From ab7f7b813b1ebdf486187424142d1a9a4cc16079 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 07:16:20 -0400
Subject: [PATCH 01/14] ci(actions): bump cache, pnpm and upload-artifact on
 the hot path (#36850)

Batch 1 of the Node 24 runtime sweep. Scoped to the two densest, most-
exercised files so one PR build gives full backend build + test coverage:
maven-job (19 external refs) and setup-java (6).

  actions/cache            @0057852b # v4.3.0 -> @55cc8345 # v6.1.0
  actions/cache/restore    @v4 -> @v6.1.0   (7 sites)
  actions/cache/save       @v4 -> @v6.1.0   (7 sites)
  actions/upload-artifact  @v4 -> @v7.0.1   (6 sites)
  pnpm/action-setup        @v4 -> @v6.0.10  (1 site)

Behaviour-neutral, and verified rather than assumed:

- cache v6 is an ESM internals change. Read v6's own action.yml: restore
  keeps inputs path/key/restore-keys/enableCrossOsArchive/fail-on-cache-miss/
  lookup-only and outputs cache-hit/cache-primary-key/cache-matched-key; save
  keeps path/key/upload-chunk-size/enableCrossOsArchive. So the restore->save
  handoff through steps.restore-*.outputs.cache-primary-key is untouched.
- No cache KEY changes anywhere, so existing caches stay warm and a revert
  re-reads the same keys. Nothing to re-prime.
- upload-artifact v7's new `archive` input defaults to 'true', i.e. exactly v4
  behaviour. `archive: false` is deliberately NOT set: maven-job's image.tar is
  consumed by `docker load`, and finalize-phase's workflow-data by
  dawidd6/action-download-artifact -- both need the zipped shape.
- pnpm resolves from core-web/package.json's packageManager (pnpm@10.17.1), so
  v6 (which adds pnpm 11 support) resolves the same version. Watch the pnpm
  store cache-hit on the SECOND consecutive build, not the first: that key
  embeds steps.pnpm-info.outputs.version, so a drift there would surface as a
  slow build rather than a failure.

The maven-wrapper pin stays SHA-pinned and keeps its rationale comment (a tag
can be repointed by its owner, which is how the trivy-action and
kics-github-action compromises worked). Its "not the mutable v4 tag" wording
is updated to v6 so the comment still describes reality.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../actions/core-cicd/maven-job/action.yml    | 34 +++++++++----------
 .../actions/core-cicd/setup-java/action.yml   | 12 +++----
 2 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/.github/actions/core-cicd/maven-job/action.yml b/.github/actions/core-cicd/maven-job/action.yml
index 61452b19e960..eaf378eec877 100644
--- a/.github/actions/core-cicd/maven-job/action.yml
+++ b/.github/actions/core-cicd/maven-job/action.yml
@@ -180,10 +180,10 @@ runs:
     # means the first one to run on a cold key repairs it for the rest.
     - id: cache-maven-wrapper
       name: Cache Maven Wrapper Distribution
-      # Pinned to a commit SHA, not the mutable v4 tag: a tag can be repointed by
+      # Pinned to a commit SHA, not the mutable v6 tag: a tag can be repointed by
       # the action owner, which is how the trivy-action and kics-github-action
       # compromises worked. Bump deliberately when updating.
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/wrapper
         # Changes only when the Maven version does, so this key is ~always a hit.
@@ -192,7 +192,7 @@ runs:
     - id: restore-cache-maven
       name: Restore Maven Repository Cache
       if: ${{ inputs.artifacts-from == '' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-mavencore-${{ hashFiles('**/pom.xml') }}
@@ -202,7 +202,7 @@ runs:
     - id: restore-cache-node
       name: Restore Node Binary Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: installs
         # hash nodejs-parent/pom.xml so the pnpm-era layout (install-node-and-npm
@@ -226,7 +226,7 @@ runs:
 
     - name: Set up pnpm
       if: ${{ inputs.requires-node == 'true' }}
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -242,7 +242,7 @@ runs:
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -254,7 +254,7 @@ runs:
     - id: cache-sonar
       name: Cache SonarQube Packages
       if: ${{ inputs.cache-sonar == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ runner.os }}-sonar
@@ -345,7 +345,7 @@ runs:
     - id: persist-maven-repo
       name: Persist Maven Repo
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
         path: ~/.m2/repository
@@ -353,7 +353,7 @@ runs:
     - id: persist-docker-build-context
       name: Persist Docker Build Context
       if: ${{ inputs.generate-docker == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: docker-build-context${{ steps.artifact-suffix.outputs.suffix }}
         path: dotCMS/target/docker-build.tar
@@ -399,7 +399,7 @@ runs:
 
     - id: upload-docker-image
       name: Upload Docker Image as Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       if: ${{ inputs.generate-docker == 'true' }}
       with:
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
@@ -408,7 +408,7 @@ runs:
     - id: persist-build-classes
       name: Persist Build Classes
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
         path: |
@@ -426,7 +426,7 @@ runs:
     - id: save-cache-maven
       name: Save Maven Repository Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-maven.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ steps.restore-cache-maven.outputs.cache-primary-key }}
@@ -434,7 +434,7 @@ runs:
     - id: save-cache-node
       name: Save Node Binary Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-node.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: installs
         key: ${{ steps.restore-cache-node.outputs.cache-primary-key }}
@@ -442,7 +442,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' && inputs.generate-artifacts == 'true' && steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
@@ -450,7 +450,7 @@ runs:
     - id: save-cache-sonar
       name: Save SonarQube Cache
       if: ${{ inputs.cache-sonar == 'true' && steps.cache-sonar.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ steps.cache-sonar.outputs.cache-primary-key }}
@@ -458,7 +458,7 @@ runs:
     # ---------------------------- Generate Reports Artifacts ----------------------------
     - id: generate-build-reports-artifact
       name: Generate Build Reports Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: "build-reports-${{ inputs.stage-name }}"
@@ -469,7 +469,7 @@ runs:
 
     - id: create-test-reports-artifact
       name: Create Test Reports Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       if: always() && inputs.generates-test-results == 'true'
       with:
         name: "build-reports-test-${{ inputs.stage-name }}"
diff --git a/.github/actions/core-cicd/setup-java/action.yml b/.github/actions/core-cicd/setup-java/action.yml
index bceb8670a524..e6ed4932c0e4 100644
--- a/.github/actions/core-cicd/setup-java/action.yml
+++ b/.github/actions/core-cicd/setup-java/action.yml
@@ -57,7 +57,7 @@ runs:
         echo "graalvm_version=$GRAALVM_VERSION" >> $GITHUB_OUTPUT
     - name: Restore Cache SDKMan install
       id: restore-cache-sdkman
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ~/.sdkman
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-install
@@ -88,14 +88,14 @@ runs:
     - name: Save Cache SDKMan install
       id: save-cache-sdkman
       if: ${{ steps.restore-cache-sdkman.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: ~/.sdkman
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-install
 
     - name: Restore Cache Java SDK
       id: restore-cache-java
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.requested_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.requested_version }}
@@ -103,7 +103,7 @@ runs:
     - name: Restore Cache GraalVM SDK
       id: restore-cache-graalvm
       if: ${{ inputs.require-graalvm == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.graalvm_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.graalvm_version }}
@@ -168,7 +168,7 @@ runs:
         java -version
 
     - name: Save Cache Java SDK
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       if: ${{ steps.restore-cache-java.outputs.cache-hit != 'true' }}
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.requested_version }}
@@ -176,7 +176,7 @@ runs:
 
     - name: Save Cache GraalVM SDK
       if: ${{ inputs.require-graalvm == 'true' && steps.restore-cache-graalvm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.graalvm_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.graalvm_version }}
\ No newline at end of file

From 5a2c8bb31c65850f60595709827550e2e18fae3d Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:05:24 -0400
Subject: [PATCH 02/14] ci(actions): bump download-artifact to v8 with explicit
 digest-mismatch (#36850)

Batch 2 of the Node 24 runtime sweep. 14 sites, v4 -> v8.0.1.

v8 changed `digest-mismatch` from warn to **error**: a hash mismatch now fails
the run. That is the only change in this whole sweep that can turn a green
build red, so it is landed in two steps. This commit writes
`digest-mismatch: warn` explicitly at every site, making the runtime bump
provably behaviour-neutral -- exactly the pure runtime change #36850 asks for.
Flipping to `error` is a separate, revertable commit later in the sweep.

Exposure, in order:
  maven-job:266      maven-repo    -> ~/.m2/repository, multi-GB, cross-run
  maven-job:291      build-classes -> large glob, cross-run
  maven-job:277      docker-image  -> single large file
  finalize-phase:39  build-reports-* pattern: N artifacts, N chances to fail,
                     on EVERY PR and merge-queue run

The value is written out rather than inherited at all 14 sites, so a future
major cannot silently move the default again.

Verified rather than assumed:
- v5's breaking change (single-download-by-ID path flattening) applies only to
  `artifact-ids:`. Zero uses of `artifact-ids:` in the repo, so it does not apply.
- v8 no longer auto-unzips non-zip Content-Type. That only matters alongside
  `archive: false` uploads, which batch 1 deliberately avoided introducing.
- upload-artifact v7 and download-artifact v8 are bumped as a pair, as the issue
  requires; batch 1 covered the upload side.

issue_autodoc.yml:354 keeps its SHA pin, rotated to v8.0.1's SHA with a
corrected version comment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2db94cca17b9f073f7570740ef0939a2c4e13d72)
---
 .../core-cicd/deployment/deploy-cli-npm/action.yml       | 3 ++-
 .../core-cicd/deployment/deploy-docker/action.yml        | 3 ++-
 .github/actions/core-cicd/maven-job/action.yml           | 9 ++++++---
 .github/workflows/cicd_comp_finalize-phase.yml           | 3 ++-
 .github/workflows/cicd_comp_publish-pr-test-image.yml    | 3 ++-
 .github/workflows/cicd_comp_release-phase.yml            | 6 ++++--
 .github/workflows/cicd_manual_publish-starter.yml        | 3 ++-
 .github/workflows/cicd_release-cli.yml                   | 6 ++++--
 .github/workflows/issue_autodoc.yml                      | 3 ++-
 .../workflows/legacy-release_maven-release-process.yml   | 3 ++-
 10 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
index 66c13bf1c386..4825d45e2cdb 100644
--- a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
@@ -55,8 +55,9 @@ runs:
 
     - name: 'Download all cli build artifacts.'
       id: download-cli-artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8.0.1
       with:
+        digest-mismatch: warn
         pattern: cli-artifacts-*
         path: ${{ github.workspace }}/artifacts
         github-token: ${{ inputs.github-token }} # token with actions:read permissions on target repo
diff --git a/.github/actions/core-cicd/deployment/deploy-docker/action.yml b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
index 3f44360da617..31f004e7b898 100644
--- a/.github/actions/core-cicd/deployment/deploy-docker/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
@@ -86,9 +86,10 @@ runs:
   using: "composite"
   steps:
     - name: Download Docker Build Context
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8.0.1
       if: inputs.build_run_id # Only download the artifact if a build run id is provided
       with:
+        digest-mismatch: warn
         name: docker-build-context${{ inputs.artifact_suffix }}
         path: ${{ github.workspace }}
         run-id: ${{ inputs.build_run_id }}
diff --git a/.github/actions/core-cicd/maven-job/action.yml b/.github/actions/core-cicd/maven-job/action.yml
index eaf378eec877..907b7ed51b7b 100644
--- a/.github/actions/core-cicd/maven-job/action.yml
+++ b/.github/actions/core-cicd/maven-job/action.yml
@@ -263,8 +263,9 @@ runs:
     - id: restore-artifact-maven-repo
       name: Restore Maven Build Repo
       if: ${{ inputs.artifacts-from != '' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8.0.1
       with:
+        digest-mismatch: warn
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
@@ -273,8 +274,9 @@ runs:
     - id: restore-artifact-docker-image
       name: Restore Docker Image
       if: ${{ inputs.needs-docker-image == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8.0.1
       with:
+        digest-mismatch: warn
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
         path: /tmp/docker-image
 
@@ -286,8 +288,9 @@ runs:
     - id: restore-artifact-classes
       name: Restore Classes
       if: ${{ inputs.restore-classes == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8.0.1
       with:
+        digest-mismatch: warn
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
diff --git a/.github/workflows/cicd_comp_finalize-phase.yml b/.github/workflows/cicd_comp_finalize-phase.yml
index 95e51bd22892..98831a74dd40 100644
--- a/.github/workflows/cicd_comp_finalize-phase.yml
+++ b/.github/workflows/cicd_comp_finalize-phase.yml
@@ -36,8 +36,9 @@ jobs:
       # Download build reports from previous steps
       - name: Download build reports
         id: download-artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           path: /tmp/build-step-reports
           pattern: build-reports-*
           merge-multiple: false
diff --git a/.github/workflows/cicd_comp_publish-pr-test-image.yml b/.github/workflows/cicd_comp_publish-pr-test-image.yml
index 17898f57fddd..28c98da86b77 100644
--- a/.github/workflows/cicd_comp_publish-pr-test-image.yml
+++ b/.github/workflows/cicd_comp_publish-pr-test-image.yml
@@ -94,8 +94,9 @@ jobs:
 
       - name: Download prebuilt image
         if: steps.resolve.outputs.found == 'true'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           name: docker-image
           path: /tmp/prebuilt
           run-id: ${{ steps.resolve.outputs.run_id }}
diff --git a/.github/workflows/cicd_comp_release-phase.yml b/.github/workflows/cicd_comp_release-phase.yml
index f46784fae541..7ef6475cd2f1 100644
--- a/.github/workflows/cicd_comp_release-phase.yml
+++ b/.github/workflows/cicd_comp_release-phase.yml
@@ -144,8 +144,9 @@ jobs:
           java-version: ${{ inputs.java-version }}
 
       - name: Restore Maven Repository
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           name: maven-repo${{ steps.java-suffix.outputs.suffix }}
           path: ~/.m2/repository
 
@@ -248,8 +249,9 @@ jobs:
           github_token: ${{ secrets.CI_MACHINE_TOKEN }}
 
       - name: Download SBOM Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           path: ${{ github.workspace }}/artifacts
           pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
 
diff --git a/.github/workflows/cicd_manual_publish-starter.yml b/.github/workflows/cicd_manual_publish-starter.yml
index e115634f5f3a..5bf964c2b62c 100644
--- a/.github/workflows/cicd_manual_publish-starter.yml
+++ b/.github/workflows/cicd_manual_publish-starter.yml
@@ -126,8 +126,9 @@ jobs:
           echo "::endgroup::"
           
       - name: 'Download artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           github-token: ${{ github.token }}
           name: ${{ env.STARTER_TYPE }}-starter
           path: ${{ github.workspace }}/starter
diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index be6f1fe66a6b..a349cbdcfa14 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -165,8 +165,9 @@ jobs:
           echo "artifactsDir=${{ github.workspace }}/artifacts" >> "$GITHUB_ENV"
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           path: ${{ github.workspace }}/artifacts
           pattern: cli-artifacts-*
       - uses: ./.github/actions/core-cicd/maven-job
@@ -207,8 +208,9 @@ jobs:
         run: pip install jinja2-cli
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           path: ${{ github.workspace }}/artifacts
           pattern: cli-artifacts-*
           merge-multiple: true
diff --git a/.github/workflows/issue_autodoc.yml b/.github/workflows/issue_autodoc.yml
index e8f71540a904..57c34c6fc98b 100644
--- a/.github/workflows/issue_autodoc.yml
+++ b/.github/workflows/issue_autodoc.yml
@@ -351,8 +351,9 @@ jobs:
 
     steps:
       - name: Download report artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          digest-mismatch: warn
           name: autodoc-report
           path: /tmp/
         continue-on-error: true
diff --git a/.github/workflows/legacy-release_maven-release-process.yml b/.github/workflows/legacy-release_maven-release-process.yml
index b600f9344d3b..94c2e24ea0bd 100644
--- a/.github/workflows/legacy-release_maven-release-process.yml
+++ b/.github/workflows/legacy-release_maven-release-process.yml
@@ -395,8 +395,9 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8.0.1
         with:
+          digest-mismatch: warn
           path: ${{ github.workspace }}/artifacts
           pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
           

From 31102249cc32d5ebc7495c1f2c9cf8ff555e7d2a Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:06:13 -0400
Subject: [PATCH 03/14] ci(actions): bump actions/checkout to v7.0.1 (#36850)

Batch 4 of the Node 24 runtime sweep. 61 of 62 sites: 56 float tags and 5 SHA
pins. cicd_post-workflow-reporting.yml is deliberately held back to its own
commit -- it is the repo's only workflow_run + checkout pair and carries ~4,000
runs/90d, so it gets a one-line revert of its own.

Legacy pins cleared along the way: @v2 in utility_discover-docker-tags.yml,
@v3 in legacy-release_sbom-generator.yaml and
issue_manual_label-customer_deployed-issues.yml.

v7 refuses to check out fork PR code from pull_request_target / workflow_run.
Read src/input-helper.ts and src/unsafe-pr-checkout-helper.ts at tag v7.0.1 --
two independent reasons it cannot trigger here:

1. assertSafePrCheckout is only REACHED when a custom `repository:` or an
   explicit `ref:` is supplied. A default self-checkout is skipped outright.
2. The throw needs all three: the event is pull_request_target, or workflow_run
   whose workflow_run.event starts with pull_request; the head repo id differs
   from the base repo id (a genuine fork); AND the resolved input points at the
   fork's code (`repository` == fork full_name, or `ref` matching
   ^refs/pull/[0-9]+/(head|merge)$, or the commit == a payload PR head SHA).

Site by site: cicd_publish-pr-test-image.yml has no checkout step at all and is
gated head.repo.full_name == github.repository; cicd_comp_publish-pr-test-image.yml
never checks out; dotbot-review.yml and dotbot-act.yml fire on pull_request and
issue_comment, outside the guard's event list.

So: no v6 pins, and `allow-unsafe-pr-checkout: true` is NOT added anywhere. That
input would permanently disarm a real pwn-request protection against a risk this
repo does not have.

v6 moves credentials out of .git/config into a file under $RUNNER_TEMP. Grepped:
nothing reads .git/config or extraheader or extracts the token, and no step runs
git under sudo or inside `docker run` against the workspace. All ~10 `git push`
sites run in the same job and as the same user as their checkout.

v6's only hard runner requirement (>= 2.329.0, for Docker container actions) does
not apply: there are no `container:` jobs and no `uses: docker://` in the repo.

The five SHA pins keep their style, rotated to v7.0.1's SHA with corrected
version comments -- including the two that disagreed on main, where the same
checkout SHA was labelled # v4.2.2 in issue_autodoc.yml and # v4.2.0 in the
dotbot workflows.

Running actionlint locally confirms the three "runner of actions/checkout@v2|v3
is too old" reports present on main are now resolved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit fe57fcde94f367a65fc676dd5df12467b58c0233)
---
 .../core-cicd/deployment/deploy-cli-npm/action.yml        | 2 +-
 .../core-cicd/deployment/deploy-javadoc/action.yml        | 2 +-
 .../core-cicd/deployment/deploy-javascript-sdk/action.yml | 2 +-
 .../actions/core-cicd/deployment/deploy-jfrog/action.yml  | 2 +-
 .github/actions/legacy-release/sbom-generator/action.yml  | 2 +-
 .github/workflows/ai_claude-backend-reviewer.yml          | 2 +-
 .github/workflows/ai_claude-orchestrator.yml              | 4 ++--
 .github/workflows/ai_claude-rollback-safety.yml           | 2 +-
 .github/workflows/ai_claude-sdk-breaking-change.yml       | 2 +-
 .github/workflows/cicd_3-trunk.yml                        | 2 +-
 .github/workflows/cicd_4-nightly.yml                      | 2 +-
 .github/workflows/cicd_5-lts.yml                          | 2 +-
 .github/workflows/cicd_6-release.yml                      | 6 +++---
 .github/workflows/cicd_comp_ai-release-notes-phase.yml    | 2 +-
 .github/workflows/cicd_comp_build-phase.yml               | 4 ++--
 .../workflows/cicd_comp_changelog-site-publish-phase.yml  | 2 +-
 .github/workflows/cicd_comp_cli-native-build-phase.yml    | 2 +-
 .github/workflows/cicd_comp_deployment-phase.yml          | 2 +-
 .github/workflows/cicd_comp_initialize-phase.yml          | 2 +-
 .github/workflows/cicd_comp_pr-area-labeler.yml           | 2 +-
 .github/workflows/cicd_comp_release-phase.yml             | 4 ++--
 .github/workflows/cicd_comp_release-prepare-phase.yml     | 2 +-
 .github/workflows/cicd_comp_test-phase.yml                | 4 ++--
 .github/workflows/cicd_evergreen-tracks-admin.yml         | 2 +-
 .github/workflows/cicd_evergreen-tracks-promote.yml       | 6 +++---
 .github/workflows/cicd_manual_build-docker-context.yml    | 2 +-
 .github/workflows/cicd_manual_build-java-base.yml         | 2 +-
 .github/workflows/cicd_manual_publish-starter.yml         | 4 ++--
 .github/workflows/cicd_pr_skill-lint.yml                  | 2 +-
 .github/workflows/cicd_release-cli.yml                    | 8 ++++----
 .github/workflows/cicd_release-sdk.yml                    | 4 ++--
 .../workflows/cicd_scheduled_opensearch-phase-sweep.yml   | 2 +-
 .github/workflows/dotbot-act.yml                          | 2 +-
 .github/workflows/dotbot-review.yml                       | 2 +-
 .github/workflows/issue_autodoc.yml                       | 4 ++--
 .../issue_manual_label-customer_deployed-issues.yml       | 2 +-
 .github/workflows/issue_manual_label-issues.yml           | 2 +-
 .../legacy-release_comp_maven-build-docker-image.yml      | 2 +-
 .../workflows/legacy-release_maven-release-process.yml    | 8 ++++----
 .github/workflows/legacy-release_sbom-generator.yaml      | 2 +-
 .github/workflows/publish_docs.yml                        | 2 +-
 .github/workflows/utility_discover-docker-tags.yml        | 2 +-
 42 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
index 4825d45e2cdb..a7ce916393b3 100644
--- a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
@@ -39,7 +39,7 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
diff --git a/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml b/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
index a544a034dee2..e25de0b7f233 100644
--- a/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
@@ -28,7 +28,7 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
diff --git a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
index a9e4952cc782..42171746d61d 100644
--- a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
@@ -47,7 +47,7 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
       with:
         ref: ${{ inputs.ref }}
         token: ${{ inputs.github-token }}
diff --git a/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml b/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
index c71f17ad4280..5856fc6c6311 100644
--- a/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
@@ -38,7 +38,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7.0.1
 
     - uses: ./.github/actions/core-cicd/maven-job
       with:
diff --git a/.github/actions/legacy-release/sbom-generator/action.yml b/.github/actions/legacy-release/sbom-generator/action.yml
index 55ca4ad6a54d..62be7681ffc3 100644
--- a/.github/actions/legacy-release/sbom-generator/action.yml
+++ b/.github/actions/legacy-release/sbom-generator/action.yml
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout core repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
       with:
         repository: dotCMS/core
         token: ${{ inputs.github_token }}
diff --git a/.github/workflows/ai_claude-backend-reviewer.yml b/.github/workflows/ai_claude-backend-reviewer.yml
index a35ca19d3863..42808e6cff5b 100644
--- a/.github/workflows/ai_claude-backend-reviewer.yml
+++ b/.github/workflows/ai_claude-backend-reviewer.yml
@@ -51,7 +51,7 @@ jobs:
     outputs:
       has_java: ${{ steps.check.outputs.has_java }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ai_claude-orchestrator.yml b/.github/workflows/ai_claude-orchestrator.yml
index 2b73cef6ba21..f6aad998afeb 100644
--- a/.github/workflows/ai_claude-orchestrator.yml
+++ b/.github/workflows/ai_claude-orchestrator.yml
@@ -44,7 +44,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Check organization membership
         id: membership-check
@@ -128,7 +128,7 @@ jobs:
     outputs:
       prompt: ${{ steps.build.outputs.prompt }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - id: build
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/ai_claude-rollback-safety.yml b/.github/workflows/ai_claude-rollback-safety.yml
index e64344fca2bc..35c204588581 100644
--- a/.github/workflows/ai_claude-rollback-safety.yml
+++ b/.github/workflows/ai_claude-rollback-safety.yml
@@ -29,7 +29,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Check organization membership
         id: membership-check
diff --git a/.github/workflows/ai_claude-sdk-breaking-change.yml b/.github/workflows/ai_claude-sdk-breaking-change.yml
index 08cc46ff7440..e6524469c4ea 100644
--- a/.github/workflows/ai_claude-sdk-breaking-change.yml
+++ b/.github/workflows/ai_claude-sdk-breaking-change.yml
@@ -29,7 +29,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Check organization membership
         id: membership-check
diff --git a/.github/workflows/cicd_3-trunk.yml b/.github/workflows/cicd_3-trunk.yml
index 92b2e6be6186..200c15703471 100644
--- a/.github/workflows/cicd_3-trunk.yml
+++ b/.github/workflows/cicd_3-trunk.yml
@@ -163,7 +163,7 @@ jobs:
       # notify-slack's action.yml (same gap already hit and fixed once in
       # cicd_release-sdk.yml's publish job).
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: 'Compute next version'
         id: next-version
diff --git a/.github/workflows/cicd_4-nightly.yml b/.github/workflows/cicd_4-nightly.yml
index beefd081cfe1..f40d5060f9c1 100644
--- a/.github/workflows/cicd_4-nightly.yml
+++ b/.github/workflows/cicd_4-nightly.yml
@@ -88,7 +88,7 @@ jobs:
       build-ref: ${{ steps.find-commit.outputs.build-ref }}
       tag-date: ${{ steps.find-commit.outputs.tag-date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           # Bounded shallow checkout: Find Build Commit walks `git log` on main
           # back to midnight UTC. The window that matters is commits landing
diff --git a/.github/workflows/cicd_5-lts.yml b/.github/workflows/cicd_5-lts.yml
index e592bcf95a93..3232dc269308 100644
--- a/.github/workflows/cicd_5-lts.yml
+++ b/.github/workflows/cicd_5-lts.yml
@@ -46,7 +46,7 @@ jobs:
     outputs:
       version: ${{ steps.resolve.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - name: Resolve version from input or maven.config
         id: resolve
         env:
diff --git a/.github/workflows/cicd_6-release.yml b/.github/workflows/cicd_6-release.yml
index 9dd2a7ee3cb6..acc9d20cddbe 100644
--- a/.github/workflows/cicd_6-release.yml
+++ b/.github/workflows/cicd_6-release.yml
@@ -308,7 +308,7 @@ jobs:
       group: evergreen-tracks-registry
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
@@ -355,7 +355,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
           # Shallow checkout: this job only needs HEAD of main (it does its own
@@ -558,7 +558,7 @@ jobs:
     if: always()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/cicd_comp_ai-release-notes-phase.yml b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
index 38b5d1ac16e0..63eec4fb7aa7 100644
--- a/.github/workflows/cicd_comp_ai-release-notes-phase.yml
+++ b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
@@ -63,7 +63,7 @@ jobs:
           echo "Release '${RELEASE_TAG}' found."
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/cicd_comp_build-phase.yml b/.github/workflows/cicd_comp_build-phase.yml
index 011aa3af8c3e..36c7a6c60135 100644
--- a/.github/workflows/cicd_comp_build-phase.yml
+++ b/.github/workflows/cicd_comp_build-phase.yml
@@ -87,7 +87,7 @@ jobs:
     steps:
       # Checkout code based on whether a specific ref is provided
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         if: inputs.ref == ''
         with:
           fetch-depth: 0
@@ -103,7 +103,7 @@ jobs:
       # expressions, collapsing the true branch to 1.
       - name: Checkout code with ref ${{ inputs.ref }}
         if: inputs.ref != ''
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: ${{ inputs.run-pr-checks && '0' || '1' }}
diff --git a/.github/workflows/cicd_comp_changelog-site-publish-phase.yml b/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
index f76193f5d933..0474c7aaa95d 100644
--- a/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
+++ b/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
@@ -79,7 +79,7 @@ jobs:
       && startsWith(inputs.release_tag, 'v')
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/cicd_comp_cli-native-build-phase.yml b/.github/workflows/cicd_comp_cli-native-build-phase.yml
index 42a4ba7a7612..c26da060f101 100644
--- a/.github/workflows/cicd_comp_cli-native-build-phase.yml
+++ b/.github/workflows/cicd_comp_cli-native-build-phase.yml
@@ -87,7 +87,7 @@ jobs:
       artifact-url: ${{ steps.upload-artifact.outputs.artifact-url }}
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ env.BRANCH }}
 
diff --git a/.github/workflows/cicd_comp_deployment-phase.yml b/.github/workflows/cicd_comp_deployment-phase.yml
index 7b9850ddcfa7..2ed5333391c4 100644
--- a/.github/workflows/cicd_comp_deployment-phase.yml
+++ b/.github/workflows/cicd_comp_deployment-phase.yml
@@ -143,7 +143,7 @@ jobs:
       formatted_tags: ${{ steps.format-tags.outputs.formatted_tags }}
     steps:
       # Checkout the repository
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           # Shallow checkout: nothing in this job reads git history (no git
           # commands after checkout; Docker/NPM publishing works from the
diff --git a/.github/workflows/cicd_comp_initialize-phase.yml b/.github/workflows/cicd_comp_initialize-phase.yml
index aae04e712f82..b11ae15c42f9 100644
--- a/.github/workflows/cicd_comp_initialize-phase.yml
+++ b/.github/workflows/cicd_comp_initialize-phase.yml
@@ -128,7 +128,7 @@ jobs:
       # JSON array of filter names that matched (from dorny/paths-filter)
       changes: ${{ steps.filter.outputs.changes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         if: ${{ inputs.change-detection == 'enabled' }}
 
       # Execute the paths-filter step to determine changes
diff --git a/.github/workflows/cicd_comp_pr-area-labeler.yml b/.github/workflows/cicd_comp_pr-area-labeler.yml
index 36f98dfca5f0..fed64379ef27 100644
--- a/.github/workflows/cicd_comp_pr-area-labeler.yml
+++ b/.github/workflows/cicd_comp_pr-area-labeler.yml
@@ -31,7 +31,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout for config
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           sparse-checkout: .github/area-labels.yml
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/cicd_comp_release-phase.yml b/.github/workflows/cicd_comp_release-phase.yml
index 7ef6475cd2f1..cc78beed823c 100644
--- a/.github/workflows/cicd_comp_release-phase.yml
+++ b/.github/workflows/cicd_comp_release-phase.yml
@@ -89,7 +89,7 @@ jobs:
       JVM_TEST_MAVEN_OPTS: '-e -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn'
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.release_tag }}
 
@@ -240,7 +240,7 @@ jobs:
     if: inputs.java-version == ''
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/legacy-release/sbom-generator
         id: sbom-generator
diff --git a/.github/workflows/cicd_comp_release-prepare-phase.yml b/.github/workflows/cicd_comp_release-prepare-phase.yml
index 484e5f418f47..f0f3ad9e3e8d 100644
--- a/.github/workflows/cicd_comp_release-prepare-phase.yml
+++ b/.github/workflows/cicd_comp_release-prepare-phase.yml
@@ -98,7 +98,7 @@ jobs:
       # the release branch from. fetch-depth: 0 pulled every branch ref
       # (~2k+ branches, ~1.1 GB pack) and cost ~20 min per release run.
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           token: ${{ secrets.CI_MACHINE_TOKEN || github.token }}
diff --git a/.github/workflows/cicd_comp_test-phase.yml b/.github/workflows/cicd_comp_test-phase.yml
index d54c46b4a6f0..7e76f21aad03 100644
--- a/.github/workflows/cicd_comp_test-phase.yml
+++ b/.github/workflows/cicd_comp_test-phase.yml
@@ -94,7 +94,7 @@ jobs:
       has-tests: ${{ steps.generate-matrix.outputs.has-tests }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           # Shallow checkout: this job only reads .github/test-matrix.yml from HEAD.
           # fetch-depth: 0 pulled every branch ref (~2k+ branches, ~1.1 GB pack).
@@ -249,7 +249,7 @@ jobs:
 
     steps:          
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           # Shallow checkout: test jobs run Maven suites against the checked-out
           # snapshot only — no git history is read anywhere in this job or in the
diff --git a/.github/workflows/cicd_evergreen-tracks-admin.yml b/.github/workflows/cicd_evergreen-tracks-admin.yml
index 45c939fb151b..0723e6365a67 100644
--- a/.github/workflows/cicd_evergreen-tracks-admin.yml
+++ b/.github/workflows/cicd_evergreen-tracks-admin.yml
@@ -38,7 +38,7 @@ jobs:
   admin:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
diff --git a/.github/workflows/cicd_evergreen-tracks-promote.yml b/.github/workflows/cicd_evergreen-tracks-promote.yml
index 8a3c1f666e58..c3ef454150a8 100644
--- a/.github/workflows/cicd_evergreen-tracks-promote.yml
+++ b/.github/workflows/cicd_evergreen-tracks-promote.yml
@@ -74,7 +74,7 @@ jobs:
       # since approval before it mutates anything.
       plan: ${{ steps.plan.outputs.plan }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
@@ -176,7 +176,7 @@ jobs:
       moved: ${{ steps.apply.outputs.moved }}
       summary: ${{ steps.apply.outputs.summary }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
@@ -271,7 +271,7 @@ jobs:
     if: always()
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - name: Notify failure
         if: needs.plan.result == 'failure' || needs.apply.result == 'failure'
         continue-on-error: true
diff --git a/.github/workflows/cicd_manual_build-docker-context.yml b/.github/workflows/cicd_manual_build-docker-context.yml
index 339c61d678dd..8ed112eb917e 100644
--- a/.github/workflows/cicd_manual_build-docker-context.yml
+++ b/.github/workflows/cicd_manual_build-docker-context.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
       - name: Set Common Vars
         run: |
           PLATFORMS='linux/amd64'
diff --git a/.github/workflows/cicd_manual_build-java-base.yml b/.github/workflows/cicd_manual_build-java-base.yml
index 11bc91b240c5..e3a85fa35185 100644
--- a/.github/workflows/cicd_manual_build-java-base.yml
+++ b/.github/workflows/cicd_manual_build-java-base.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
       - name: Set Common Vars
         run: |
           PLATFORMS='linux/amd64'
diff --git a/.github/workflows/cicd_manual_publish-starter.yml b/.github/workflows/cicd_manual_publish-starter.yml
index 5bf964c2b62c..578e4ea4ebf9 100644
--- a/.github/workflows/cicd_manual_publish-starter.yml
+++ b/.github/workflows/cicd_manual_publish-starter.yml
@@ -111,7 +111,7 @@ jobs:
     steps:
       - name: 'Checkout repository'
         if: ${{ github.event.inputs.type == 'empty' && github.event.inputs.dry-run == 'false' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - uses: jfrog/setup-jfrog-cli@v4
         env:
@@ -213,7 +213,7 @@ jobs:
     if: always() && github.event.inputs.dry-run == 'false'
     steps:
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Compose Message
         id: compose-message
diff --git a/.github/workflows/cicd_pr_skill-lint.yml b/.github/workflows/cicd_pr_skill-lint.yml
index 4933c7a2a1eb..dbb928ccd42c 100644
--- a/.github/workflows/cicd_pr_skill-lint.yml
+++ b/.github/workflows/cicd_pr_skill-lint.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .claude/skills
diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index a349cbdcfa14..326b5b36d3c8 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -88,7 +88,7 @@ jobs:
 
       # Checkout the repository
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       # Setup git configuration
       - name: 'Setup git config'
@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.AUXILIARY_BRANCH }}
       - name: 'Create artifacts directory'
@@ -193,7 +193,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: 'Checkout code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.HEAD }}
 
@@ -359,7 +359,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.HEAD }}
 
diff --git a/.github/workflows/cicd_release-sdk.yml b/.github/workflows/cicd_release-sdk.yml
index 7ee8de2b02e2..be8a312dc3ac 100644
--- a/.github/workflows/cicd_release-sdk.yml
+++ b/.github/workflows/cicd_release-sdk.yml
@@ -119,7 +119,7 @@ jobs:
       # can't be resolved on an empty runner workspace, so without this the Slack step
       # would silently no-op instead of ever sending the failure notice.
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: 'Slack Notification (Pre-check failure)'
         continue-on-error: true
@@ -143,7 +143,7 @@ jobs:
       # The composite action re-checks-out internally at the correct ref for the actual
       # build/publish; this checkout only needs to make the action definition resolvable.
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.REF }}
 
diff --git a/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml b/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
index c06dfe691860..484a1dac0504 100644
--- a/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
+++ b/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
@@ -119,7 +119,7 @@ jobs:
     if: failure()
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
       - name: Post failure to #team-scout
         uses: ./.github/actions/core-cicd/notification/notify-slack
         with:
diff --git a/.github/workflows/dotbot-act.yml b/.github/workflows/dotbot-act.yml
index 1eca0aa8a09c..b93721591f3d 100644
--- a/.github/workflows/dotbot-act.yml
+++ b/.github/workflows/dotbot-act.yml
@@ -37,7 +37,7 @@ jobs:
     steps:
       # Pinned to a full commit SHA: a mutable tag could be repointed to run
       # attacker-controlled code with this job's write-scoped GITHUB_TOKEN.
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # The action code must be loaded from the pinned release SHA, not this
diff --git a/.github/workflows/dotbot-review.yml b/.github/workflows/dotbot-review.yml
index 3db33324d4df..7a86b25fd80b 100644
--- a/.github/workflows/dotbot-review.yml
+++ b/.github/workflows/dotbot-review.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
       # Pinned to a full commit SHA: a mutable tag could be repointed to run
       # attacker-controlled code with this job's write-scoped GITHUB_TOKEN.
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: dotbot autonomous review
diff --git a/.github/workflows/issue_autodoc.yml b/.github/workflows/issue_autodoc.yml
index 57c34c6fc98b..8823a41fb80e 100644
--- a/.github/workflows/issue_autodoc.yml
+++ b/.github/workflows/issue_autodoc.yml
@@ -97,10 +97,10 @@ jobs:
 
     steps:
       - name: Checkout triggering repo
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout dotcms-aios
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: dotCMS/dotcms-aios
           token: ${{ secrets.CI_MACHINE_TOKEN }}
diff --git a/.github/workflows/issue_manual_label-customer_deployed-issues.yml b/.github/workflows/issue_manual_label-customer_deployed-issues.yml
index 2ce81f85db14..6d88b12df235 100644
--- a/.github/workflows/issue_manual_label-customer_deployed-issues.yml
+++ b/.github/workflows/issue_manual_label-customer_deployed-issues.yml
@@ -19,7 +19,7 @@ jobs:
     
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7.0.1
       
       - name: Set up Python
         uses: actions/setup-python@v4
diff --git a/.github/workflows/issue_manual_label-issues.yml b/.github/workflows/issue_manual_label-issues.yml
index 03adb6f5581b..c0637299f2d1 100644
--- a/.github/workflows/issue_manual_label-issues.yml
+++ b/.github/workflows/issue_manual_label-issues.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Fetch issues
         id: fetch-next-release-issues
diff --git a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
index 848fcdefa3f4..0b5e0f4f588a 100644
--- a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
+++ b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
@@ -101,7 +101,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
diff --git a/.github/workflows/legacy-release_maven-release-process.yml b/.github/workflows/legacy-release_maven-release-process.yml
index 94c2e24ea0bd..5451f63f9d14 100644
--- a/.github/workflows/legacy-release_maven-release-process.yml
+++ b/.github/workflows/legacy-release_maven-release-process.yml
@@ -88,7 +88,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_MACHINE_TOKEN }}
@@ -262,7 +262,7 @@ jobs:
     if: success()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.prepare-release.outputs.release_tag }}
 
@@ -386,7 +386,7 @@ jobs:
     needs: [  prepare-release, build-push-image ]
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/legacy-release/sbom-generator
         id: sbom-generator
@@ -438,7 +438,7 @@ jobs:
     if: success()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/legacy-release_sbom-generator.yaml b/.github/workflows/legacy-release_sbom-generator.yaml
index 3ecbc9bbe7db..41a45ffaba7f 100644
--- a/.github/workflows/legacy-release_sbom-generator.yaml
+++ b/.github/workflows/legacy-release_sbom-generator.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout core-test-results repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7.0.1
         with:
           repository: dotCMS/core-test-results
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish_docs.yml b/.github/workflows/publish_docs.yml
index e59851ecc602..a19830914951 100644
--- a/.github/workflows/publish_docs.yml
+++ b/.github/workflows/publish_docs.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
       - name: Configuring Node.js
diff --git a/.github/workflows/utility_discover-docker-tags.yml b/.github/workflows/utility_discover-docker-tags.yml
index 1b392561e3cf..e399af3b0b92 100644
--- a/.github/workflows/utility_discover-docker-tags.yml
+++ b/.github/workflows/utility_discover-docker-tags.yml
@@ -24,7 +24,7 @@ jobs:
         run: echo "$GITHUB_CONTEXT"
         if: env.DEBUG == 'true'
       - name: Checkout core
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7.0.1
       - name: Set Common Vars
         run: |
           pwd && ls -las

From 7b94d182d357c3864ce37ee5a09def5c423acf4b Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:06:50 -0400
Subject: [PATCH 04/14] ci(actions): bump dorny/paths-filter to v4.0.3 (#36850)

Batch 5a, isolated on purpose: this action is the mechanism accepted ADR-0013
depends on, so it gets a commit that reverts alone.

ADR-0013 ("Skip Integration and Postman Tests for Frontend-Only Changes in
Merge Queue") turns on path-based test filtering in the merge queue. Its entire
implementation is this one step at cicd_comp_initialize-phase.yml, whose outputs
the "Rewrite Filter" step consumes.

Safe because v4.0.0's only change is `feat: update action runtime to node24` --
no input, output or filter-semantics change. Verified against the upstream
release rather than inferred.

One line touched. `id: filter` and the step's `if:` guard are untouched, because
the fail-open design hangs off them: "Rewrite Filter" reads
`toJSON(steps.filter.outputs)` and defaults every filter to 'true' when change
detection is disabled, so a filter that fails to resolve runs MORE tests, not
fewer. Preserving that direction matters more than the bump.

Note for anyone re-reading ADR-0013: the code has moved on since it was written.
The ADR describes a `validation-level` input and per-output `|| 'true'` defaults;
the workflow now takes `change-detection` and consumes the outputs as a JSON
object. The dependency on paths-filter's outputs is unchanged, which is what
makes this bump safe.

Still to verify on a real merge-queue run (tracked as a task, not assumed here):
that the filter resolves and a frontend-only change still skips integration and
Postman.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit bd5a9dc0904b7cd5481dcaa1cef6cfefb5d27511)
---
 .github/workflows/cicd_comp_initialize-phase.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cicd_comp_initialize-phase.yml b/.github/workflows/cicd_comp_initialize-phase.yml
index b11ae15c42f9..a14d4e485eb8 100644
--- a/.github/workflows/cicd_comp_initialize-phase.yml
+++ b/.github/workflows/cicd_comp_initialize-phase.yml
@@ -133,7 +133,7 @@ jobs:
 
       # Execute the paths-filter step to determine changes
       # For PRs, paths-filter automatically uses GitHub API to get changed files
-      - uses: dorny/paths-filter@v3.0.1
+      - uses: dorny/paths-filter@v4.0.3
         if: ${{ inputs.change-detection == 'enabled' }}
         id: filter
         with:

From 1a0cd3b798994d105f0c564f07622053ffb9f466 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:07:22 -0400
Subject: [PATCH 05/14] ci(actions): bump the remaining PR-pipeline third-party
 actions (#36850)

Batch 5b. These four are not in #36850's list, but the runner emits its
deprecation annotation PER JOB, listing that job's stale actions -- so without
them AC-001 fails on its own terms.

Measured on run 33122809569 before the sweep:

  Label PR / Apply Area Labels     checkout@v4, github-script@v7
  PR Test / Setup Test Matrix      checkout@v4, github-script@v7
  Finalize / Prepare Report Data   upload-artifact@v4, download-artifact@v4

github-script@v7 appears in two of the three annotated jobs. Bumping only the
six actions the issue names would clear Initial Artifact Build and leave
initialize, label-pr and test still annotated.

  actions/github-script             @v7      -> @v8       (14)
  docker/login-action               @v3/@v3.0.0 -> @v4.6.0 (12)
  dawidd6/action-download-artifact  @v6      -> @v24       (3)

v8 is a pure node24 bump: no "type": "module", still @actions/github ^6.0.0 and
@octokit/core ^5.0.1. That is the whole of what this issue needs.

Worth recording because the opposite is widely repeated: **v9 does not break
require()**. Checked at tag v9.0.0 -- src/main.ts still passes
`require: wrapRequire` and `__original_require__`, src/wrap-require.ts is a Proxy
over __non_webpack_require__ handling both bare module IDs and ./-relative paths,
and src/async-function.ts still declares `require: NodeRequire`. All three
require() sites here (require('fs') x2, plus one local-module require) would keep
working.

What v9 actually changes: @actions/github becomes ESM-only so
require('@actions/github') fails -- 0 occurrences here; and getOctokit becomes an
injected parameter, making `const`/`let getOctokit` a SyntaxError -- also 0
occurrences. The real cost is Octokit v5 -> v7 under 14 inline scripts, which is
a different review from a runtime bump. Deferred to #37194 with that scope, not
with a wrong reason.

Verified against v24's own action.yml: every input in use is still present
(github_token, workflow_search, commit, workflow_conclusion, search_artifacts,
dry_run, name, name_is_regexp, path, run_id, if_no_artifact_found) and so is the
found_artifact output. All three call sites already set
`if_no_artifact_found: warn`, so they are non-fatal by construction.

Worth a follow-up, not this PR: actions/download-artifact@v8 now supports run-id
+ github-token natively, so this dependency may be removable. It would be a
behaviour change (no name_is_regexp, no workflow_search/commit discovery), so it
belongs in #37194.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit eb6183db54ad536260b1c76e6bd99094b172098f)
---
 .../actions/core-cicd/deployment/deploy-docker/action.yml   | 4 ++--
 .github/actions/core-cicd/maven-job/action.yml              | 2 +-
 .github/workflows/cicd_6-release.yml                        | 2 +-
 .github/workflows/cicd_comp_initialize-phase.yml            | 2 +-
 .github/workflows/cicd_comp_pr-area-labeler.yml             | 2 +-
 .github/workflows/cicd_comp_test-phase.yml                  | 2 +-
 .github/workflows/cicd_evergreen-tracks-admin.yml           | 2 +-
 .github/workflows/cicd_evergreen-tracks-promote.yml         | 4 ++--
 .github/workflows/cicd_manual_build-docker-context.yml      | 2 +-
 .github/workflows/cicd_manual_build-java-base.yml           | 2 +-
 .github/workflows/cicd_post-workflow-reporting.yml          | 4 ++--
 .github/workflows/cicd_scheduled_notify-seated-prs.yml      | 6 +++---
 .github/workflows/cicd_weekly-rolling-tags.yml              | 2 +-
 .github/workflows/issue_comp_frontend-notify.yml            | 4 ++--
 .github/workflows/issue_comp_label-conditional-labeling.yml | 4 ++--
 .github/workflows/issue_comp_release-labeling.yml           | 4 ++--
 .github/workflows/issue_on-open_add-to-triage-project..yml  | 2 +-
 .../legacy-release_comp_maven-build-docker-image.yml        | 4 ++--
 18 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/actions/core-cicd/deployment/deploy-docker/action.yml b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
index 31f004e7b898..50f0a40de573 100644
--- a/.github/actions/core-cicd/deployment/deploy-docker/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
@@ -163,14 +163,14 @@ runs:
           fi
         echo "EOF" >> $GITHUB_ENV
     - name: Docker.io login
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@v4.6.0
       with:
         username: ${{ inputs.docker_io_username }}
         password: ${{ inputs.docker_io_token }}
       if: (inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH') && inputs.do_deploy == 'true'
 
     - name: GHCR.io login
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@v4.6.0
       with:
         registry: ghcr.io
         username: ${{ inputs.ghcr_io_username }}
diff --git a/.github/actions/core-cicd/maven-job/action.yml b/.github/actions/core-cicd/maven-job/action.yml
index 907b7ed51b7b..fffb75cf3ecc 100644
--- a/.github/actions/core-cicd/maven-job/action.yml
+++ b/.github/actions/core-cicd/maven-job/action.yml
@@ -297,7 +297,7 @@ runs:
 
     - name: Docker Hub Login
       if: ${{ inputs.docker-io-username != '' && inputs.docker-io-token != '' }}
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@v4.6.0
       with:
         username: ${{ inputs.docker-io-username }}
         password: ${{ inputs.docker-io-token }}
diff --git a/.github/workflows/cicd_6-release.yml b/.github/workflows/cicd_6-release.yml
index acc9d20cddbe..a77c7a45ac75 100644
--- a/.github/workflows/cicd_6-release.yml
+++ b/.github/workflows/cicd_6-release.yml
@@ -312,7 +312,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_comp_initialize-phase.yml b/.github/workflows/cicd_comp_initialize-phase.yml
index a14d4e485eb8..ed64ef65a204 100644
--- a/.github/workflows/cicd_comp_initialize-phase.yml
+++ b/.github/workflows/cicd_comp_initialize-phase.yml
@@ -84,7 +84,7 @@ jobs:
     steps:
       - name: Download Build Artifact
         id: data-download
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@v24
         if: ${{ inputs.reuse-previous-build == true }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/cicd_comp_pr-area-labeler.yml b/.github/workflows/cicd_comp_pr-area-labeler.yml
index fed64379ef27..795778623d97 100644
--- a/.github/workflows/cicd_comp_pr-area-labeler.yml
+++ b/.github/workflows/cicd_comp_pr-area-labeler.yml
@@ -37,7 +37,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Apply Area Labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/cicd_comp_test-phase.yml b/.github/workflows/cicd_comp_test-phase.yml
index 7e76f21aad03..470c5323b301 100644
--- a/.github/workflows/cicd_comp_test-phase.yml
+++ b/.github/workflows/cicd_comp_test-phase.yml
@@ -108,7 +108,7 @@ jobs:
 
       - name: Generate test matrix
         id: generate-matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         env:
           # Passed via env (not interpolated into the script) to avoid script injection.
           OPENSEARCH_PHASE: ${{ inputs.opensearch_phase }}
diff --git a/.github/workflows/cicd_evergreen-tracks-admin.yml b/.github/workflows/cicd_evergreen-tracks-admin.yml
index 0723e6365a67..15a5aa241992 100644
--- a/.github/workflows/cicd_evergreen-tracks-admin.yml
+++ b/.github/workflows/cicd_evergreen-tracks-admin.yml
@@ -42,7 +42,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_evergreen-tracks-promote.yml b/.github/workflows/cicd_evergreen-tracks-promote.yml
index c3ef454150a8..ffeae3bf0a53 100644
--- a/.github/workflows/cicd_evergreen-tracks-promote.yml
+++ b/.github/workflows/cicd_evergreen-tracks-promote.yml
@@ -78,7 +78,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -180,7 +180,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_manual_build-docker-context.yml b/.github/workflows/cicd_manual_build-docker-context.yml
index 8ed112eb917e..738fdba5d3c0 100644
--- a/.github/workflows/cicd_manual_build-docker-context.yml
+++ b/.github/workflows/cicd_manual_build-docker-context.yml
@@ -45,7 +45,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
         if: github.event.inputs.multi_arch == 'true'
       - name: Docker Hub login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_manual_build-java-base.yml b/.github/workflows/cicd_manual_build-java-base.yml
index e3a85fa35185..238fa1327694 100644
--- a/.github/workflows/cicd_manual_build-java-base.yml
+++ b/.github/workflows/cicd_manual_build-java-base.yml
@@ -45,7 +45,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
         if: github.event.inputs.multi_arch == 'true'
       - name: Docker Hub login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_post-workflow-reporting.yml b/.github/workflows/cicd_post-workflow-reporting.yml
index 48f7bacb89dc..5331830640e3 100644
--- a/.github/workflows/cicd_post-workflow-reporting.yml
+++ b/.github/workflows/cicd_post-workflow-reporting.yml
@@ -60,7 +60,7 @@ jobs:
       # Download workflow data from previous run
       - name: Download Workflow Data
         id: data-download
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@v24
         with:
           name: 'workflow-data'
           run_id: ${{ github.event.workflow_run.id || inputs.run-id }}
@@ -69,7 +69,7 @@ jobs:
       # Download build reports from previous run
       - name: Download build reports
         id: download-artifact
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@v24
         with:
           name: build-reports-test-.*
           name_is_regexp: true
diff --git a/.github/workflows/cicd_scheduled_notify-seated-prs.yml b/.github/workflows/cicd_scheduled_notify-seated-prs.yml
index d3cf89dd5a3d..f516789ad8dd 100644
--- a/.github/workflows/cicd_scheduled_notify-seated-prs.yml
+++ b/.github/workflows/cicd_scheduled_notify-seated-prs.yml
@@ -27,7 +27,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
       - name: Filter execution
         id: filter-execution
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           result-encoding: string
           script: |
@@ -42,7 +42,7 @@ jobs:
       - id: fetch-seated-prs
         name: Fetch Seated PRs
         if: success() && steps.filter-execution.outputs.continue == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           result-encoding: string
           retries: 3
@@ -163,7 +163,7 @@ jobs:
     steps:
       - name: Build Message
         id: build-message
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           result-encoding: string
           script: |
diff --git a/.github/workflows/cicd_weekly-rolling-tags.yml b/.github/workflows/cicd_weekly-rolling-tags.yml
index 4acd4eda107a..4575efbe6095 100644
--- a/.github/workflows/cicd_weekly-rolling-tags.yml
+++ b/.github/workflows/cicd_weekly-rolling-tags.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/issue_comp_frontend-notify.yml b/.github/workflows/issue_comp_frontend-notify.yml
index 0e87f355e686..2a8a020234ac 100644
--- a/.github/workflows/issue_comp_frontend-notify.yml
+++ b/.github/workflows/issue_comp_frontend-notify.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Check if Technology body changed
         id: body-technology-check
         if: github.event.action == 'edited'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const words = ['frontend', 'front-end'];
@@ -77,7 +77,7 @@ jobs:
       - name: Check if Technology label changed
         id: label-technology-check
         if: github.event.action == 'labeled'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/issue_comp_label-conditional-labeling.yml b/.github/workflows/issue_comp_label-conditional-labeling.yml
index fa6dd80ef7d3..f3d2b74c9e14 100644
--- a/.github/workflows/issue_comp_label-conditional-labeling.yml
+++ b/.github/workflows/issue_comp_label-conditional-labeling.yml
@@ -64,7 +64,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJSON(github) }}
       - name: Resolve Labels
         id: resolve-labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           result-encoding: string
           script: |
@@ -93,7 +93,7 @@ jobs:
             
             core.setOutput('labels', JSON.stringify(filteredLabels));
       - name: Add Labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         if: success() && steps.resolve-labels.outputs.labels != ''
         with:
           result-encoding: string
diff --git a/.github/workflows/issue_comp_release-labeling.yml b/.github/workflows/issue_comp_release-labeling.yml
index 19c995c7f326..fd41363dddf7 100644
--- a/.github/workflows/issue_comp_release-labeling.yml
+++ b/.github/workflows/issue_comp_release-labeling.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Rename label
         if: success()
         id: validate-inputs
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           result-encoding: string
           retries: 3
@@ -94,7 +94,7 @@ jobs:
             
       - name: Re-Create New Label
         if: success()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           result-encoding: string
           retries: 3
diff --git a/.github/workflows/issue_on-open_add-to-triage-project..yml b/.github/workflows/issue_on-open_add-to-triage-project..yml
index d401d880d187..7010f5c4cedd 100644
--- a/.github/workflows/issue_on-open_add-to-triage-project..yml
+++ b/.github/workflows/issue_on-open_add-to-triage-project..yml
@@ -12,7 +12,7 @@ jobs:
     if: github.event.issue.assignee == null
     steps:
       - name: Check team labels and add to project
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.TRIAGE_PROJECT_TOKEN }}
           script: |
diff --git a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
index 0b5e0f4f588a..5a0b9bb93c75 100644
--- a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
+++ b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
@@ -257,14 +257,14 @@ jobs:
         if: success()
 
       - name: Docker.io login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.docker_io_username }}
           password: ${{ secrets.docker_io_token }}
         if: inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH'
 
       - name: GHCR.io login
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ secrets.ghcr_io_username }}

From 279e4d459aec23bacc1449109cff6f1f5d66e19f Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:07:22 -0400
Subject: [PATCH 06/14] ci(actions): bump checkout in post-workflow-reporting
 (#36850)

Batch 6. One line, its own commit, because this is the repo's only
workflow_run + actions/checkout pair and it runs ~4,000 times per 90 days.

The v7 fork-PR guard cannot fire here, for two independent reasons (full
analysis in the batch-4 commit):

1. This is a bare `- uses: actions/checkout@v7.0.1` with no `with:` block at
   all, so assertSafePrCheckout is never even reached -- the guard only runs
   when a custom `repository:` or explicit `ref:` is supplied.
2. On workflow_run, github.ref and github.sha resolve to the default branch,
   never the fork head, so the condition that requires the resolved input to
   point at fork code is false.

Cannot be verified before merge: it needs a real completed workflow_run for
'PR Check', and its fork path only surfaces on the first external-contributor
PR after merge. Watch that, not the green internal ones.

Blast radius if wrong is reporting only -- Slack messages and test-report check
runs. It gates no merge. And the failure mode is loud and instant: the step
fails in seconds with "Refusing to check out fork pull request code".

With this commit every actions/checkout reference under .github/ is on v7.0.1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 0fb3c5ea36ea01d65ff5aa76aa1f0654819f6423)
---
 .github/workflows/cicd_post-workflow-reporting.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cicd_post-workflow-reporting.yml b/.github/workflows/cicd_post-workflow-reporting.yml
index 5331830640e3..804db8a9fe59 100644
--- a/.github/workflows/cicd_post-workflow-reporting.yml
+++ b/.github/workflows/cicd_post-workflow-reporting.yml
@@ -55,7 +55,7 @@ jobs:
         run: echo "$GITHUB_CONTEXT"
 
       # Checkout the repository
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
       # Download workflow data from previous run
       - name: Download Workflow Data

From a7dc7f04d9ef9a18d2cdf068c5d65f43b1987684 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:08:11 -0400
Subject: [PATCH 07/14] ci(actions): bump setup-node and the remaining
 composites (#36850)

Batch 7. Everything still on a stale pin outside the hot path: the four
core-cicd deployment composites, the sbom-generator, and the release, manual,
scheduled and PR-lint workflows.

  actions/setup-node       @v4 / @49933ea5 -> @v7.0.0  (6)
  actions/upload-artifact  @v4 -> @v7.0.1              (4)
  actions/cache/restore    @v4 -> @v6.1.0              (1)
  actions/cache/save       @v4 -> @v6.1.0              (1)
  pnpm/action-setup        @v4 -> @v6.0.10             (1)

pnpm caching is managed manually. That precondition does not exist in this repo,
so adding the input would be verifiably dead config -- and dead config gets
cargo-culted into places where it also does nothing.

setup-node can cache two ways, and both are closed here:

1. Explicitly, via `cache:` / `cache-dependency-path`. Verified: neither input
   is set at any of the 8 call sites, nor anywhere else under .github/.
2. Automatically, added in v5, driven by packageManager / devEngines.packageManager
   in $GITHUB_WORKSPACE/package.json. setup-node reads ONLY that path, and this
   repo has no root package.json -- just a stub root package-lock.json. So
   core-web/package.json's `packageManager: pnpm@10.17.1` is invisible to it,
   and v6 narrowed automatic caching to npm anyway.

Both facts are load-bearing: (1) alone leaves v5's automatic path open, (2) alone
leaves an explicit `cache:` open. Together they establish that no setup-node
cache can collide with the manual pnpm store cache at
deploy-javascript-sdk/action.yml:123,143 -- the hazard the AC was written to
prevent. The deviation is documented in the spec and was signed off there.

deploy-javascript-sdk is the one file where setup-node precedes pnpm/action-setup
plus a manual store cache, so it is worth an eyeball on the run log rather than a
config change.

cicd_pr_skill-lint.yml keeps its SHA pin, rotated to v7.0.0's SHA with a
corrected comment.

What remains after this commit sits only in legacy or disabled workflows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit ac007120c37bc14888e3cbe37f7ee7b56bd39c83)
---
 .../core-cicd/deployment/deploy-cli-npm/action.yml        | 2 +-
 .../core-cicd/deployment/deploy-javascript-sdk/action.yml | 8 ++++----
 .github/actions/legacy-release/sbom-generator/action.yml  | 2 +-
 .github/workflows/cicd_6-release.yml                      | 2 +-
 .github/workflows/cicd_comp_ai-release-notes-phase.yml    | 2 +-
 .github/workflows/cicd_comp_cli-native-build-phase.yml    | 2 +-
 .github/workflows/cicd_comp_finalize-phase.yml            | 2 +-
 .github/workflows/cicd_manual_publish-starter.yml         | 2 +-
 .github/workflows/cicd_pr_skill-lint.yml                  | 2 +-
 .github/workflows/cicd_release-cli.yml                    | 2 +-
 .github/workflows/cicd_scheduled_image-cve-scan.yml       | 2 +-
 11 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
index a7ce916393b3..80f006a9c3a4 100644
--- a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
@@ -44,7 +44,7 @@ runs:
         ref: ${{ inputs.ref }}
 
     - name: 'Set up Node.js'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
diff --git a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
index 42171746d61d..05bab0968104 100644
--- a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
@@ -53,7 +53,7 @@ runs:
         token: ${{ inputs.github-token }}
 
     - name: 'Setup Node'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7.0.0
       with:
         node-version-file: 'core-web/.nvmrc'
 
@@ -106,7 +106,7 @@ runs:
       shell: bash
 
     - name: Set up pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -120,7 +120,7 @@ runs:
 
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -140,7 +140,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
diff --git a/.github/actions/legacy-release/sbom-generator/action.yml b/.github/actions/legacy-release/sbom-generator/action.yml
index 62be7681ffc3..6771ae8b82f5 100644
--- a/.github/actions/legacy-release/sbom-generator/action.yml
+++ b/.github/actions/legacy-release/sbom-generator/action.yml
@@ -52,7 +52,7 @@ runs:
         mv core/sbom-cyclonedx.json core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
 
     - name: Upload SBOM to GitHub
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: sbom-dotcms-${{ env.DOTCMS_VERSION }}
         path: core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
diff --git a/.github/workflows/cicd_6-release.yml b/.github/workflows/cicd_6-release.yml
index a77c7a45ac75..822f6d0c095b 100644
--- a/.github/workflows/cicd_6-release.yml
+++ b/.github/workflows/cicd_6-release.yml
@@ -579,7 +579,7 @@ jobs:
           && !contains(needs.release-prepare.outputs.release_tag, '_lts_')
           && startsWith(needs.release-prepare.outputs.release_tag, 'v')
         continue-on-error: true
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/cicd_comp_ai-release-notes-phase.yml b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
index 63eec4fb7aa7..825ba6b67a2c 100644
--- a/.github/workflows/cicd_comp_ai-release-notes-phase.yml
+++ b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
@@ -68,7 +68,7 @@ jobs:
           ref: main
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/cicd_comp_cli-native-build-phase.yml b/.github/workflows/cicd_comp_cli-native-build-phase.yml
index c26da060f101..07c2f24968c9 100644
--- a/.github/workflows/cicd_comp_cli-native-build-phase.yml
+++ b/.github/workflows/cicd_comp_cli-native-build-phase.yml
@@ -107,7 +107,7 @@ jobs:
       # Upload the built distribution as an artifact
       - name: 'Upload built distribution'
         id: upload-artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: cli-artifacts-${{ matrix.platform }}
           path: |
diff --git a/.github/workflows/cicd_comp_finalize-phase.yml b/.github/workflows/cicd_comp_finalize-phase.yml
index 98831a74dd40..1d8e1771cb8e 100644
--- a/.github/workflows/cicd_comp_finalize-phase.yml
+++ b/.github/workflows/cicd_comp_finalize-phase.yml
@@ -228,7 +228,7 @@ jobs:
           echo "aggregate_status=${AGGREGATE_STATUS}" >> $GITHUB_OUTPUT
       # Upload the final workflow data report as an artifact
       - name: Upload workflow data
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: workflow-data
           path: ./workflow-data.json
diff --git a/.github/workflows/cicd_manual_publish-starter.yml b/.github/workflows/cicd_manual_publish-starter.yml
index 578e4ea4ebf9..d6c57fe7c2a4 100644
--- a/.github/workflows/cicd_manual_publish-starter.yml
+++ b/.github/workflows/cicd_manual_publish-starter.yml
@@ -92,7 +92,7 @@ jobs:
 
       - name: 'Upload artifacts'
         id: upload-artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ env.STARTER_TYPE }}-starter
           path: |
diff --git a/.github/workflows/cicd_pr_skill-lint.yml b/.github/workflows/cicd_pr_skill-lint.yml
index dbb928ccd42c..249e422f4d6c 100644
--- a/.github/workflows/cicd_pr_skill-lint.yml
+++ b/.github/workflows/cicd_pr_skill-lint.yml
@@ -37,7 +37,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
 
diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index 326b5b36d3c8..01716632d478 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -200,7 +200,7 @@ jobs:
       - uses: ./.github/actions/core-cicd/cleanup-runner
 
       - name: 'Set up Node.js'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/cicd_scheduled_image-cve-scan.yml b/.github/workflows/cicd_scheduled_image-cve-scan.yml
index 65ec6cc5a9fd..279dd6c801e4 100644
--- a/.github/workflows/cicd_scheduled_image-cve-scan.yml
+++ b/.github/workflows/cicd_scheduled_image-cve-scan.yml
@@ -70,7 +70,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload results artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: trivy-image-cve-scan
           path: |

From c5929d696c784513aa3894e80f7e70977a9c6afd Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:09:02 -0400
Subject: [PATCH 08/14] ci(actions): bump legacy and disabled workflows,
 refresh README examples (#36850)

Batch 8+10, the tail. This completes the sweep: every in-scope action reference
under .github/, code and documentation alike, is now on a node24 major.

  legacy-release_maven-release-process.yml   cache@v4 x5, cache/restore@v4 x4
  legacy-release_comp_maven-build-docker-image.yml  cache/restore@v3
  publish_docs.yml                          setup-node@v2-beta -> v7.0.0
  7 README.md files                         8 stale usage references

cache/restore@v3 in legacy-release_comp_maven-build-docker-image.yml targeted
the v1 cache service, shut down in February 2025. It was already dead code, so
bumping it is free.

## publish_docs.yml: pin bumped, workflow deliberately not repaired

It is disabled_manually on GitHub with 0 runs in 90 days. The hardcoded
`node-version: "16.13.2"` is replaced with node-version-file: 'core-web/.nvmrc'
so the file stops asserting an EOL Node, but its `cd core-web && npm install`
still cannot work against a pnpm workspace. Converting it would be a functional
change to a dead pipeline hidden inside a runtime bump.

The follow-up should lean towards DELETING it: #37150 removed core-web/libs/dotcms
and stripped `npm run build:docs:dotcms` from this very workflow, leaving only
build:docs:dotcms-models. Half of what it existed to publish no longer exists.
legacy-release_sbom-generator.yaml is likewise disabled with 0 runs.

## READMEs

8 references across 7 files, broader than first scoped. Four are
`uses: actions/checkout@v2` code examples (maven-job, cleanup-runner, setup-java,
prepare-runner), one is a checkout@v4 example (deploy-jfrog), and three are prose
references (deploy-javascript-sdk x2, deploy-javadoc). Prose counts: a reader
copying from it reintroduces the drift.

## Deliberately left alone, tracked in #37194

- The 4 first-party actions on runs.using: 'node16' -- they need dist/ rebuilds,
  not pin edits, and a regenerated ncc bundle cannot be diff-reviewed.
- The dead `runner.os == 'Windows'` branch in maven-job (no Windows runner exists
  in any matrix).
- .github/main.workflow (Actions-v1 HCL, never executed).
- ad-m/github-push-action@master (a moving branch ref; Docker action, so the
  runtime deprecation does not apply, but the pin violates the repo's own
  Action-security guidance).

Running actionlint locally leaves 9 findings, all pre-existing and unrelated to
action versions -- 4 expression, 1 events, plus setup-python@v4,
configure-aws-credentials@v1 and the two malformed `options:` keys in the
issue-fetcher / issue-labeler action.yml files, which belong to #37194.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit c871f91343708ffa86572a88597f33583e3ee34f)
---
 .../actions/core-cicd/cleanup-runner/Readme.md |  2 +-
 .../deployment/deploy-javadoc/README.md        |  2 +-
 .../deployment/deploy-javascript-sdk/README.md |  4 ++--
 .../deployment/deploy-jfrog/README.md          |  2 +-
 .github/actions/core-cicd/maven-job/README.md  |  2 +-
 .../actions/core-cicd/prepare-runner/README.md |  2 +-
 .github/actions/core-cicd/setup-java/README.md |  2 +-
 ...y-release_comp_maven-build-docker-image.yml |  2 +-
 .../legacy-release_maven-release-process.yml   | 18 +++++++++---------
 .github/workflows/publish_docs.yml             |  4 ++--
 10 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/actions/core-cicd/cleanup-runner/Readme.md b/.github/actions/core-cicd/cleanup-runner/Readme.md
index 6559555feeef..7f5e2b01603c 100644
--- a/.github/actions/core-cicd/cleanup-runner/Readme.md
+++ b/.github/actions/core-cicd/cleanup-runner/Readme.md
@@ -42,7 +42,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7.0.1
 
       # Your build steps here...
 
diff --git a/.github/actions/core-cicd/deployment/deploy-javadoc/README.md b/.github/actions/core-cicd/deployment/deploy-javadoc/README.md
index 212d5484354b..8dfb52efb1f3 100644
--- a/.github/actions/core-cicd/deployment/deploy-javadoc/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-javadoc/README.md
@@ -36,7 +36,7 @@ This GitHub composite action deploys Javadoc artifacts to the GitHub Packages re
 
 ## Steps
 
-1. **Checkout**: Uses the `actions/checkout@v4` action to check out the specified branch.
+1. **Checkout**: Uses the `actions/checkout@v7.0.1` action to check out the specified branch.
 2. **Maven Clean Build**: Runs a Maven clean install to build the project (skipping tests), only if `artifact-run-id` is not provided.
 3. **Deploy Javadoc**: Runs Maven to generate Javadocs and restores classes from the specified artifact run ID if provided.
 4. **Configure AWS Credentials**: Configures AWS credentials using the `aws-actions/configure-aws-credentials@v1` action.
diff --git a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md
index a61f1618edd2..be47eda6e3c7 100644
--- a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md
@@ -35,10 +35,10 @@ This GitHub Action is designed to automate the process of publishing dotCMS SDK
 ## Detailed Steps
 
 1. **Checkout**  
-   The action uses `actions/checkout@v4` to check out the specified branch, allowing the workflow to access the repository's contents.
+   The action uses `actions/checkout@v7.0.1` to check out the specified branch, allowing the workflow to access the repository's contents.
 
 2. **Set Up Node.js**  
-   `actions/setup-node@v4` sets up the Node.js environment, crucial for running scripts and managing dependencies.
+   `actions/setup-node@v7.0.0` sets up the Node.js environment, crucial for running scripts and managing dependencies.
 
 3. **Get Next Version**  
    This step retrieves the next version of the SDK by reading the `package.json` file from the specified directory.
diff --git a/.github/actions/core-cicd/deployment/deploy-jfrog/README.md b/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
index a9f82ac995be..0d36a0654ef9 100644
--- a/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
@@ -34,7 +34,7 @@ jobs:
   deploy:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Deploy Artifact
         uses: ./.github/actions/core-cicd/deployment/deploy-jfrog
diff --git a/.github/actions/core-cicd/maven-job/README.md b/.github/actions/core-cicd/maven-job/README.md
index b9e1284d3371..4b76f4f41e7e 100644
--- a/.github/actions/core-cicd/maven-job/README.md
+++ b/.github/actions/core-cicd/maven-job/README.md
@@ -73,7 +73,7 @@ jobs:
   build-and-test:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7.0.1
 
       - name: Run Maven Job
         uses: ./.github/actions/core-cicd/maven-job
diff --git a/.github/actions/core-cicd/prepare-runner/README.md b/.github/actions/core-cicd/prepare-runner/README.md
index e033156247d1..4ad81cddd90c 100644
--- a/.github/actions/core-cicd/prepare-runner/README.md
+++ b/.github/actions/core-cicd/prepare-runner/README.md
@@ -55,7 +55,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7.0.1
 
       - name: Prepare Runner
         uses: ./.github/actions/core-cicd/prepare-runner
diff --git a/.github/actions/core-cicd/setup-java/README.md b/.github/actions/core-cicd/setup-java/README.md
index 9042bc18403e..d2815c0581ea 100644
--- a/.github/actions/core-cicd/setup-java/README.md
+++ b/.github/actions/core-cicd/setup-java/README.md
@@ -54,7 +54,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Java
         uses: ./.github/actions/core-cicd/setup-java
diff --git a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
index 5a0b9bb93c75..2a35ae5319c5 100644
--- a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
+++ b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
@@ -121,7 +121,7 @@ jobs:
 
       - name: Restore Docker Context
         id: restore-docker-context
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v6.1.0
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: ${{ inputs.docker_context_cache_key }}
diff --git a/.github/workflows/legacy-release_maven-release-process.yml b/.github/workflows/legacy-release_maven-release-process.yml
index 5451f63f9d14..6616b8267a69 100644
--- a/.github/workflows/legacy-release_maven-release-process.yml
+++ b/.github/workflows/legacy-release_maven-release-process.yml
@@ -195,7 +195,7 @@ jobs:
 
       - name: Cache Maven Repository
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
         with:
           path: ~/.m2/repository
           key: maven-core-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -205,7 +205,7 @@ jobs:
 
       - name: Cache Core Output
         id: cache-core-output
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ./dotCMS/target/classes
@@ -218,7 +218,7 @@ jobs:
 
       - name: Cache Node Binary
         id: cache-node-binary
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             core-web/installs
@@ -227,7 +227,7 @@ jobs:
 
       - name: Cache NPM
         id: cache-npm
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.npm
@@ -237,7 +237,7 @@ jobs:
 
       - name: Cache Docker Context
         id: cache-docker-context
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: docker-context-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -270,14 +270,14 @@ jobs:
 
       - name: Restore Maven Repository
         id: restore-maven
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6.1.0
         with:
           path: ~/.m2/repository
           key: maven-core-${{ needs.prepare-release.outputs.date }}-${{ github.run_id }}
 
       - name: Restore Core Output
         id: restore-core-output
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6.1.0
         with:
           path: |
             ./dotCMS/target/classes
@@ -287,14 +287,14 @@ jobs:
 
       - name: Restore Node Binary
         id: restore-node-binary
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6.1.0
         with:
           path: core-web/installs
           key: node-binary-${{ hashFiles('core-web/.nvmrc') }}
 
       - name: Restore NPM
         id: restore-npm
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6.1.0
         with:
           path: ~/.npm
           key: npm-${{ hashFiles('core-web/package-lock.json') }}
diff --git a/.github/workflows/publish_docs.yml b/.github/workflows/publish_docs.yml
index a19830914951..1cb958c71678 100644
--- a/.github/workflows/publish_docs.yml
+++ b/.github/workflows/publish_docs.yml
@@ -14,9 +14,9 @@ jobs:
         with:
           fetch-depth: 1
       - name: Configuring Node.js
-        uses: actions/setup-node@v2-beta
+        uses: actions/setup-node@v7.0.0
         with:
-          node-version: "16.13.2"
+          node-version-file: 'core-web/.nvmrc'
       - name: Installing dependencies
         run: |
           cd core-web

From 7713fec5f48c7dc51c9b85e11a160770a096b3e3 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:09:21 -0400
Subject: [PATCH 09/14] ci(actions): flip download-artifact digest-mismatch to
 error (#36850)

Batch 3, landed last on purpose so it reverts alone.

Batch 2 bumped download-artifact v4 -> v8.0.1 with `digest-mismatch: warn`,
which made the runtime bump provably behaviour-neutral. This commit adopts v8's
own secure default at the same 14 sites.

The trade: today a corrupt maven-repo artifact surfaces as a baffling Maven
resolution error twenty minutes into the build. With `error` it surfaces
immediately, at the download step, naming the artifact.

If a mismatch does appear -- most likely on the multi-GB maven-repo, or on
finalize-phase's `build-reports-*` pattern where N artifacts mean N chances --
revert THIS commit only. The Node 24 migration stays landed.

Verify on two consecutive PR builds plus a merge-queue run before trusting it;
one green build is not evidence for a hash check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit a12c41edbc6aa7944ff490e07bd99e863115fe17)
---
 .../actions/core-cicd/deployment/deploy-cli-npm/action.yml  | 2 +-
 .../actions/core-cicd/deployment/deploy-docker/action.yml   | 2 +-
 .github/actions/core-cicd/maven-job/action.yml              | 6 +++---
 .github/workflows/cicd_comp_finalize-phase.yml              | 2 +-
 .github/workflows/cicd_comp_publish-pr-test-image.yml       | 2 +-
 .github/workflows/cicd_comp_release-phase.yml               | 4 ++--
 .github/workflows/cicd_manual_publish-starter.yml           | 2 +-
 .github/workflows/cicd_release-cli.yml                      | 4 ++--
 .github/workflows/issue_autodoc.yml                         | 2 +-
 .github/workflows/legacy-release_maven-release-process.yml  | 2 +-
 10 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
index 80f006a9c3a4..fa4b67a270c3 100644
--- a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
@@ -57,7 +57,7 @@ runs:
       id: download-cli-artifacts
       uses: actions/download-artifact@v8.0.1
       with:
-        digest-mismatch: warn
+        digest-mismatch: error
         pattern: cli-artifacts-*
         path: ${{ github.workspace }}/artifacts
         github-token: ${{ inputs.github-token }} # token with actions:read permissions on target repo
diff --git a/.github/actions/core-cicd/deployment/deploy-docker/action.yml b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
index 50f0a40de573..eaa72c15a2f7 100644
--- a/.github/actions/core-cicd/deployment/deploy-docker/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
@@ -89,7 +89,7 @@ runs:
       uses: actions/download-artifact@v8.0.1
       if: inputs.build_run_id # Only download the artifact if a build run id is provided
       with:
-        digest-mismatch: warn
+        digest-mismatch: error
         name: docker-build-context${{ inputs.artifact_suffix }}
         path: ${{ github.workspace }}
         run-id: ${{ inputs.build_run_id }}
diff --git a/.github/actions/core-cicd/maven-job/action.yml b/.github/actions/core-cicd/maven-job/action.yml
index fffb75cf3ecc..2f8e7b41be4d 100644
--- a/.github/actions/core-cicd/maven-job/action.yml
+++ b/.github/actions/core-cicd/maven-job/action.yml
@@ -265,7 +265,7 @@ runs:
       if: ${{ inputs.artifacts-from != '' }}
       uses: actions/download-artifact@v8.0.1
       with:
-        digest-mismatch: warn
+        digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
@@ -276,7 +276,7 @@ runs:
       if: ${{ inputs.needs-docker-image == 'true' }}
       uses: actions/download-artifact@v8.0.1
       with:
-        digest-mismatch: warn
+        digest-mismatch: error
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
         path: /tmp/docker-image
 
@@ -290,7 +290,7 @@ runs:
       if: ${{ inputs.restore-classes == 'true' }}
       uses: actions/download-artifact@v8.0.1
       with:
-        digest-mismatch: warn
+        digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
diff --git a/.github/workflows/cicd_comp_finalize-phase.yml b/.github/workflows/cicd_comp_finalize-phase.yml
index 1d8e1771cb8e..d6ecfeacf394 100644
--- a/.github/workflows/cicd_comp_finalize-phase.yml
+++ b/.github/workflows/cicd_comp_finalize-phase.yml
@@ -38,7 +38,7 @@ jobs:
         id: download-artifact
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           path: /tmp/build-step-reports
           pattern: build-reports-*
           merge-multiple: false
diff --git a/.github/workflows/cicd_comp_publish-pr-test-image.yml b/.github/workflows/cicd_comp_publish-pr-test-image.yml
index 28c98da86b77..2d052fe4f5cc 100644
--- a/.github/workflows/cicd_comp_publish-pr-test-image.yml
+++ b/.github/workflows/cicd_comp_publish-pr-test-image.yml
@@ -96,7 +96,7 @@ jobs:
         if: steps.resolve.outputs.found == 'true'
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           name: docker-image
           path: /tmp/prebuilt
           run-id: ${{ steps.resolve.outputs.run_id }}
diff --git a/.github/workflows/cicd_comp_release-phase.yml b/.github/workflows/cicd_comp_release-phase.yml
index cc78beed823c..70e2f2a359d3 100644
--- a/.github/workflows/cicd_comp_release-phase.yml
+++ b/.github/workflows/cicd_comp_release-phase.yml
@@ -146,7 +146,7 @@ jobs:
       - name: Restore Maven Repository
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           name: maven-repo${{ steps.java-suffix.outputs.suffix }}
           path: ~/.m2/repository
 
@@ -251,7 +251,7 @@ jobs:
       - name: Download SBOM Artifacts
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
 
diff --git a/.github/workflows/cicd_manual_publish-starter.yml b/.github/workflows/cicd_manual_publish-starter.yml
index d6c57fe7c2a4..4f4ce80df2bc 100644
--- a/.github/workflows/cicd_manual_publish-starter.yml
+++ b/.github/workflows/cicd_manual_publish-starter.yml
@@ -128,7 +128,7 @@ jobs:
       - name: 'Download artifacts'
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           github-token: ${{ github.token }}
           name: ${{ env.STARTER_TYPE }}-starter
           path: ${{ github.workspace }}/starter
diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index 01716632d478..0fad4f9c6b8a 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -167,7 +167,7 @@ jobs:
       - name: 'Download all build artifacts'
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: cli-artifacts-*
       - uses: ./.github/actions/core-cicd/maven-job
@@ -210,7 +210,7 @@ jobs:
       - name: 'Download all build artifacts'
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: cli-artifacts-*
           merge-multiple: true
diff --git a/.github/workflows/issue_autodoc.yml b/.github/workflows/issue_autodoc.yml
index 8823a41fb80e..3fa4602c4e36 100644
--- a/.github/workflows/issue_autodoc.yml
+++ b/.github/workflows/issue_autodoc.yml
@@ -353,7 +353,7 @@ jobs:
       - name: Download report artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           name: autodoc-report
           path: /tmp/
         continue-on-error: true
diff --git a/.github/workflows/legacy-release_maven-release-process.yml b/.github/workflows/legacy-release_maven-release-process.yml
index 6616b8267a69..036224cd1922 100644
--- a/.github/workflows/legacy-release_maven-release-process.yml
+++ b/.github/workflows/legacy-release_maven-release-process.yml
@@ -397,7 +397,7 @@ jobs:
       - name: 'Download all build artifacts'
         uses: actions/download-artifact@v8.0.1
         with:
-          digest-mismatch: warn
+          digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
           pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
           

From f6a9d2682377da73ced142715dd15b18eaa90787 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 06:28:05 -0400
Subject: [PATCH 10/14] ci(actions): bump the pins
 ai_claude-post-merge-test-plan brought in (#36850)

The merge of main added .github/workflows/ai_claude-post-merge-test-plan.yml,
which arrived with two stale SHA pins:

  actions/checkout      @11d5960a # v4.4.0 -> @3d3c42e5 # v7.0.1
  actions/github-script @60a0d830 # v7.0.1 -> @ed597411 # v8

Both entered through the merge rather than through the sweep, and neither would
have been spotted by eye in a 74-file diff.

Note the second one also had a wrong version comment -- the SHA was labelled
# v7.0.1, which is checkout's version, not github-script's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 7a0c4c7daa3cc26576c35896429ae537a8814823)
---
 .github/workflows/ai_claude-post-merge-test-plan.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ai_claude-post-merge-test-plan.yml b/.github/workflows/ai_claude-post-merge-test-plan.yml
index cfa3c834a942..a5c56e905cd1 100644
--- a/.github/workflows/ai_claude-post-merge-test-plan.yml
+++ b/.github/workflows/ai_claude-post-merge-test-plan.yml
@@ -105,7 +105,7 @@ jobs:
       # (that comes from the API) and never history. Sparse + shallow keeps this job seconds long
       # on a repository this size.
       - name: Checkout scripts and prompt
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           sparse-checkout: |
@@ -148,7 +148,7 @@ jobs:
 
       - name: Discover related issues
         id: discover
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           PR_NUMBER: ${{ needs.preflight.outputs.pr_number }}
           PR_BRANCH: ${{ steps.meta.outputs.branch }}

From b4a379a3c6dc6392d13cf0df7d8a9f00db0f90c7 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 13:30:13 -0400
Subject: [PATCH 11/14] ci(actions): bump create-or-update-comment, missed on
 the PR path (#36850)

peter-evans/create-or-update-comment @v4 (node20) -> @v5.0.0 (node24), at both
sites in issue_comp_link-issue-to-pr.yml.

This was a scoping mistake, not a deferral. It was filed under "cold-path
third-party actions" for #37194, but it runs on **every pull request** via
`Add Issue to PR / link-issue`, so it kept AC-001 unsatisfied: the annotation
scan on this PR still reported

  Node.js 20 is deprecated. ... peter-evans/create-or-update-comment@v4

The cause: the PR-pipeline surface was traced through cicd_1-pr.yml's job graph
only. Other workflows also fire on `pull_request` -- issue_open-pr.yml (which
calls this composite), the five ai_claude-* workflows, dotbot-review.yml and
cicd_pr_skill-lint.yml -- and they were not walked.

Safe: v5.0.0's release notes are dependency bumps only, and every input in use
here (issue-number, comment-id, body, edit-mode) is still present in v5's
action.yml. The `edit-mode: replace` guard against comment accumulation
(issue #35794) is untouched.

Remaining Node 20 annotations on this PR are NOT fixable from this repository:
`Claude AI Orchestrator` and `Claude AI Rollback Safety Check` run
dotCMS/ai-workflows' reusable workflows, addressed by dotCMS/ai-workflows#67.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/issue_comp_link-issue-to-pr.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/issue_comp_link-issue-to-pr.yml b/.github/workflows/issue_comp_link-issue-to-pr.yml
index ebe5e4764938..1960a28a8004 100644
--- a/.github/workflows/issue_comp_link-issue-to-pr.yml
+++ b/.github/workflows/issue_comp_link-issue-to-pr.yml
@@ -488,14 +488,14 @@ jobs:
 
       - name: Create new comment
         if: steps.determine_issue.outputs.is_cross_repo != 'true' && steps.check_comment.outputs.existing_comment_id == ''
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5.0.0
         with:
           issue-number: ${{ steps.determine_issue.outputs.final_issue_number }}
           body: ${{ steps.check_comment.outputs.pr_list }}
 
       - name: Update existing comment
         if: steps.determine_issue.outputs.is_cross_repo != 'true' && steps.check_comment.outputs.existing_comment_id != ''
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5.0.0
         with:
           comment-id: ${{ steps.check_comment.outputs.existing_comment_id }}
           body: ${{ steps.check_comment.outputs.pr_list }}

From d819831a08e7ae499eedb32f1fa067c3fef5dd5c Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Fri, 28 Aug 2026 13:41:44 -0400
Subject: [PATCH 12/14] ci(actions): SHA-pin create-or-update-comment (#36850)

Semgrep flagged the v5.0.0 tag as blocking on the line the previous commit
introduced, and the finding is correct on its own terms: this action runs on
every pull request, receives repository-derived values (issue-number,
comment-id, body), and holds a token that can modify issue comments. A
repointed tag would execute attacker code in that context with no change to
this workflow file.

  @v5.0.0 -> @e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0  (node24)

Pinned rather than triaged because it costs two lines here, unlike the repo-wide
convention change. This joins the existing deliberate SHA pins (maven-job's
cache, issue_autodoc, dotbot-*, cicd_pr_skill-lint) under the same reasoning as
the comment at maven-job/action.yml: a tag can be repointed by its owner, which
is how the trivy-action and kics-github-action compromises worked.

Note this does not resolve Semgrep's other ~146 findings of the same rule. Those
are pre-existing: main carries 199 mutable tags and this branch carries 199 too,
because @v4 -> @v7.0.1 swaps one mutable tag for another. Semgrep's scan is
diff-aware, so a touched line is reported as new. Converting all 199 to SHAs is a
convention migration that belongs with #37194's dependabot work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/issue_comp_link-issue-to-pr.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/issue_comp_link-issue-to-pr.yml b/.github/workflows/issue_comp_link-issue-to-pr.yml
index 1960a28a8004..c04786f91cea 100644
--- a/.github/workflows/issue_comp_link-issue-to-pr.yml
+++ b/.github/workflows/issue_comp_link-issue-to-pr.yml
@@ -488,14 +488,14 @@ jobs:
 
       - name: Create new comment
         if: steps.determine_issue.outputs.is_cross_repo != 'true' && steps.check_comment.outputs.existing_comment_id == ''
-        uses: peter-evans/create-or-update-comment@v5.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ steps.determine_issue.outputs.final_issue_number }}
           body: ${{ steps.check_comment.outputs.pr_list }}
 
       - name: Update existing comment
         if: steps.determine_issue.outputs.is_cross_repo != 'true' && steps.check_comment.outputs.existing_comment_id != ''
-        uses: peter-evans/create-or-update-comment@v5.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           comment-id: ${{ steps.check_comment.outputs.existing_comment_id }}
           body: ${{ steps.check_comment.outputs.pr_list }}

From 3881aba812ba5ba74795760f35ad12db7d8a2dba Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Mon, 31 Aug 2026 12:31:20 -0400
Subject: [PATCH 13/14] ci(actions): pin every bumped action to a commit SHA
 (#36850)

Converts the 141 action references this PR already modifies from mutable version
tags to full 40-character commit SHAs, each carrying a `# vX.Y.Z` comment.

  actions/checkout@v7.0.1                  -> @3d3c42e5aac5... # v7.0.1   (55)
  actions/download-artifact@v8.0.1         -> @3e5f45b2cfb9... # v8.0.1   (13)
  actions/cache/restore@v6.1.0             -> @55cc8345863c... # v6.1.0   (13)
  docker/login-action@v4.6.0               -> @dbcb813823bd... # v4.6.0   (12)
  actions/github-script@v8                 -> @ed597411d8f9... # v8       (12)
  actions/upload-artifact@v7.0.1           -> @043fb46d1a93... # v7.0.1   (11)
  actions/cache/save@v6.1.0                -> @55cc8345863c... # v6.1.0    (8)
  actions/setup-node@v7.0.0                -> @820762786026... # v7.0.0    (6)
  actions/cache@v6.1.0                     -> @55cc8345863c... # v6.1.0    (5)
  dawidd6/action-download-artifact@v24     -> @d63b86af1b34... # v24       (3)
  pnpm/action-setup@v6.0.10                -> @0977fd99725f... # v6.0.10   (2)
  dorny/paths-filter@v4.0.3                -> @ceb8a2b8f2d8... # v4.0.3    (1)

Why now, having earlier argued the other way: the objection was that this turns a
runtime bump into a convention migration and makes the diff harder to read. The
first half does not hold -- these 141 lines are ALREADY modified by this PR, so
pinning them adds zero new diff surface; the line count is identical. The second
half is handled by the mandatory `# vX.Y.Z` comment, which keeps the version
readable at the call site.

What it buys:

- Semgrep's github-actions-mutable-action-tag reported ~146 findings on this PR,
  essentially one per touched mutable-tag line. Pinning resolves them at the
  source instead of triaging 146 items by hand now and again on the next bump.
- It matches the repo's own guidance and the reasoning already written at
  maven-job/action.yml: a tag can be repointed by its owner, which is how the
  trivy-action and kics-github-action compromises worked.

What it costs, stated plainly: every future bump needs a SHA lookup. That is
exactly what Dependabot automates -- it maintains SHA pins together with their
version comments -- so the `.github/dependabot.yml` item in #37194 is now a
prerequisite for keeping this maintainable rather than a nice-to-have.

Every SHA was resolved from the GitHub API at commit time and its action.yml
confirmed to declare `runs.using: node24`. All 151 SHA pins on the branch were
then re-checked against their comments: 151 correct, 0 mismatched.

actionlint introduces no new findings -- the 11 non-shellcheck reports are the
9 pre-existing ones plus the two `ubuntu-server` runner-label reports that
reappeared when .github/actionlint.yaml was removed with the guard.

The ~56 mutable tags on lines this PR does not touch are unchanged and remain
tracked in #37194.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../deployment/deploy-cli-npm/action.yml      |  6 +--
 .../deployment/deploy-docker/action.yml       |  6 +--
 .../deployment/deploy-javadoc/action.yml      |  2 +-
 .../deploy-javascript-sdk/action.yml          | 10 ++---
 .../deployment/deploy-jfrog/action.yml        |  2 +-
 .../actions/core-cicd/maven-job/action.yml    | 38 +++++++++----------
 .../actions/core-cicd/setup-java/action.yml   | 12 +++---
 .../legacy-release/sbom-generator/action.yml  |  4 +-
 .../workflows/ai_claude-backend-reviewer.yml  |  2 +-
 .github/workflows/ai_claude-orchestrator.yml  |  4 +-
 .../workflows/ai_claude-rollback-safety.yml   |  2 +-
 .../ai_claude-sdk-breaking-change.yml         |  2 +-
 .github/workflows/cicd_3-trunk.yml            |  2 +-
 .github/workflows/cicd_4-nightly.yml          |  2 +-
 .github/workflows/cicd_5-lts.yml              |  2 +-
 .github/workflows/cicd_6-release.yml          | 10 ++---
 .../cicd_comp_ai-release-notes-phase.yml      |  4 +-
 .github/workflows/cicd_comp_build-phase.yml   |  4 +-
 ...cicd_comp_changelog-site-publish-phase.yml |  2 +-
 .../cicd_comp_cli-native-build-phase.yml      |  4 +-
 .../workflows/cicd_comp_deployment-phase.yml  |  2 +-
 .../workflows/cicd_comp_finalize-phase.yml    |  4 +-
 .../workflows/cicd_comp_initialize-phase.yml  |  6 +--
 .../workflows/cicd_comp_pr-area-labeler.yml   |  4 +-
 .../cicd_comp_publish-pr-test-image.yml       |  2 +-
 .github/workflows/cicd_comp_release-phase.yml |  8 ++--
 .../cicd_comp_release-prepare-phase.yml       |  2 +-
 .github/workflows/cicd_comp_test-phase.yml    |  6 +--
 .../workflows/cicd_evergreen-tracks-admin.yml |  4 +-
 .../cicd_evergreen-tracks-promote.yml         | 10 ++---
 .../cicd_manual_build-docker-context.yml      |  4 +-
 .../workflows/cicd_manual_build-java-base.yml |  4 +-
 .../workflows/cicd_manual_publish-starter.yml |  8 ++--
 .../cicd_post-workflow-reporting.yml          |  6 +--
 .github/workflows/cicd_release-cli.yml        | 14 +++----
 .github/workflows/cicd_release-sdk.yml        |  4 +-
 .../cicd_scheduled_image-cve-scan.yml         |  2 +-
 .../cicd_scheduled_notify-seated-prs.yml      |  6 +--
 .../cicd_scheduled_opensearch-phase-sweep.yml |  2 +-
 .../workflows/cicd_weekly-rolling-tags.yml    |  2 +-
 .../workflows/issue_comp_frontend-notify.yml  |  4 +-
 .../issue_comp_label-conditional-labeling.yml |  4 +-
 .../workflows/issue_comp_release-labeling.yml |  4 +-
 ..._manual_label-customer_deployed-issues.yml |  2 +-
 .../workflows/issue_manual_label-issues.yml   |  2 +-
 .../issue_on-open_add-to-triage-project..yml  |  2 +-
 ...-release_comp_maven-build-docker-image.yml |  8 ++--
 .../legacy-release_maven-release-process.yml  | 28 +++++++-------
 .../legacy-release_sbom-generator.yaml        |  2 +-
 .github/workflows/publish_docs.yml            |  4 +-
 .../utility_discover-docker-tags.yml          |  2 +-
 51 files changed, 141 insertions(+), 141 deletions(-)

diff --git a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
index fa4b67a270c3..37ea988bd516 100644
--- a/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml
@@ -39,12 +39,12 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v7.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
     - name: 'Set up Node.js'
-      uses: actions/setup-node@v7.0.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
@@ -55,7 +55,7 @@ runs:
 
     - name: 'Download all cli build artifacts.'
       id: download-cli-artifacts
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         digest-mismatch: error
         pattern: cli-artifacts-*
diff --git a/.github/actions/core-cicd/deployment/deploy-docker/action.yml b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
index eaa72c15a2f7..a6c729cce87d 100644
--- a/.github/actions/core-cicd/deployment/deploy-docker/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-docker/action.yml
@@ -86,7 +86,7 @@ runs:
   using: "composite"
   steps:
     - name: Download Docker Build Context
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       if: inputs.build_run_id # Only download the artifact if a build run id is provided
       with:
         digest-mismatch: error
@@ -163,14 +163,14 @@ runs:
           fi
         echo "EOF" >> $GITHUB_ENV
     - name: Docker.io login
-      uses: docker/login-action@v4.6.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker_io_username }}
         password: ${{ inputs.docker_io_token }}
       if: (inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH') && inputs.do_deploy == 'true'
 
     - name: GHCR.io login
-      uses: docker/login-action@v4.6.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ inputs.ghcr_io_username }}
diff --git a/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml b/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
index e25de0b7f233..b818150aaa63 100644
--- a/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javadoc/action.yml
@@ -28,7 +28,7 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v7.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
diff --git a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
index 05bab0968104..a7bb6bbdffc0 100644
--- a/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml
@@ -47,13 +47,13 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v7.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
         token: ${{ inputs.github-token }}
 
     - name: 'Setup Node'
-      uses: actions/setup-node@v7.0.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version-file: 'core-web/.nvmrc'
 
@@ -106,7 +106,7 @@ runs:
       shell: bash
 
     - name: Set up pnpm
-      uses: pnpm/action-setup@v6.0.10
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -120,7 +120,7 @@ runs:
 
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -140,7 +140,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
diff --git a/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml b/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
index 5856fc6c6311..f3df12c28dfa 100644
--- a/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
+++ b/.github/actions/core-cicd/deployment/deploy-jfrog/action.yml
@@ -38,7 +38,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - uses: ./.github/actions/core-cicd/maven-job
       with:
diff --git a/.github/actions/core-cicd/maven-job/action.yml b/.github/actions/core-cicd/maven-job/action.yml
index 2f8e7b41be4d..351e81225ea8 100644
--- a/.github/actions/core-cicd/maven-job/action.yml
+++ b/.github/actions/core-cicd/maven-job/action.yml
@@ -192,7 +192,7 @@ runs:
     - id: restore-cache-maven
       name: Restore Maven Repository Cache
       if: ${{ inputs.artifacts-from == '' }}
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-mavencore-${{ hashFiles('**/pom.xml') }}
@@ -202,7 +202,7 @@ runs:
     - id: restore-cache-node
       name: Restore Node Binary Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: installs
         # hash nodejs-parent/pom.xml so the pnpm-era layout (install-node-and-npm
@@ -226,7 +226,7 @@ runs:
 
     - name: Set up pnpm
       if: ${{ inputs.requires-node == 'true' }}
-      uses: pnpm/action-setup@v6.0.10
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -242,7 +242,7 @@ runs:
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -254,7 +254,7 @@ runs:
     - id: cache-sonar
       name: Cache SonarQube Packages
       if: ${{ inputs.cache-sonar == 'true' }}
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ runner.os }}-sonar
@@ -263,7 +263,7 @@ runs:
     - id: restore-artifact-maven-repo
       name: Restore Maven Build Repo
       if: ${{ inputs.artifacts-from != '' }}
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
@@ -274,7 +274,7 @@ runs:
     - id: restore-artifact-docker-image
       name: Restore Docker Image
       if: ${{ inputs.needs-docker-image == 'true' }}
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         digest-mismatch: error
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
@@ -288,7 +288,7 @@ runs:
     - id: restore-artifact-classes
       name: Restore Classes
       if: ${{ inputs.restore-classes == 'true' }}
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
@@ -297,7 +297,7 @@ runs:
 
     - name: Docker Hub Login
       if: ${{ inputs.docker-io-username != '' && inputs.docker-io-token != '' }}
-      uses: docker/login-action@v4.6.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker-io-username }}
         password: ${{ inputs.docker-io-token }}
@@ -348,7 +348,7 @@ runs:
     - id: persist-maven-repo
       name: Persist Maven Repo
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
         path: ~/.m2/repository
@@ -356,7 +356,7 @@ runs:
     - id: persist-docker-build-context
       name: Persist Docker Build Context
       if: ${{ inputs.generate-docker == 'true' }}
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: docker-build-context${{ steps.artifact-suffix.outputs.suffix }}
         path: dotCMS/target/docker-build.tar
@@ -402,7 +402,7 @@ runs:
 
     - id: upload-docker-image
       name: Upload Docker Image as Artifact
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: ${{ inputs.generate-docker == 'true' }}
       with:
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
@@ -411,7 +411,7 @@ runs:
     - id: persist-build-classes
       name: Persist Build Classes
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
         path: |
@@ -429,7 +429,7 @@ runs:
     - id: save-cache-maven
       name: Save Maven Repository Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-maven.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ steps.restore-cache-maven.outputs.cache-primary-key }}
@@ -437,7 +437,7 @@ runs:
     - id: save-cache-node
       name: Save Node Binary Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-node.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: installs
         key: ${{ steps.restore-cache-node.outputs.cache-primary-key }}
@@ -445,7 +445,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' && inputs.generate-artifacts == 'true' && steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
@@ -453,7 +453,7 @@ runs:
     - id: save-cache-sonar
       name: Save SonarQube Cache
       if: ${{ inputs.cache-sonar == 'true' && steps.cache-sonar.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ steps.cache-sonar.outputs.cache-primary-key }}
@@ -461,7 +461,7 @@ runs:
     # ---------------------------- Generate Reports Artifacts ----------------------------
     - id: generate-build-reports-artifact
       name: Generate Build Reports Artifact
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always()
       with:
         name: "build-reports-${{ inputs.stage-name }}"
@@ -472,7 +472,7 @@ runs:
 
     - id: create-test-reports-artifact
       name: Create Test Reports Artifact
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() && inputs.generates-test-results == 'true'
       with:
         name: "build-reports-test-${{ inputs.stage-name }}"
diff --git a/.github/actions/core-cicd/setup-java/action.yml b/.github/actions/core-cicd/setup-java/action.yml
index e6ed4932c0e4..9c51c4d33b8c 100644
--- a/.github/actions/core-cicd/setup-java/action.yml
+++ b/.github/actions/core-cicd/setup-java/action.yml
@@ -57,7 +57,7 @@ runs:
         echo "graalvm_version=$GRAALVM_VERSION" >> $GITHUB_OUTPUT
     - name: Restore Cache SDKMan install
       id: restore-cache-sdkman
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-install
@@ -88,14 +88,14 @@ runs:
     - name: Save Cache SDKMan install
       id: save-cache-sdkman
       if: ${{ steps.restore-cache-sdkman.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-install
 
     - name: Restore Cache Java SDK
       id: restore-cache-java
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.requested_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.requested_version }}
@@ -103,7 +103,7 @@ runs:
     - name: Restore Cache GraalVM SDK
       id: restore-cache-graalvm
       if: ${{ inputs.require-graalvm == 'true' }}
-      uses: actions/cache/restore@v6.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.graalvm_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.graalvm_version }}
@@ -168,7 +168,7 @@ runs:
         java -version
 
     - name: Save Cache Java SDK
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ steps.restore-cache-java.outputs.cache-hit != 'true' }}
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.requested_version }}
@@ -176,7 +176,7 @@ runs:
 
     - name: Save Cache GraalVM SDK
       if: ${{ inputs.require-graalvm == 'true' && steps.restore-cache-graalvm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v6.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sdkman/candidates/java/${{ steps.get-requested-version.outputs.graalvm_version }}
         key: ${{ runner.os }}-${{ env.ARCHITECTURE }}-sdkman-java-${{ steps.get-requested-version.outputs.graalvm_version }}
\ No newline at end of file
diff --git a/.github/actions/legacy-release/sbom-generator/action.yml b/.github/actions/legacy-release/sbom-generator/action.yml
index 6771ae8b82f5..3128787ec1d5 100644
--- a/.github/actions/legacy-release/sbom-generator/action.yml
+++ b/.github/actions/legacy-release/sbom-generator/action.yml
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout core repository
-      uses: actions/checkout@v7.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: dotCMS/core
         token: ${{ inputs.github_token }}
@@ -52,7 +52,7 @@ runs:
         mv core/sbom-cyclonedx.json core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
 
     - name: Upload SBOM to GitHub
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: sbom-dotcms-${{ env.DOTCMS_VERSION }}
         path: core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
diff --git a/.github/workflows/ai_claude-backend-reviewer.yml b/.github/workflows/ai_claude-backend-reviewer.yml
index 0fe7a24d4d74..3f1e6900f864 100644
--- a/.github/workflows/ai_claude-backend-reviewer.yml
+++ b/.github/workflows/ai_claude-backend-reviewer.yml
@@ -51,7 +51,7 @@ jobs:
     outputs:
       has_java: ${{ steps.check.outputs.has_java }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ai_claude-orchestrator.yml b/.github/workflows/ai_claude-orchestrator.yml
index f6aad998afeb..7bc13906383a 100644
--- a/.github/workflows/ai_claude-orchestrator.yml
+++ b/.github/workflows/ai_claude-orchestrator.yml
@@ -44,7 +44,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check organization membership
         id: membership-check
@@ -128,7 +128,7 @@ jobs:
     outputs:
       prompt: ${{ steps.build.outputs.prompt }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: build
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/ai_claude-rollback-safety.yml b/.github/workflows/ai_claude-rollback-safety.yml
index 35c204588581..6ac32af44782 100644
--- a/.github/workflows/ai_claude-rollback-safety.yml
+++ b/.github/workflows/ai_claude-rollback-safety.yml
@@ -29,7 +29,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check organization membership
         id: membership-check
diff --git a/.github/workflows/ai_claude-sdk-breaking-change.yml b/.github/workflows/ai_claude-sdk-breaking-change.yml
index e6524469c4ea..ebc5763eb286 100644
--- a/.github/workflows/ai_claude-sdk-breaking-change.yml
+++ b/.github/workflows/ai_claude-sdk-breaking-change.yml
@@ -29,7 +29,7 @@ jobs:
       authorized: ${{ steps.membership-check.outputs.is_member }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check organization membership
         id: membership-check
diff --git a/.github/workflows/cicd_3-trunk.yml b/.github/workflows/cicd_3-trunk.yml
index 200c15703471..0e23db06afed 100644
--- a/.github/workflows/cicd_3-trunk.yml
+++ b/.github/workflows/cicd_3-trunk.yml
@@ -163,7 +163,7 @@ jobs:
       # notify-slack's action.yml (same gap already hit and fixed once in
       # cicd_release-sdk.yml's publish job).
       - name: 'Checkout'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Compute next version'
         id: next-version
diff --git a/.github/workflows/cicd_4-nightly.yml b/.github/workflows/cicd_4-nightly.yml
index f40d5060f9c1..8f0b5b8e919f 100644
--- a/.github/workflows/cicd_4-nightly.yml
+++ b/.github/workflows/cicd_4-nightly.yml
@@ -88,7 +88,7 @@ jobs:
       build-ref: ${{ steps.find-commit.outputs.build-ref }}
       tag-date: ${{ steps.find-commit.outputs.tag-date }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Bounded shallow checkout: Find Build Commit walks `git log` on main
           # back to midnight UTC. The window that matters is commits landing
diff --git a/.github/workflows/cicd_5-lts.yml b/.github/workflows/cicd_5-lts.yml
index 3232dc269308..10c65a100d2a 100644
--- a/.github/workflows/cicd_5-lts.yml
+++ b/.github/workflows/cicd_5-lts.yml
@@ -46,7 +46,7 @@ jobs:
     outputs:
       version: ${{ steps.resolve.outputs.version }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Resolve version from input or maven.config
         id: resolve
         env:
diff --git a/.github/workflows/cicd_6-release.yml b/.github/workflows/cicd_6-release.yml
index 822f6d0c095b..83b33f8241ba 100644
--- a/.github/workflows/cicd_6-release.yml
+++ b/.github/workflows/cicd_6-release.yml
@@ -308,11 +308,11 @@ jobs:
       group: evergreen-tracks-registry
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -355,7 +355,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           # Shallow checkout: this job only needs HEAD of main (it does its own
@@ -558,7 +558,7 @@ jobs:
     if: always()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
@@ -579,7 +579,7 @@ jobs:
           && !contains(needs.release-prepare.outputs.release_tag, '_lts_')
           && startsWith(needs.release-prepare.outputs.release_tag, 'v')
         continue-on-error: true
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/cicd_comp_ai-release-notes-phase.yml b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
index 825ba6b67a2c..ab5d4da7009d 100644
--- a/.github/workflows/cicd_comp_ai-release-notes-phase.yml
+++ b/.github/workflows/cicd_comp_ai-release-notes-phase.yml
@@ -63,12 +63,12 @@ jobs:
           echo "Release '${RELEASE_TAG}' found."
 
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/cicd_comp_build-phase.yml b/.github/workflows/cicd_comp_build-phase.yml
index 36c7a6c60135..a277b8a5c729 100644
--- a/.github/workflows/cicd_comp_build-phase.yml
+++ b/.github/workflows/cicd_comp_build-phase.yml
@@ -87,7 +87,7 @@ jobs:
     steps:
       # Checkout code based on whether a specific ref is provided
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: inputs.ref == ''
         with:
           fetch-depth: 0
@@ -103,7 +103,7 @@ jobs:
       # expressions, collapsing the true branch to 1.
       - name: Checkout code with ref ${{ inputs.ref }}
         if: inputs.ref != ''
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: ${{ inputs.run-pr-checks && '0' || '1' }}
diff --git a/.github/workflows/cicd_comp_changelog-site-publish-phase.yml b/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
index 0474c7aaa95d..3c444feb55c4 100644
--- a/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
+++ b/.github/workflows/cicd_comp_changelog-site-publish-phase.yml
@@ -79,7 +79,7 @@ jobs:
       && startsWith(inputs.release_tag, 'v')
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/cicd_comp_cli-native-build-phase.yml b/.github/workflows/cicd_comp_cli-native-build-phase.yml
index 07c2f24968c9..a8b7f3340edc 100644
--- a/.github/workflows/cicd_comp_cli-native-build-phase.yml
+++ b/.github/workflows/cicd_comp_cli-native-build-phase.yml
@@ -87,7 +87,7 @@ jobs:
       artifact-url: ${{ steps.upload-artifact.outputs.artifact-url }}
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.BRANCH }}
 
@@ -107,7 +107,7 @@ jobs:
       # Upload the built distribution as an artifact
       - name: 'Upload built distribution'
         id: upload-artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cli-artifacts-${{ matrix.platform }}
           path: |
diff --git a/.github/workflows/cicd_comp_deployment-phase.yml b/.github/workflows/cicd_comp_deployment-phase.yml
index 2ed5333391c4..148ebcc109c3 100644
--- a/.github/workflows/cicd_comp_deployment-phase.yml
+++ b/.github/workflows/cicd_comp_deployment-phase.yml
@@ -143,7 +143,7 @@ jobs:
       formatted_tags: ${{ steps.format-tags.outputs.formatted_tags }}
     steps:
       # Checkout the repository
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow checkout: nothing in this job reads git history (no git
           # commands after checkout; Docker/NPM publishing works from the
diff --git a/.github/workflows/cicd_comp_finalize-phase.yml b/.github/workflows/cicd_comp_finalize-phase.yml
index d6ecfeacf394..56e295a03a92 100644
--- a/.github/workflows/cicd_comp_finalize-phase.yml
+++ b/.github/workflows/cicd_comp_finalize-phase.yml
@@ -36,7 +36,7 @@ jobs:
       # Download build reports from previous steps
       - name: Download build reports
         id: download-artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           path: /tmp/build-step-reports
@@ -228,7 +228,7 @@ jobs:
           echo "aggregate_status=${AGGREGATE_STATUS}" >> $GITHUB_OUTPUT
       # Upload the final workflow data report as an artifact
       - name: Upload workflow data
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: workflow-data
           path: ./workflow-data.json
diff --git a/.github/workflows/cicd_comp_initialize-phase.yml b/.github/workflows/cicd_comp_initialize-phase.yml
index ed64ef65a204..cb813169f24b 100644
--- a/.github/workflows/cicd_comp_initialize-phase.yml
+++ b/.github/workflows/cicd_comp_initialize-phase.yml
@@ -84,7 +84,7 @@ jobs:
     steps:
       - name: Download Build Artifact
         id: data-download
-        uses: dawidd6/action-download-artifact@v24
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         if: ${{ inputs.reuse-previous-build == true }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -128,12 +128,12 @@ jobs:
       # JSON array of filter names that matched (from dorny/paths-filter)
       changes: ${{ steps.filter.outputs.changes }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ inputs.change-detection == 'enabled' }}
 
       # Execute the paths-filter step to determine changes
       # For PRs, paths-filter automatically uses GitHub API to get changed files
-      - uses: dorny/paths-filter@v4.0.3
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         if: ${{ inputs.change-detection == 'enabled' }}
         id: filter
         with:
diff --git a/.github/workflows/cicd_comp_pr-area-labeler.yml b/.github/workflows/cicd_comp_pr-area-labeler.yml
index 795778623d97..c6e434ca600c 100644
--- a/.github/workflows/cicd_comp_pr-area-labeler.yml
+++ b/.github/workflows/cicd_comp_pr-area-labeler.yml
@@ -31,13 +31,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout for config
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: .github/area-labels.yml
           sparse-checkout-cone-mode: false
 
       - name: Apply Area Labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/cicd_comp_publish-pr-test-image.yml b/.github/workflows/cicd_comp_publish-pr-test-image.yml
index 2d052fe4f5cc..0383c0537cbc 100644
--- a/.github/workflows/cicd_comp_publish-pr-test-image.yml
+++ b/.github/workflows/cicd_comp_publish-pr-test-image.yml
@@ -94,7 +94,7 @@ jobs:
 
       - name: Download prebuilt image
         if: steps.resolve.outputs.found == 'true'
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           name: docker-image
diff --git a/.github/workflows/cicd_comp_release-phase.yml b/.github/workflows/cicd_comp_release-phase.yml
index 70e2f2a359d3..8abf96573747 100644
--- a/.github/workflows/cicd_comp_release-phase.yml
+++ b/.github/workflows/cicd_comp_release-phase.yml
@@ -89,7 +89,7 @@ jobs:
       JVM_TEST_MAVEN_OPTS: '-e -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn'
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.release_tag }}
 
@@ -144,7 +144,7 @@ jobs:
           java-version: ${{ inputs.java-version }}
 
       - name: Restore Maven Repository
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           name: maven-repo${{ steps.java-suffix.outputs.suffix }}
@@ -240,7 +240,7 @@ jobs:
     if: inputs.java-version == ''
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/legacy-release/sbom-generator
         id: sbom-generator
@@ -249,7 +249,7 @@ jobs:
           github_token: ${{ secrets.CI_MACHINE_TOKEN }}
 
       - name: Download SBOM Artifacts
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
diff --git a/.github/workflows/cicd_comp_release-prepare-phase.yml b/.github/workflows/cicd_comp_release-prepare-phase.yml
index f0f3ad9e3e8d..810750161dd9 100644
--- a/.github/workflows/cicd_comp_release-prepare-phase.yml
+++ b/.github/workflows/cicd_comp_release-prepare-phase.yml
@@ -98,7 +98,7 @@ jobs:
       # the release branch from. fetch-depth: 0 pulled every branch ref
       # (~2k+ branches, ~1.1 GB pack) and cost ~20 min per release run.
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           token: ${{ secrets.CI_MACHINE_TOKEN || github.token }}
diff --git a/.github/workflows/cicd_comp_test-phase.yml b/.github/workflows/cicd_comp_test-phase.yml
index 470c5323b301..9fc4df4e85d6 100644
--- a/.github/workflows/cicd_comp_test-phase.yml
+++ b/.github/workflows/cicd_comp_test-phase.yml
@@ -94,7 +94,7 @@ jobs:
       has-tests: ${{ steps.generate-matrix.outputs.has-tests }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow checkout: this job only reads .github/test-matrix.yml from HEAD.
           # fetch-depth: 0 pulled every branch ref (~2k+ branches, ~1.1 GB pack).
@@ -108,7 +108,7 @@ jobs:
 
       - name: Generate test matrix
         id: generate-matrix
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           # Passed via env (not interpolated into the script) to avoid script injection.
           OPENSEARCH_PHASE: ${{ inputs.opensearch_phase }}
@@ -249,7 +249,7 @@ jobs:
 
     steps:          
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow checkout: test jobs run Maven suites against the checked-out
           # snapshot only — no git history is read anywhere in this job or in the
diff --git a/.github/workflows/cicd_evergreen-tracks-admin.yml b/.github/workflows/cicd_evergreen-tracks-admin.yml
index 15a5aa241992..91336b622a33 100644
--- a/.github/workflows/cicd_evergreen-tracks-admin.yml
+++ b/.github/workflows/cicd_evergreen-tracks-admin.yml
@@ -38,11 +38,11 @@ jobs:
   admin:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_evergreen-tracks-promote.yml b/.github/workflows/cicd_evergreen-tracks-promote.yml
index ffeae3bf0a53..37b3ed587f60 100644
--- a/.github/workflows/cicd_evergreen-tracks-promote.yml
+++ b/.github/workflows/cicd_evergreen-tracks-promote.yml
@@ -74,11 +74,11 @@ jobs:
       # since approval before it mutates anything.
       plan: ${{ steps.plan.outputs.plan }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -176,11 +176,11 @@ jobs:
       moved: ${{ steps.apply.outputs.moved }}
       summary: ${{ steps.apply.outputs.summary }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@v5
       - uses: docker/setup-buildx-action@v3
       - name: Docker login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -271,7 +271,7 @@ jobs:
     if: always()
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Notify failure
         if: needs.plan.result == 'failure' || needs.apply.result == 'failure'
         continue-on-error: true
diff --git a/.github/workflows/cicd_manual_build-docker-context.yml b/.github/workflows/cicd_manual_build-docker-context.yml
index 738fdba5d3c0..955034dfb337 100644
--- a/.github/workflows/cicd_manual_build-docker-context.yml
+++ b/.github/workflows/cicd_manual_build-docker-context.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set Common Vars
         run: |
           PLATFORMS='linux/amd64'
@@ -45,7 +45,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
         if: github.event.inputs.multi_arch == 'true'
       - name: Docker Hub login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_manual_build-java-base.yml b/.github/workflows/cicd_manual_build-java-base.yml
index 238fa1327694..be1e13c84c91 100644
--- a/.github/workflows/cicd_manual_build-java-base.yml
+++ b/.github/workflows/cicd_manual_build-java-base.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set Common Vars
         run: |
           PLATFORMS='linux/amd64'
@@ -45,7 +45,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
         if: github.event.inputs.multi_arch == 'true'
       - name: Docker Hub login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/cicd_manual_publish-starter.yml b/.github/workflows/cicd_manual_publish-starter.yml
index 4f4ce80df2bc..655fba903c39 100644
--- a/.github/workflows/cicd_manual_publish-starter.yml
+++ b/.github/workflows/cicd_manual_publish-starter.yml
@@ -92,7 +92,7 @@ jobs:
 
       - name: 'Upload artifacts'
         id: upload-artifacts
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.STARTER_TYPE }}-starter
           path: |
@@ -111,7 +111,7 @@ jobs:
     steps:
       - name: 'Checkout repository'
         if: ${{ github.event.inputs.type == 'empty' && github.event.inputs.dry-run == 'false' }}
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: jfrog/setup-jfrog-cli@v4
         env:
@@ -126,7 +126,7 @@ jobs:
           echo "::endgroup::"
           
       - name: 'Download artifacts'
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           github-token: ${{ github.token }}
@@ -213,7 +213,7 @@ jobs:
     if: always() && github.event.inputs.dry-run == 'false'
     steps:
 
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Compose Message
         id: compose-message
diff --git a/.github/workflows/cicd_post-workflow-reporting.yml b/.github/workflows/cicd_post-workflow-reporting.yml
index 804db8a9fe59..b454e3d9c11b 100644
--- a/.github/workflows/cicd_post-workflow-reporting.yml
+++ b/.github/workflows/cicd_post-workflow-reporting.yml
@@ -55,12 +55,12 @@ jobs:
         run: echo "$GITHUB_CONTEXT"
 
       # Checkout the repository
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Download workflow data from previous run
       - name: Download Workflow Data
         id: data-download
-        uses: dawidd6/action-download-artifact@v24
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         with:
           name: 'workflow-data'
           run_id: ${{ github.event.workflow_run.id || inputs.run-id }}
@@ -69,7 +69,7 @@ jobs:
       # Download build reports from previous run
       - name: Download build reports
         id: download-artifact
-        uses: dawidd6/action-download-artifact@v24
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         with:
           name: build-reports-test-.*
           name_is_regexp: true
diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index 0fad4f9c6b8a..c75fd8733e48 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -88,7 +88,7 @@ jobs:
 
       # Checkout the repository
       - name: 'Checkout'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Setup git configuration
       - name: 'Setup git config'
@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.AUXILIARY_BRANCH }}
       - name: 'Create artifacts directory'
@@ -165,7 +165,7 @@ jobs:
           echo "artifactsDir=${{ github.workspace }}/artifacts" >> "$GITHUB_ENV"
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
@@ -193,14 +193,14 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: 'Checkout code'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.HEAD }}
 
       - uses: ./.github/actions/core-cicd/cleanup-runner
 
       - name: 'Set up Node.js'
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -208,7 +208,7 @@ jobs:
         run: pip install jinja2-cli
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
@@ -359,7 +359,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.HEAD }}
 
diff --git a/.github/workflows/cicd_release-sdk.yml b/.github/workflows/cicd_release-sdk.yml
index be8a312dc3ac..f89979307c41 100644
--- a/.github/workflows/cicd_release-sdk.yml
+++ b/.github/workflows/cicd_release-sdk.yml
@@ -119,7 +119,7 @@ jobs:
       # can't be resolved on an empty runner workspace, so without this the Slack step
       # would silently no-op instead of ever sending the failure notice.
       - name: 'Checkout'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Slack Notification (Pre-check failure)'
         continue-on-error: true
@@ -143,7 +143,7 @@ jobs:
       # The composite action re-checks-out internally at the correct ref for the actual
       # build/publish; this checkout only needs to make the action definition resolvable.
       - name: 'Checkout'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.precheck.outputs.REF }}
 
diff --git a/.github/workflows/cicd_scheduled_image-cve-scan.yml b/.github/workflows/cicd_scheduled_image-cve-scan.yml
index 279dd6c801e4..8158c8afa7dd 100644
--- a/.github/workflows/cicd_scheduled_image-cve-scan.yml
+++ b/.github/workflows/cicd_scheduled_image-cve-scan.yml
@@ -70,7 +70,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload results artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy-image-cve-scan
           path: |
diff --git a/.github/workflows/cicd_scheduled_notify-seated-prs.yml b/.github/workflows/cicd_scheduled_notify-seated-prs.yml
index f516789ad8dd..bff594bf0159 100644
--- a/.github/workflows/cicd_scheduled_notify-seated-prs.yml
+++ b/.github/workflows/cicd_scheduled_notify-seated-prs.yml
@@ -27,7 +27,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
       - name: Filter execution
         id: filter-execution
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
@@ -42,7 +42,7 @@ jobs:
       - id: fetch-seated-prs
         name: Fetch Seated PRs
         if: success() && steps.filter-execution.outputs.continue == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           retries: 3
@@ -163,7 +163,7 @@ jobs:
     steps:
       - name: Build Message
         id: build-message
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
diff --git a/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml b/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
index 484a1dac0504..d59624c93576 100644
--- a/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
+++ b/.github/workflows/cicd_scheduled_opensearch-phase-sweep.yml
@@ -119,7 +119,7 @@ jobs:
     if: failure()
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Post failure to #team-scout
         uses: ./.github/actions/core-cicd/notification/notify-slack
         with:
diff --git a/.github/workflows/cicd_weekly-rolling-tags.yml b/.github/workflows/cicd_weekly-rolling-tags.yml
index 4575efbe6095..9b64c6477d4d 100644
--- a/.github/workflows/cicd_weekly-rolling-tags.yml
+++ b/.github/workflows/cicd_weekly-rolling-tags.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/issue_comp_frontend-notify.yml b/.github/workflows/issue_comp_frontend-notify.yml
index 2a8a020234ac..20311c14c580 100644
--- a/.github/workflows/issue_comp_frontend-notify.yml
+++ b/.github/workflows/issue_comp_frontend-notify.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Check if Technology body changed
         id: body-technology-check
         if: github.event.action == 'edited'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const words = ['frontend', 'front-end'];
@@ -77,7 +77,7 @@ jobs:
       - name: Check if Technology label changed
         id: label-technology-check
         if: github.event.action == 'labeled'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/issue_comp_label-conditional-labeling.yml b/.github/workflows/issue_comp_label-conditional-labeling.yml
index f3d2b74c9e14..c73373836e5e 100644
--- a/.github/workflows/issue_comp_label-conditional-labeling.yml
+++ b/.github/workflows/issue_comp_label-conditional-labeling.yml
@@ -64,7 +64,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJSON(github) }}
       - name: Resolve Labels
         id: resolve-labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
@@ -93,7 +93,7 @@ jobs:
             
             core.setOutput('labels', JSON.stringify(filteredLabels));
       - name: Add Labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: success() && steps.resolve-labels.outputs.labels != ''
         with:
           result-encoding: string
diff --git a/.github/workflows/issue_comp_release-labeling.yml b/.github/workflows/issue_comp_release-labeling.yml
index fd41363dddf7..145b6139594c 100644
--- a/.github/workflows/issue_comp_release-labeling.yml
+++ b/.github/workflows/issue_comp_release-labeling.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Rename label
         if: success()
         id: validate-inputs
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           retries: 3
@@ -94,7 +94,7 @@ jobs:
             
       - name: Re-Create New Label
         if: success()
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           retries: 3
diff --git a/.github/workflows/issue_manual_label-customer_deployed-issues.yml b/.github/workflows/issue_manual_label-customer_deployed-issues.yml
index 6d88b12df235..d0e22f7a8d87 100644
--- a/.github/workflows/issue_manual_label-customer_deployed-issues.yml
+++ b/.github/workflows/issue_manual_label-customer_deployed-issues.yml
@@ -19,7 +19,7 @@ jobs:
     
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       - name: Set up Python
         uses: actions/setup-python@v4
diff --git a/.github/workflows/issue_manual_label-issues.yml b/.github/workflows/issue_manual_label-issues.yml
index c0637299f2d1..17ca623ce349 100644
--- a/.github/workflows/issue_manual_label-issues.yml
+++ b/.github/workflows/issue_manual_label-issues.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fetch issues
         id: fetch-next-release-issues
diff --git a/.github/workflows/issue_on-open_add-to-triage-project..yml b/.github/workflows/issue_on-open_add-to-triage-project..yml
index 7010f5c4cedd..040bf4efe763 100644
--- a/.github/workflows/issue_on-open_add-to-triage-project..yml
+++ b/.github/workflows/issue_on-open_add-to-triage-project..yml
@@ -12,7 +12,7 @@ jobs:
     if: github.event.issue.assignee == null
     steps:
       - name: Check team labels and add to project
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ secrets.TRIAGE_PROJECT_TOKEN }}
           script: |
diff --git a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
index 2a35ae5319c5..a4af3a430e8a 100644
--- a/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
+++ b/.github/workflows/legacy-release_comp_maven-build-docker-image.yml
@@ -101,7 +101,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
@@ -121,7 +121,7 @@ jobs:
 
       - name: Restore Docker Context
         id: restore-docker-context
-        uses: actions/cache/restore@v6.1.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: ${{ inputs.docker_context_cache_key }}
@@ -257,14 +257,14 @@ jobs:
         if: success()
 
       - name: Docker.io login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.docker_io_username }}
           password: ${{ secrets.docker_io_token }}
         if: inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH'
 
       - name: GHCR.io login
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ secrets.ghcr_io_username }}
diff --git a/.github/workflows/legacy-release_maven-release-process.yml b/.github/workflows/legacy-release_maven-release-process.yml
index 036224cd1922..15ea8262ed34 100644
--- a/.github/workflows/legacy-release_maven-release-process.yml
+++ b/.github/workflows/legacy-release_maven-release-process.yml
@@ -88,7 +88,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_MACHINE_TOKEN }}
@@ -195,7 +195,7 @@ jobs:
 
       - name: Cache Maven Repository
         id: cache-maven
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: maven-core-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -205,7 +205,7 @@ jobs:
 
       - name: Cache Core Output
         id: cache-core-output
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ./dotCMS/target/classes
@@ -218,7 +218,7 @@ jobs:
 
       - name: Cache Node Binary
         id: cache-node-binary
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             core-web/installs
@@ -227,7 +227,7 @@ jobs:
 
       - name: Cache NPM
         id: cache-npm
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.npm
@@ -237,7 +237,7 @@ jobs:
 
       - name: Cache Docker Context
         id: cache-docker-context
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: docker-context-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -262,7 +262,7 @@ jobs:
     if: success()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.prepare-release.outputs.release_tag }}
 
@@ -270,14 +270,14 @@ jobs:
 
       - name: Restore Maven Repository
         id: restore-maven
-        uses: actions/cache/restore@v6.1.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: maven-core-${{ needs.prepare-release.outputs.date }}-${{ github.run_id }}
 
       - name: Restore Core Output
         id: restore-core-output
-        uses: actions/cache/restore@v6.1.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ./dotCMS/target/classes
@@ -287,14 +287,14 @@ jobs:
 
       - name: Restore Node Binary
         id: restore-node-binary
-        uses: actions/cache/restore@v6.1.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: core-web/installs
           key: node-binary-${{ hashFiles('core-web/.nvmrc') }}
 
       - name: Restore NPM
         id: restore-npm
-        uses: actions/cache/restore@v6.1.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: npm-${{ hashFiles('core-web/package-lock.json') }}
@@ -386,7 +386,7 @@ jobs:
     needs: [  prepare-release, build-push-image ]
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/legacy-release/sbom-generator
         id: sbom-generator
@@ -395,7 +395,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Download all build artifacts'
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           digest-mismatch: error
           path: ${{ github.workspace }}/artifacts
@@ -438,7 +438,7 @@ jobs:
     if: success()
     steps:
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/legacy-release_sbom-generator.yaml b/.github/workflows/legacy-release_sbom-generator.yaml
index 41a45ffaba7f..0729761e265a 100644
--- a/.github/workflows/legacy-release_sbom-generator.yaml
+++ b/.github/workflows/legacy-release_sbom-generator.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout core-test-results repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: dotCMS/core-test-results
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish_docs.yml b/.github/workflows/publish_docs.yml
index 1cb958c71678..c30506fed5cf 100644
--- a/.github/workflows/publish_docs.yml
+++ b/.github/workflows/publish_docs.yml
@@ -10,11 +10,11 @@ jobs:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
       - name: Configuring Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: 'core-web/.nvmrc'
       - name: Installing dependencies
diff --git a/.github/workflows/utility_discover-docker-tags.yml b/.github/workflows/utility_discover-docker-tags.yml
index e399af3b0b92..391198fbeb8b 100644
--- a/.github/workflows/utility_discover-docker-tags.yml
+++ b/.github/workflows/utility_discover-docker-tags.yml
@@ -24,7 +24,7 @@ jobs:
         run: echo "$GITHUB_CONTEXT"
         if: env.DEBUG == 'true'
       - name: Checkout core
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set Common Vars
         run: |
           pwd && ls -las

From 97d66efb470fc44edf1a1714a3f9d11744edbda9 Mon Sep 17 00:00:00 2001
From: Nicolas Molina Monroy <hi@nicobytes.com>
Date: Mon, 31 Aug 2026 12:38:50 -0400
Subject: [PATCH 14/14] docs(ci): pin the copyable README examples to a SHA too
 (#36850)

Five action README examples still showed a mutable tag after the workflows were
pinned, so the docs were teaching the opposite of the practice:

  deploy-jfrog/README.md:37
  maven-job/README.md:76
  prepare-runner/README.md:58
  cleanup-runner/Readme.md:45
  setup-java/README.md:57

  - uses: actions/checkout@v7.0.1
  + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

These sit inside ```yaml blocks and exist to be copied into a real workflow, so
a mutable tag here reintroduces exactly the drift this PR removed -- the same
argument that put the stale @v2 examples in scope in the first place.

Three references are deliberately left as versions, because they are prose, not
code, and nobody pastes a sentence into a workflow:

  deploy-javadoc/README.md:39         "Uses the `actions/checkout@v7.0.1` action to..."
  deploy-javascript-sdk/README.md:38  "The action uses `actions/checkout@v7.0.1` to..."
  deploy-javascript-sdk/README.md:41  "`actions/setup-node@v7.0.0` sets up the Node.js..."

A 40-character SHA in running text is worse documentation than the version it
replaces: the version is the informative part, and the sentence is describing
what the composite does rather than offering something to copy.

Noticed while auditing these, and NOT fixed here: api-limits-check/Readme.md:30
shows `uses: your-repo/check-rate-limit-action@v1` -- a placeholder that was
never filled in, pointing at a repository that does not exist. Unrelated to
Node 24; worth its own cleanup.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/actions/core-cicd/cleanup-runner/Readme.md          | 2 +-
 .github/actions/core-cicd/deployment/deploy-jfrog/README.md | 2 +-
 .github/actions/core-cicd/maven-job/README.md               | 2 +-
 .github/actions/core-cicd/prepare-runner/README.md          | 2 +-
 .github/actions/core-cicd/setup-java/README.md              | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/actions/core-cicd/cleanup-runner/Readme.md b/.github/actions/core-cicd/cleanup-runner/Readme.md
index 7f5e2b01603c..02761cedc32f 100644
--- a/.github/actions/core-cicd/cleanup-runner/Readme.md
+++ b/.github/actions/core-cicd/cleanup-runner/Readme.md
@@ -42,7 +42,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Your build steps here...
 
diff --git a/.github/actions/core-cicd/deployment/deploy-jfrog/README.md b/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
index 0d36a0654ef9..ef001e49b9de 100644
--- a/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
+++ b/.github/actions/core-cicd/deployment/deploy-jfrog/README.md
@@ -34,7 +34,7 @@ jobs:
   deploy:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Deploy Artifact
         uses: ./.github/actions/core-cicd/deployment/deploy-jfrog
diff --git a/.github/actions/core-cicd/maven-job/README.md b/.github/actions/core-cicd/maven-job/README.md
index 4b76f4f41e7e..d4461eb4cb6f 100644
--- a/.github/actions/core-cicd/maven-job/README.md
+++ b/.github/actions/core-cicd/maven-job/README.md
@@ -73,7 +73,7 @@ jobs:
   build-and-test:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Maven Job
         uses: ./.github/actions/core-cicd/maven-job
diff --git a/.github/actions/core-cicd/prepare-runner/README.md b/.github/actions/core-cicd/prepare-runner/README.md
index 4ad81cddd90c..b0958c12941a 100644
--- a/.github/actions/core-cicd/prepare-runner/README.md
+++ b/.github/actions/core-cicd/prepare-runner/README.md
@@ -55,7 +55,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare Runner
         uses: ./.github/actions/core-cicd/prepare-runner
diff --git a/.github/actions/core-cicd/setup-java/README.md b/.github/actions/core-cicd/setup-java/README.md
index d2815c0581ea..f13cd20c8062 100644
--- a/.github/actions/core-cicd/setup-java/README.md
+++ b/.github/actions/core-cicd/setup-java/README.md
@@ -54,7 +54,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Java
         uses: ./.github/actions/core-cicd/setup-java