chore(deps): pin dependencies

.github/workflows/android-ech.yml

@@ -37,16 +37,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.3.0
 
       - name: Enable KVM group permissions
         run: |
@@ -57,7 +57,7 @@ jobs:
       # API 37 is the emulator this suite needs: ECH is applied by OkHttp's Android platform
       # through android.net.ssl.EchConfigList, which arrived there.
       - name: Run the ECH suite against the fixture containers
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@v2.38.0
         with:
           api-level: '37.0'
           target: google_apis_playstore_ps16k
@@ -105,7 +105,7 @@ jobs:
       # The suite's XML, for the status page, whatever colour the job ended up.
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: android-ech-test-results-${{ inputs.okhttpVersion || 'pinned-snapshot' }}
           path: |

.github/workflows/conscrypt.yml

@@ -44,11 +44,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       # Conscrypt's own build wants a JDK to compile against and JNI headers to build against.
       - name: Configure JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: 17
@@ -108,7 +108,7 @@ jobs:
       # fetched back — including on a pull request, where it exercises the fallback path.
       - name: Upload the build
         if: always() && (steps.existing.outputs.exists == 'false' || inputs.force)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: conscrypt-${{ steps.pin.outputs.tag }}
           path: conscrypt/build/dist/

.github/workflows/containers.yml

@@ -51,16 +51,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.3.0
 
       - name: Run Container Tests
         # --continue so a failing container test doesn't stop loomTest from running:
@@ -100,7 +100,7 @@ jobs:
       # the build. The status page reads results from here, not from the job's colour.
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: container-test-results-${{ matrix.okhttpVersion || 'pinned' }}
           path: |

.github/workflows/network.yml

@@ -47,16 +47,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.3.0
 
       # Without this the Conscrypt suites are left out of the source set and a change that
       # breaks them compiles clean. Failure is not fatal here: a pull request that bumps the
@@ -91,16 +91,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.3.0
 
       # The ECH suites' other half: a Conscrypt that can encrypt a client hello, which is not
       # published anywhere. Downloaded rather than built — the build is its own workflow, and
@@ -150,7 +150,7 @@ jobs:
       # results — the status page reads them from here, and shows them as findings.
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: network-test-results-${{ matrix.okhttpVersion || 'pinned' }}
           path: |

.github/workflows/pages.yml

@@ -56,14 +56,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       # enablement creates the Pages site on the first run rather than requiring someone to
       # turn it on by hand: without it every build fails at this step with "Get Pages site
       # failed", and nothing is ever deployed. It is a no-op once the site exists.
       - name: Configure Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v5.0.0
         with:
           enablement: true
 
@@ -156,10 +156,10 @@ jobs:
           echo "collected $(python3 -c 'import json,sys; print(len(json.load(open("site/data/issues.json"))))') open issue(s)"
 
       - name: Upload Pages Artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v4.0.0
         with:
           path: site
 
       - name: Deploy
         id: deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v4.0.5

.github/workflows/test-server.yml

@@ -37,12 +37,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v5.6.0
         with:
-          go-version: '1.24'
+          go-version: '1.24.13'
           cache-dependency-path: test-server/go.mod
 
       - name: Vet and Test
@@ -120,7 +120,7 @@ jobs:
 
       - name: Log in to GHCR
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}