chore(ci): upgrade GitHub Actions to Node 24 runtime majors (#36850)

.github/actions/core-cicd/cleanup-runner/Readme.md

@@ -42,7 +42,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Your build steps here...
 

.github/actions/core-cicd/deployment/deploy-cli-npm/action.yml

@@ -39,12 +39,12 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
 
     - name: 'Set up Node.js'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
@@ -55,8 +55,9 @@ runs:
 
     - name: 'Download all cli build artifacts.'
       id: download-cli-artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         pattern: cli-artifacts-*
         path: ${{ github.workspace }}/artifacts
         github-token: ${{ inputs.github-token }} # token with actions:read permissions on target repo

.github/actions/core-cicd/deployment/deploy-docker/action.yml

@@ -86,9 +86,10 @@ runs:
   using: "composite"
   steps:
     - name: Download Docker Build Context
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       if: inputs.build_run_id # Only download the artifact if a build run id is provided
       with:
+        digest-mismatch: error
         name: docker-build-context${{ inputs.artifact_suffix }}
         path: ${{ github.workspace }}
         run-id: ${{ inputs.build_run_id }}
@@ -162,14 +163,14 @@ runs:
           fi
         echo "EOF" >> $GITHUB_ENV
     - name: Docker.io login
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker_io_username }}
         password: ${{ inputs.docker_io_token }}
       if: (inputs.docker_registry == 'DOCKER.IO' || inputs.docker_registry == 'BOTH') && inputs.do_deploy == 'true'
 
     - name: GHCR.io login
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ inputs.ghcr_io_username }}

.github/actions/core-cicd/deployment/deploy-javadoc/README.md

@@ -36,7 +36,7 @@ This GitHub composite action deploys Javadoc artifacts to the GitHub Packages re
 
 ## Steps
 
-1. **Checkout**: Uses the `actions/checkout@v4` action to check out the specified branch.
+1. **Checkout**: Uses the `actions/checkout@v7.0.1` action to check out the specified branch.
 2. **Maven Clean Build**: Runs a Maven clean install to build the project (skipping tests), only if `artifact-run-id` is not provided.
 3. **Deploy Javadoc**: Runs Maven to generate Javadocs and restores classes from the specified artifact run ID if provided.
 4. **Configure AWS Credentials**: Configures AWS credentials using the `aws-actions/configure-aws-credentials@v1` action.

.github/actions/core-cicd/deployment/deploy-javadoc/action.yml

@@ -28,7 +28,7 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
 

.github/actions/core-cicd/deployment/deploy-javascript-sdk/README.md

@@ -35,10 +35,10 @@ This GitHub Action is designed to automate the process of publishing dotCMS SDK
 ## Detailed Steps
 
 1. **Checkout**  
-   The action uses `actions/checkout@v4` to check out the specified branch, allowing the workflow to access the repository's contents.
+   The action uses `actions/checkout@v7.0.1` to check out the specified branch, allowing the workflow to access the repository's contents.
 
 2. **Set Up Node.js**  
-   `actions/setup-node@v4` sets up the Node.js environment, crucial for running scripts and managing dependencies.
+   `actions/setup-node@v7.0.0` sets up the Node.js environment, crucial for running scripts and managing dependencies.
 
 3. **Get Next Version**  
    This step retrieves the next version of the SDK by reading the `package.json` file from the specified directory.

.github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml

@@ -47,13 +47,13 @@ runs:
   using: "composite"
   steps:
     - name: 'Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref }}
         token: ${{ inputs.github-token }}
 
     - name: 'Setup Node'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version-file: 'core-web/.nvmrc'
 
@@ -106,7 +106,7 @@ runs:
       shell: bash
 
     - name: Set up pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -120,7 +120,7 @@ runs:
 
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -140,7 +140,7 @@ runs:
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}

.github/actions/core-cicd/deployment/deploy-jfrog/README.md

@@ -34,7 +34,7 @@ jobs:
   deploy:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Deploy Artifact
         uses: ./.github/actions/core-cicd/deployment/deploy-jfrog

.github/actions/core-cicd/deployment/deploy-jfrog/action.yml

@@ -38,7 +38,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - uses: ./.github/actions/core-cicd/maven-job
       with:

.github/actions/core-cicd/maven-job/README.md

@@ -73,7 +73,7 @@ jobs:
   build-and-test:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Maven Job
         uses: ./.github/actions/core-cicd/maven-job

.github/actions/core-cicd/maven-job/action.yml

@@ -180,10 +180,10 @@ runs:
     # means the first one to run on a cold key repairs it for the rest.
     - id: cache-maven-wrapper
       name: Cache Maven Wrapper Distribution
-      # Pinned to a commit SHA, not the mutable v4 tag: a tag can be repointed by
+      # Pinned to a commit SHA, not the mutable v6 tag: a tag can be repointed by
       # the action owner, which is how the trivy-action and kics-github-action
       # compromises worked. Bump deliberately when updating.
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/wrapper
         # Changes only when the Maven version does, so this key is ~always a hit.
@@ -192,7 +192,7 @@ runs:
     - id: restore-cache-maven
       name: Restore Maven Repository Cache
       if: ${{ inputs.artifacts-from == '' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-mavencore-${{ hashFiles('**/pom.xml') }}
@@ -202,7 +202,7 @@ runs:
     - id: restore-cache-node
       name: Restore Node Binary Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: installs
         # hash nodejs-parent/pom.xml so the pnpm-era layout (install-node-and-npm
@@ -226,7 +226,7 @@ runs:
 
     - name: Set up pnpm
       if: ${{ inputs.requires-node == 'true' }}
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       with:
         package_json_file: core-web/package.json
         run_install: false
@@ -242,7 +242,7 @@ runs:
     - id: restore-cache-pnpm
       name: Restore pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ runner.os }}-pnpm-${{ steps.pnpm-info.outputs.version }}-${{ hashFiles('core-web/pnpm-lock.yaml') }}
@@ -254,7 +254,7 @@ runs:
     - id: cache-sonar
       name: Cache SonarQube Packages
       if: ${{ inputs.cache-sonar == 'true' }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ runner.os }}-sonar
@@ -263,8 +263,9 @@ runs:
     - id: restore-artifact-maven-repo
       name: Restore Maven Build Repo
       if: ${{ inputs.artifacts-from != '' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
@@ -273,8 +274,9 @@ runs:
     - id: restore-artifact-docker-image
       name: Restore Docker Image
       if: ${{ inputs.needs-docker-image == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
         path: /tmp/docker-image
 
@@ -286,15 +288,16 @@ runs:
     - id: restore-artifact-classes
       name: Restore Classes
       if: ${{ inputs.restore-classes == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
+        digest-mismatch: error
         run-id: ${{ inputs.artifacts-from }}
         github-token: ${{ inputs.github-token }}
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
 
     - name: Docker Hub Login
       if: ${{ inputs.docker-io-username != '' && inputs.docker-io-token != '' }}
-      uses: docker/login-action@v3.0.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker-io-username }}
         password: ${{ inputs.docker-io-token }}
@@ -345,15 +348,15 @@ runs:
     - id: persist-maven-repo
       name: Persist Maven Repo
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: maven-repo${{ steps.artifact-suffix.outputs.suffix }}
         path: ~/.m2/repository
 
     - id: persist-docker-build-context
       name: Persist Docker Build Context
       if: ${{ inputs.generate-docker == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: docker-build-context${{ steps.artifact-suffix.outputs.suffix }}
         path: dotCMS/target/docker-build.tar
@@ -399,7 +402,7 @@ runs:
 
     - id: upload-docker-image
       name: Upload Docker Image as Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: ${{ inputs.generate-docker == 'true' }}
       with:
         name: docker-image${{ steps.artifact-suffix.outputs.suffix }}
@@ -408,7 +411,7 @@ runs:
     - id: persist-build-classes
       name: Persist Build Classes
       if: ${{ inputs.generate-artifacts == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: build-classes${{ steps.artifact-suffix.outputs.suffix }}
         path: |
@@ -426,39 +429,39 @@ runs:
     - id: save-cache-maven
       name: Save Maven Repository Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-maven.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.m2/repository
         key: ${{ steps.restore-cache-maven.outputs.cache-primary-key }}
 
     - id: save-cache-node
       name: Save Node Binary Cache
       if: ${{ inputs.generate-artifacts == 'true' && steps.restore-cache-node.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: installs
         key: ${{ steps.restore-cache-node.outputs.cache-primary-key }}
 
     - id: save-cache-pnpm
       name: Save pnpm Store Cache
       if: ${{ inputs.requires-node == 'true' && inputs.generate-artifacts == 'true' && steps.restore-cache-pnpm.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-info.outputs.dir }}
         key: ${{ steps.restore-cache-pnpm.outputs.cache-primary-key }}
 
     - id: save-cache-sonar
       name: Save SonarQube Cache
       if: ${{ inputs.cache-sonar == 'true' && steps.cache-sonar.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ steps.cache-sonar.outputs.cache-primary-key }}
 
     # ---------------------------- Generate Reports Artifacts ----------------------------
     - id: generate-build-reports-artifact
       name: Generate Build Reports Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always()
       with:
         name: "build-reports-${{ inputs.stage-name }}"
@@ -469,7 +472,7 @@ runs:
 
     - id: create-test-reports-artifact
       name: Create Test Reports Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always() && inputs.generates-test-results == 'true'
       with:
         name: "build-reports-test-${{ inputs.stage-name }}"

.github/actions/core-cicd/prepare-runner/README.md

@@ -55,7 +55,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare Runner
         uses: ./.github/actions/core-cicd/prepare-runner

.github/actions/core-cicd/setup-java/README.md

@@ -54,7 +54,7 @@ jobs:
   build:
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Java
         uses: ./.github/actions/core-cicd/setup-java