chore: harden GitHub Actions workflows (#3834)

Co-authored-by: jonathan343 <jonathangee09@gmail.com>

Author: kai-ion

.github/workflows/clang-format.yml

@@ -16,9 +16,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0  # Fetch all commits of the pull request branch
+          persist-credentials: false
 
 
       - name: Install clang-format

.github/workflows/clang-tidy.yml

@@ -20,10 +20,11 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           submodules: recursive
+          persist-credentials: false
 
       - name: Install dependencies
         run: |

.github/workflows/closed-issue-message.yml

@@ -9,7 +9,7 @@ jobs:
     auto_comment:
         runs-on: ubuntu-latest
         steps:
-        - uses: aws-actions/closed-issue-message@v1
+        - uses: aws-actions/closed-issue-message@cf797c2463fa6b95a23b2957fe075a3fa9aa8138 # v1
           with:
             # These inputs are both required
             repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/cspell.yml

@@ -11,9 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       with:
         path: aws-sdk-cpp
+        persist-credentials: false
     - name: Install Dependencies
       run: |
         sudo npm install -g cspell

.github/workflows/handle-stale-discussions.yml

@@ -13,6 +13,6 @@ jobs:
       discussions: write
     steps:
       - name: Stale discussions action
-        uses: aws-github-ops/handle-stale-discussions@v1
+        uses: aws-github-ops/handle-stale-discussions@711a9813957be17629fc6933afcd8bd132c57254 # v1.6
         env:
-          GITHUB_TOKEN:  ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN:  ${{secrets.GITHUB_TOKEN}}

.github/workflows/issue-regression-labeler.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
     - name: Fetch template body
       id: check_regression
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
       env: 
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         TEMPLATE_BODY: ${{ github.event.issue.body }}
@@ -28,7 +28,7 @@ jobs:
     - name: Add label on regression
       if: steps.check_regression.outputs.is_regression == 'true'
       id: add_label
-      uses: actions/github-script@v6
+      uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
@@ -42,7 +42,7 @@ jobs:
     - name: Remove label on regression
       if: steps.check_regression.outputs.is_regression == 'false'
       id: remove_label
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
@@ -56,4 +56,4 @@ jobs:
           } catch (error) {
             console.log('Label does not exist or cannot be removed:', error.message);
           }
-          
+          

.github/workflows/pull-request-build.yml

@@ -26,9 +26,10 @@ jobs:
     steps:
       - name: Checkout merge group (shallow)
         if: github.event_name == 'merge_group'
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 2
+          persist-credentials: false
       - name: Check if merge queue build is needed
         if: github.event_name == 'merge_group'
         id: queue-check
@@ -51,7 +52,7 @@ jobs:
           fi
       - name: Configure AWS Credentials
         if: steps.queue-check.outputs.skip != 'true'
-        uses: aws-actions/configure-aws-credentials@main
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ env.IAM_ROLE_ARN }}
           role-session-name: PullRequestBuildGitHubAction
@@ -78,4 +79,4 @@ jobs:
             --branch "$HEAD_REF" \
             --pr-number "$PR_NUMBER" \
             --run-id "$RUN_ID"
-        timeout-minutes: 180
+        timeout-minutes: 180

.github/workflows/stale_issue.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Stale issue job
     steps:
-    - uses: aws-actions/stale-issue-cleanup@v3
+    - uses: aws-actions/stale-issue-cleanup@a212a95494d14ffef4ebb4c4574b6548c50e341c # v3
       with:
         # Setting messages to an empty string will cause the automation to skip
         # that category