c0537cbc 100644
--- a/.github/workflows/cicd_comp_publish-pr-test-image.yml
+++ b/.github/workflows/cicd_comp_publish-pr-test-image.yml
@@ -94,8 +94,9 @@ jobs:
 
       - name: Download prebuilt image
         if: steps.resolve.outputs.found == 'true'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           name: docker-image
           path: /tmp/prebuilt
           run-id: ${{ steps.resolve.outputs.run_id }}
diff --git a/.github/workflows/cicd_comp_release-phase.yml b/.github/workflows/cicd_comp_release-phase.yml
index f46784fae541..8abf96573747 100644
--- a/.github/workflows/cicd_comp_release-phase.yml
+++ b/.github/workflows/cicd_comp_release-phase.yml
@@ -89,7 +89,7 @@ jobs:
       JVM_TEST_MAVEN_OPTS: '-e -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn'
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.release_tag }}
 
@@ -144,8 +144,9 @@ jobs:
           java-version: ${{ inputs.java-version }}
 
       - name: Restore Maven Repository
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           name: maven-repo${{ steps.java-suffix.outputs.suffix }}
           path: ~/.m2/repository
 
@@ -239,7 +240,7 @@ jobs:
     if: inputs.java-version == ''
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/legacy-release/sbom-generator
         id: sbom-generator
@@ -248,8 +249,9 @@ jobs:
           github_token: ${{ secrets.CI_MACHINE_TOKEN }}
 
       - name: Download SBOM Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
 
diff --git a/.github/workflows/cicd_comp_release-prepare-phase.yml b/.github/workflows/cicd_comp_release-prepare-phase.yml
index 484e5f418f47..810750161dd9 100644
--- a/.github/workflows/cicd_comp_release-prepare-phase.yml
+++ b/.github/workflows/cicd_comp_release-prepare-phase.yml
@@ -98,7 +98,7 @@ jobs:
       # the release branch from. fetch-depth: 0 pulled every branch ref
       # (~2k+ branches, ~1.1 GB pack) and cost ~20 min per release run.
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           token: ${{ secrets.CI_MACHINE_TOKEN || github.token }}
diff --git a/.github/workflows/cicd_comp_test-phase.yml b/.github/workflows/cicd_comp_test-phase.yml
index d54c46b4a6f0..9fc4df4e85d6 100644
--- a/.github/workflows/cicd_comp_test-phase.yml
+++ b/.github/workflows/cicd_comp_test-phase.yml
@@ -94,7 +94,7 @@ jobs:
       has-tests: ${{ steps.generate-matrix.outputs.has-tests }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow checkout: this job only reads .github/test-matrix.yml from HEAD.
           # fetch-depth: 0 pulled every branch ref (~2k+ branches, ~1.1 GB pack).
@@ -108,7 +108,7 @@ jobs:
 
       - name: Generate test matrix
         id: generate-matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           # Passed via env (not interpolated into the script) to avoid script injection.
           OPENSEARCH_PHASE: ${{ inputs.opensearch_phase }}
@@ -249,7 +249,7 @@ jobs:
 
     steps:          
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow checkout: test jobs run Maven suites against the checked-out
           # snapshot only — no git history is read anywhere in this job or in the
diff --git a/.github/workflows/cicd_evergreen-tracks-admin.yml b/.github/workflows/cicd_evergreen-tracks-admin.yml
index 45c939fb151b..91336b622a33 100644
--- a/.github/workflows/cicd_evergreen-tracks-admin.yml
+++ b/.github/workflows/cicd_evergreen-tracks-admin.yml
@@ -38,11 +38,11 @@ jobs:
   admin:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_evergreen-tracks-promote.yml b/.github/workflows/cicd_evergreen-tracks-promote.yml
index 8a3c1f666e58..37b3ed587f60 100644
--- a/.github/workflows/cicd_evergreen-tracks-promote.yml
+++ b/.github/workflows/cicd_evergreen-tracks-promote.yml
@@ -74,11 +74,11 @@ jobs:
       # since approval before it mutates anything.
       plan: ${{ steps.plan.outputs.plan }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -176,11 +176,11 @@ jobs:
       moved: ${{ steps.apply.outputs.moved }}
       summary: ${{ steps.apply.outputs.summary }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -271,7 +271,7 @@ jobs:
     if: always()
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Notify failure
         if: needs.plan.result == 'failure' || needs.apply.result == 'failure'
         continue-on-error: true
diff --git a/.github/workflows/cicd_manual_build-docker-context.yml b/.github/workflows/cicd_manual_build-docker-context.yml
index 339c61d678dd..955034dfb337 100644
--- a/.github/workflows/cicd_manual_build-docker-context.yml
+++ b/.github/workflows/cicd_manual_build-docker-context.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set Common Vars
         run: |
           PLATFORMS='linux/amd64'
@@ -45,7 +45,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
         if: github.event.inputs.multi_arch == 'true'
       - name: Docker Hub login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_manual_build-java-base.yml b/.github/workflows/cicd_manual_build-java-base.yml
index 11bc91b240c5..be1e13c84c91 100644
--- a/.github/workflows/cicd_manual_build-java-base.yml
+++ b/.github/workflows/cicd_manual_build-java-base.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set Common Vars
         run: |
           PLATFORMS='linux/amd64'
@@ -45,7 +45,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
         if: github.event.inputs.multi_arch == 'true'
       - name: Docker Hub login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_manual_publish-starter.yml b/.github/workflows/cicd_manual_publish-starter.yml
index e115634f5f3a..655fba903c39 100644
--- a/.github/workflows/cicd_manual_publish-starter.yml
+++ b/.github/workflows/cicd_manual_publish-starter.yml
@@ -92,7 +92,7 @@ jobs:
 
       - name: 'Upload artifacts'
         id: upload-artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.STARTER_TYPE }}-starter
           path: |
@@ -111,7 +111,7 @@ jobs:
     steps:
       - name: 'Checkout repository'
         if: ${{ github.event.inputs.type == 'empty' && github.event.inputs.dry-run == 'false' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: jfrog/setup-jfrog-cli@v4
         env:
@@ -126,8 +126,9 @@ jobs:
           echo "::endgroup::"
           
       - name: 'Download artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           github-token: ${{ github.token }}
           name: ${{ env.STARTER_TYPE }}-starter
           path: ${{ github.workspace }}/starter
@@ -212,7 +213,7 @@ jobs:
     if: always() && github.event.inputs.dry-run == 'false'
     steps:
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Compose Message
         id: compose-message
diff --git a/.github/workflows/cicd_post-workflow-reporting.yml b/.github/workflows/cicd_post-workflow-reporting.yml
index 48f7bacb89dc..b454e3d9c11b 100644
--- a/.github/workflows/cicd_post-workflow-reporting.yml
+++ b/.github/workflows/cicd_post-workflow-reporting.yml
@@ -55,12 +55,12 @@ jobs:
         run: echo "$GITHUB_CONTEXT"
 
       # Checkout the repository
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Download workflow data from previous run
       - name: Download Workflow Data
         id: data-download
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         with:
           name: 'workflow-data'
           run_id: ${{ github.event.workflow_run.id || inputs.run-id }}
@@ -69,7 +69,7 @@ jobs:
       # Download build reports from previous run
       - name: Download build reports
         id: download-artifact
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         with:
           name: build-reports-test-.*
           name_is_regexp: true
diff --git a/.github/workflows/cicd_pr_skill-lint.yml b/.github/workflows/cicd_pr_skill-lint.yml
index 4933c7a2a1eb..249e422f4d6c 100644
--- a/.github/workflows/cicd_pr_skill-lint.yml
+++ b/.github/workflows/cicd_pr_skill-lint.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .claude/skills
@@ -37,7 +37,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
 
diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index be6f1fe66a6b..c75fd8733e48 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -88,7 +88,7 @@ jobs:
 
       # Checkout the repository
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Setup git configuration
       - name: 'Setup git config'
@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.AUXILIARY_BRANCH }}
       - name: 'Create artifacts directory'
@@ -165,8 +165,9 @@ jobs:
           echo "artifactsDir=${{ github.workspace }}/artifacts" >> "$GITHUB_ENV"
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: cli-artifacts-*
       - uses: ./.github/actions/core-cicd/maven-job
@@ -192,14 +193,14 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: 'Checkout code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.HEAD }}
 
       - uses: ./.github/actions/core-cicd/cleanup-runner
 
       - name: 'Set up Node.js'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -207,8 +208,9 @@ jobs:
         run: pip install jinja2-cli
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: cli-artifacts-*
           merge-multiple: true
@@ -357,7 +359,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.HEAD }}
 
diff --git a/.github/workflows/cicd_release-sdk.yml b/.github/workflows/cicd_release-sdk.yml
index 7ee8de2b02e2..f89979307c41 100644
--- a/.github/workflows/cicd_release-sdk.yml
+++ b/.github/workflows/cicd_release-sdk.yml
@@ -119,7 +119,7 @@ jobs:
       # can't be resolved on an empty runner workspace, so without this the Slack step
       # would silently no-op instead of ever sending the failure notice.
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Slack Notification (Pre-check failure)'
         continue-on-error: true
@@ -143,7 +143,7 @@ jobs:
       # The composite action re-checks-out internally at the correct ref for the actual
       # build/publish; this checkout only needs to make the action definition resolvable.
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.REF }}
 
diff --git a/.github/workflows/cicd_scheduled_image-cve-scan.yml b/.github/workflows/cicd_scheduled_image-cve-scan.yml
index 65ec6cc5a9fd..8158c8afa7dd 100644
--- a/.github/workflows/cicd_scheduled_image-cve-scan.yml
+++ b/.github/workflows/cicd_scheduled_image-cve-scan.yml
@@ -70,7 +70,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload results artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy-image-cve-scan
           path: |
diff --git a/.github/workflows/cicd_scheduled_notify-seated-prs.yml b/.github/workflows/cicd_scheduled_notify-seated-prs.yml
index d3cf89dd5a3d..bff594bf0159 100644
--- a/.github/workflows/cicd_scheduled_notify-seated-prs.yml
+++ b/.github/workflows/cicd_scheduled_notify-seated-prs.yml
@@ -27,7 +27,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
       - name: Filter execution
         id: filter-execution
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
@@ -42,7 +42,7 @@ jobs:
       - id: fetch-seated-prs
         name: Fetch Seated PRs
         if: success() && steps.filter-execution.outputs.continue == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           retries: 3
@@ -163,7 +163,7 @@ jobs:
     steps:
       - name: Build Message
         id: build-message
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
diff --git a/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml b/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
index c06dfe691860..d59624c93576 100644
--- a/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
+++ b/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
@@ -119,7 +119,7 @@ jobs:
     if: failure()
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Post failure to #team-scout
         uses: ./.github/actions/core-cicd/notification/notify-slack
         with:
diff --git a/.github/workflows/cicd_weekly-rolling-tags.yml b/.github/workflows/cicd_weekly-rolling-tags.yml
index 4acd4eda107a..9b64c6477d4d 100644
--- a/.github/workflows/cicd_weekly-rolling-tags.yml
+++ b/.github/workflows/cicd_weekly-rolling-tags.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/dotbot-act.yml b/.github/workflows/dotbot-act.yml
index 1eca0aa8a09c..b93721591f3d 100644
--- a/.github/workflows/dotbot-act.yml
+++ b/.github/workflows/dotbot-act.yml
@@ -37,7 +37,7 @@ jobs:
     steps:
       # Pinned to a full commit SHA: a mutable tag could be repointed to run
       # attacker-controlled code with this job's write-scoped GITHUB_TOKEN.
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # The action code must be loaded from the pinned release SHA, not this
diff --git a/.github/workflows/dotbot-review.yml b/.github/workflows/dotbot-review.yml
index 3db33324d4df..7a86b25fd80b 100644
--- a/.github/workflows/dotbot-review.yml
+++ b/.github/workflows/dotbot-review.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
       # Pinned to a full commit SHA: a mutable tag could be repointed to run
       # attacker-controlled code with this job's write-scoped GITHUB_TOKEN.
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: dotbot autonomous review
diff --git a/.github/workflows/issue_autodoc.yml b/.github/workflows/issue_autodoc.yml
index e8f71540a904..3fa4602c4e36 100644
--- a/.github/workflows/issue_autodoc.yml
+++ b/.github/workflows/issue_autodoc.yml
@@ -97,10 +97,10 @@ jobs:
 
     steps:
       - name: Checkout triggering repo
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout dotcms-aios
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: dotCMS/dotcms-aios
           token: ${{ secrets.CI_MACHINE_TOKEN }}
@@ -351,8 +351,9 @@ jobs:
 
     steps:
       - name: Download report artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           name: autodoc-report
           path: /tmp/
         continue-on-error: true
diff --git a/.github/workflows/issue_comp_frontend-notify.yml b/.github/workflows/issue_comp_frontend-notify.yml
index 0e87f355e686..20311c14c580 100644
--- a/.github/workflows/issue_comp_frontend-notify.yml
+++ b/.github/workflows/issue_comp_frontend-notify.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Check if Technology body changed
         id: body-technology-check
         if: github.event.action == 'edited'
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const words = ['frontend', 'front-end'];
@@ -77,7 +77,7 @@ jobs:
       - name: Check if Technology label changed
         id: label-technology-check
         if: github.event.action == 'labeled'
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/issue_comp_label-conditional-labeling.yml b/.github/workflows/issue_comp_label-conditional-labeling.yml
index fa6dd80ef7d3..c73373836e5e 100644
--- a/.github/workflows/issue_comp_label-conditional-labeling.yml
+++ b/.github/workflows/issue_comp_label-conditional-labeling.yml
@@ -64,7 +64,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJSON(github) }}
       - name: Resolve Labels
         id: resolve-labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
@@ -93,7 +93,7 @@ jobs:
             
             core.setOutput('labels', JSON.stringify(filteredLabels));
       - name: Add Labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: success() && steps.resolve-labels.outputs.labels != ''
         with:
           result-encoding: string
diff --git a/.github/workflows/issue_comp_link-issue-to-pr.yml b/.github/workflows/issue_comp_link-issue-to-pr.yml
index ebe5e4764938..c04786f91cea 100644
--- a/.github/workflows/issue_comp_link-issue-to-pr.yml
+++ b/.github/workflows/issue_comp_link-issue-to-pr.yml
@@ -488,14 +488,14 @@ jobs:
 
       - name: Create new comment
         if: steps.determine_issue.outputs.is_cross_repo != 'true' && steps.check_comment.outputs.existing_comment_id == ''
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ steps.determine_issue.outputs.final_issue_number }}
           body: ${{ steps.check_comment.outputs.pr_list }}
 
       - name: Update existing comment
         if: steps.determine_issue.outputs.is_cross_repo != 'true' && steps.check_comment.outputs.existing_comment_id != ''
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           comment-id: ${{ steps.check_comment.outputs.existing_comment_id }}
           body: ${{ steps.check_comment.outputs.pr_list }}
diff --git a/.github/workflows/issue_comp_release-labeling.yml b/.github/workflows/issue_comp_release-labeling.yml
index 19c995c7f326..145b6139594c 100644
--- a/.github/workflows/issue_comp_release-labeling.yml
+++ b/.github/workflows/issue_comp_release-labeling.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Rename label
         if: success()
         id: validate-inputs
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           retries: 3
@@ -94,7 +94,7 @@ jobs:
             
       - name: Re-Create New Label
         if: success()
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           retries: 3
diff --git a/.github/workflows/issue_manual_label-customer_deployed-issues.yml b/.github/workflows/issue_manual_label-customer_deployed-issues.yml
index 2ce81f85db14..d0e22f7a8d87 100644
--- a/.github/workflows/issue_manual_label-customer_deployed-issues.yml
+++ b/.github/workflows/issue_manual_label-customer_deployed-issues.yml
@@ -19,7 +19,7 @@ jobs:
     
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       - name: Set up Python
         uses: actions/setup-python@v4
diff --git a/.github/workflows/issue_manual_label-issues.yml b/.github/workflows/issue_manual_label-issues.yml
index 03adb6f5581b..17ca623ce349 100644
--- a/.github/workflows/issue_manual_label-issues.yml
+++ b/.github/workflows/issue_manual_label-issues.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fetch issues
         id: fetch-next-release-issues
diff --git a/.github/workflows/issue_on-open_add-to-triage-project..yml b/.github/workflows/issue_on-open_add-to-triage-project..yml
index d401d880d187..040bf4efe763 100644
--- a/.github/workflows/issue_on-open_add-to-triage-project..yml
+++ b/.github/workflows/issue_on-open_add-to-triage-project..yml
@@ -12,7 +12,7 @@ jobs:
     if: github.event.issue.assignee == null
     steps:
       - name: Check team labels and add to project
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ secrets.TRIAGE_PROJECT_TOKEN }}
           script: |
diff --git a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
index 848fcdefa3f4..a4af3a430e8a 100644
--- a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
+++ b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
@@ -101,7 +101,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
@@ -121,7 +121,7 @@ jobs:
 
       - name: Restore Docker Context
         id: restore-docker-context
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: ${{ inputs.docker_context_cache_key }}
@@ -257,14 +257,14 @@ jobs:
         if: success()
 
       - name: Docker.io login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.docker_io_username }}
           password: ${{ secrets.docker_io_token }}
         if: inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH'
 
       - name: GHCR.io login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ secrets.ghcr_io_username }}
diff --git a/.github/workflows/legacy-release_maven-release-process.yml b/.github/workflows/legacy-release_maven-release-process.yml
index b600f9344d3b..15ea8262ed34 100644
--- a/.github/workflows/legacy-release_maven-release-process.yml
+++ b/.github/workflows/legacy-release_maven-release-process.yml
@@ -88,7 +88,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_MACHINE_TOKEN }}
@@ -195,7 +195,7 @@ jobs:
 
       - name: Cache Maven Repository
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: maven-core-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -205,7 +205,7 @@ jobs:
 
       - name: Cache Core Output
         id: cache-core-output
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ./dotCMS/target/classes
@@ -218,7 +218,7 @@ jobs:
 
       - name: Cache Node Binary
         id: cache-node-binary
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             core-web/installs
@@ -227,7 +227,7 @@ jobs:
 
       - name: Cache NPM
         id: cache-npm
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.npm
@@ -237,7 +237,7 @@ jobs:
 
       - name: Cache Docker Context
         id: cache-docker-context
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: docker-context-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -262,7 +262,7 @@ jobs:
     if: success()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.prepare-release.outputs.release_tag }}
 
@@ -270,14 +270,14 @@ jobs:
 
       - name: Restore Maven Repository
         id: restore-maven
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: maven-core-${{ needs.prepare-release.outputs.date }}-${{ github.run_id }}
 
       - name: Restore Core Output
         id: restore-core-output
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ./dotCMS/target/classes
@@ -287,14 +287,14 @@ jobs:
 
       - name: Restore Node Binary
         id: restore-node-binary
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: core-web/installs
           key: node-binary-${{ hashFiles('core-web/.nvmrc') }}
 
       - name: Restore NPM
         id: restore-npm
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: npm-${{ hashFiles('core-web/package-lock.json') }}
@@ -386,7 +386,7 @@ jobs:
     needs: [  prepare-release, build-push-image ]
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/legacy-release/sbom-generator
         id: sbom-generator
@@ -395,8 +395,9 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
           
@@ -437,7 +438,7 @@ jobs:
     if: success()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/legacy-release_sbom-generator.yaml b/.github/workflows/legacy-release_sbom-generator.yaml
index 3ecbc9bbe7db..0729761e265a 100644
--- a/.github/workflows/legacy-release_sbom-generator.yaml
+++ b/.github/workflows/legacy-release_sbom-generator.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout core-test-results repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: dotCMS/core-test-results
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish_docs.yml b/.github/workflows/publish_docs.yml
index e59851ecc602..c30506fed5cf 100644
--- a/.github/workflows/publish_docs.yml
+++ b/.github/workflows/publish_docs.yml
@@ -10,13 +10,13 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
       - name: Configuring Node.js
-        uses: actions/setup-node@v2-beta
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "16.13.2"
+          node-version-file: 'core-web/.nvmrc'
       - name: Installing dependencies
         run: |
           cd core-web
diff --git a/.github/workflows/utility_discover-docker-tags.yml b/.github/workflows/utility_discover-docker-tags.yml
index 1b392561e3cf..391198fbeb8b 100644
--- a/.github/workflows/utility_discover-docker-tags.yml
+++ b/.github/workflows/utility_discover-docker-tags.yml
@@ -24,7 +24,7 @@ jobs:
         run: echo "$GITHUB_CONTEXT"
         if: env.DEBUG == 'true'
       - name: Checkout core
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set Common Vars
         run: |
           pwd && ls -las