apify · B4nan · Aug 20, 2026 · Aug 20, 2026
diff --git a/.github/workflows/build_docker_image_and_push_to_ecr.yaml b/.github/workflows/build_docker_image_and_push_to_ecr.yaml
@@ -109,7 +109,7 @@ jobs:
     steps:
       - name: Send notification to slack
         if: inputs.slackChannelId != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}
@@ -148,7 +148,7 @@ jobs:
             }
 
       - name: clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: set docker build args and secrets
         run: |
@@ -168,15 +168,15 @@ jobs:
 
       # NOTE: can be useful
       # - name: Set up QEMU
-      #   uses: docker/setup-qemu-action@v2
+      #   uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
 
       - name: setup Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # First assume GithubOIDCRole role, the trust relationship between GitHub and AWS is defined in IAM GithubOIDCRole in the organization account. This role has permissions to assume Deployer roles only.
       - name: assume GithubOIDCRole
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.githubOIDCRoleArn }}
@@ -189,7 +189,7 @@ jobs:
       # Then assume Deployer role, which can be assumed by GithubOIDCRole and has all the permissions needed to deploy cloudformation stacks.
       - name: assume Deployer role
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.awsRoleArn }}
@@ -200,19 +200,19 @@ jobs:
       - name: login to AWS ECR using OIDC
         if: inputs.useOIDC == true
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
 
       - name: login to AWS ECR
         if: inputs.useOIDC == false
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
       - name: build and push
         id: build_and_push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ inputs.dockerContext }}
           file: ${{ inputs.dockerFilePath }}
@@ -238,7 +238,7 @@ jobs:
 
       - name: send result to slack
         if: always() && inputs.slackChannelId != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}

diff --git a/.github/workflows/check-execute-workflow-dist.yaml b/.github/workflows/check-execute-workflow-dist.yaml
@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: '.nvmrc'
 

diff --git a/.github/workflows/claude-md-maintenance.yml b/.github/workflows/claude-md-maintenance.yml
@@ -18,12 +18,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "24"
 

diff --git a/.github/workflows/copy_proofread_review.yaml b/.github/workflows/copy_proofread_review.yaml
@@ -58,15 +58,15 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # The diff comes from `gh pr diff` (API-backed) and files are read from the working tree.
           fetch-depth: 1
 
       - name: Check out the apify-proofreader skill
         # Checked out here rather than under `.claude/` — claude-code-action wipes and restores `.claude/`
         # from the PR base branch before running Claude.
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: apify/agent-skills-internal
           token: ${{ secrets.agentSkillsRepoGithubToken }}
@@ -75,7 +75,7 @@ jobs:
           fetch-depth: 1
 
       - name: Proofread public-facing copy
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@5ee796a55f92566ecd7e39d70dd613abcbea0d7c # v1.0.197
         env:
           GH_TOKEN: ${{ github.token }}
         with:
@@ -155,7 +155,7 @@ jobs:
       - name: Remove trigger label
         # Re-adding it re-runs the review.
         if: always() && github.event.label.name != ''
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ github.token }}
           script: |

diff --git a/.github/workflows/create_changelog.yaml b/.github/workflows/create_changelog.yaml
@@ -77,7 +77,7 @@ jobs:
 
       - name: report failure to slack
         if: failure() && inputs.slackChannelIdForFailureMsg != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}

diff --git a/.github/workflows/deploy_cloudformation.yaml b/.github/workflows/deploy_cloudformation.yaml
@@ -100,7 +100,7 @@ jobs:
     steps:
       - name: send notification to slack
         if: inputs.slackChannelId != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}
@@ -139,11 +139,11 @@ jobs:
             }
 
       - name: clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: assume IAM role
         if: inputs.useOIDC == false
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.awsAccessKeyId }}
           aws-secret-access-key: ${{ secrets.awsSecretAccessKey }}
@@ -158,7 +158,7 @@ jobs:
       # First assume GithubOIDCRole role, the trust relationship between GitHub and AWS is defined in IAM GithubOIDCRole in the organization account. This role has permissions to assume Deployer roles only.
       - name: assume GithubOIDCRole
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.githubOIDCRoleArn }}
@@ -171,7 +171,7 @@ jobs:
       # Then assume Deployer role, which can be assumed by GithubOIDCRole and has all the permissions needed to deploy cloudformation stacks.
       - name: assume Deployer role
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.awsRoleArn }}
@@ -257,7 +257,7 @@ jobs:
 
       - name: send result to slack
         if: always() && inputs.slackChannelId != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}

diff --git a/.github/workflows/deploy_helmfile.yaml b/.github/workflows/deploy_helmfile.yaml
@@ -129,11 +129,11 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Send notification to slack
         if: inputs.slackChannelId != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}
@@ -208,7 +208,7 @@ jobs:
 
       - name: assume IAM role
         if: inputs.useOIDC == false
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.awsAccessKeyId }}
           aws-secret-access-key: ${{ secrets.awsSecretAccessKey }}
@@ -223,7 +223,7 @@ jobs:
       # First assume GithubOIDCRole role, the trust relationship between GitHub and AWS is defined in IAM GithubOIDCRole in the organization account. This role has permissions to assume Deployer roles only.
       - name: assume GithubOIDCRole
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.githubOIDCRoleArn }}
@@ -236,7 +236,7 @@ jobs:
       # Then assume Deployer role, which can be assumed by GithubOIDCRole and has all the permissions needed to deploy cloudformation stacks.
       - name: assume Deployer role
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.awsRoleArn }}
@@ -248,7 +248,7 @@ jobs:
         run: aws eks update-kubeconfig --name ${{ inputs.eksClusterName }} $OPTIONAL_PARAMS
 
       - name: Tailscale VPN
-        uses: tailscale/github-action@v4
+        uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4.1.2
         if: inputs.enableVpn == 'true'
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
@@ -296,7 +296,7 @@ jobs:
 
       - name: send result to slack
         if: always() && inputs.slackChannelId != ''
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           method: chat.postMessage
           token: ${{ secrets.slackToken }}

diff --git a/.github/workflows/get_values.yaml b/.github/workflows/get_values.yaml
@@ -64,7 +64,7 @@ jobs:
           echo "clean_branch_name_with_suffix=${CLEAN_BRANCH_NAME_WITH_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: get last commit author
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: get_commit_author
         with:
           result-encoding: string

diff --git a/.github/workflows/invalidate_cloudfront.yaml b/.github/workflows/invalidate_cloudfront.yaml
@@ -66,7 +66,7 @@ jobs:
     steps:
       - name: assume IAM role
         if: inputs.useOIDC == false
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.awsAccessKeyId }}
           aws-secret-access-key: ${{ secrets.awsSecretAccessKey }}
@@ -81,7 +81,7 @@ jobs:
       # First assume GithubOIDCRole role, the trust relationship between GitHub and AWS is defined in IAM GithubOIDCRole in the organization account. This role has permissions to assume Deployer roles only.
       - name: assume GithubOIDCRole
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.githubOIDCRoleArn }}
@@ -94,7 +94,7 @@ jobs:
       # Then assume Deployer role, which can be assumed by GithubOIDCRole and has all the permissions needed.
       - name: assume Deployer role
         if: inputs.useOIDC == true
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.awsRoleArn }}

diff --git a/.github/workflows/lint_cloudformation.yaml b/.github/workflows/lint_cloudformation.yaml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-22.04-arm64
     steps:
       - name: clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: install cfn-lint
         run: pip install cfn-lint==${CFN_LINT_VERSION}

diff --git a/.github/workflows/lint_gh_actions.yaml b/.github/workflows/lint_gh_actions.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-22.04-arm64
     steps:
       - name: clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: lint
         run: |

diff --git a/.github/workflows/lint_helmfile.yaml b/.github/workflows/lint_helmfile.yaml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-22.04-arm64
     steps:
       - name: clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: install helmfile
         run: |

diff --git a/.github/workflows/local_lint.yaml b/.github/workflows/local_lint.yaml
@@ -21,16 +21,16 @@ jobs:
     runs-on: ubuntu-22.04-arm64
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: '.nvmrc'
           check-latest: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile --ignore-scripts

diff --git a/.github/workflows/local_release.yaml b/.github/workflows/local_release.yaml
@@ -17,6 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: release-please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
         with:
           release-type: simple
diff --git a/.github/workflows/python_bump_and_update_changelog.yaml b/.github/workflows/python_bump_and_update_changelog.yaml
@@ -45,17 +45,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ inputs.python_version }}
 
       - name: Set up uv package manager
-        uses: astral-sh/setup-uv@v8.0.0
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
         with:
           python-version: ${{ inputs.python_version }}
 
@@ -71,7 +71,7 @@ jobs:
       # 128 KiB - past that the step fails to start with "Argument list too long".
       - name: Download changelog artifact
         id: changelog_artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         continue-on-error: true
         with:
           name: ${{ inputs.changelog_artifact_name }}
@@ -108,7 +108,7 @@ jobs:
       # not upload the artifact. Drop it, together with the 'changelog' input, once every caller is bumped.
       - name: Update the changelog from the input
         if: ${{ steps.changelog_artifact.outcome != 'success' }}
-        uses: DamianReeves/write-file-action@v1.3
+        uses: DamianReeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42 # v1.3
         with:
           path: ${{ inputs.changelog_path }}
           write-mode: overwrite