Merge branch 'main' into redesign-log-details

Author: ogzhanolguncu

.github/actions/setup-go/action.yaml

@@ -8,10 +8,10 @@ inputs:
 
 runs:
   using: "composite"
-  
+
   steps:
-    - name: Setup Go
-      uses: actions/setup-go@v5
+    - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      name: Setup Go
       with:
         go-version-file: ./go/go.mod
         cache-dependency-path: ./go/go.sum
@@ -21,4 +21,4 @@ runs:
       shell: bash
       working-directory: ./go
       env:
-        GITHUB_TOKEN: ${{ inputs.github_token }}
+        GITHUB_TOKEN: ${{ inputs.github_token }}

.github/actions/setup-node/action.yaml

@@ -8,34 +8,29 @@ inputs:
   install:
     description: Whether to run pnpm install
     required: false
-    default: 'true'
+    default: "true"
 
 runs:
   using: "composite"
-  
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       with:
         run_install: false
-
     - name: Setup Node with pnpm cache
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
       with:
         node-version: lts/*
-        cache: 'pnpm'
+        cache: "pnpm"
         cache-dependency-path: "**/pnpm-lock.yaml"
-
     - name: Enable Corepack
       shell: bash
       run: corepack enable
-
-
     - name: Install dependencies
       if: inputs.install == 'true'
       shell: bash
       run: pnpm install --recursive --frozen-lockfile
       env:
         CI: 1
         GITHUB_TOKEN: ${{ inputs.github_token }}
-        NPM_TOKEN: ${{ inputs.github_token }}
+        NPM_TOKEN: ${{ inputs.github_token }}

.github/workflows/agent_build_publish.yaml

@@ -11,7 +11,7 @@ jobs:
     name: Build Agent
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Get Version
         run: |
           # Extract everything after "agent/"
@@ -21,17 +21,17 @@ jobs:
       - name: Get tags
         run: echo "TAGS=ghcr.io/unkeyed/agent:${{env.VERSION}},ghcr.io/unkeyed/agent:latest" >> $GITHUB_ENV
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Login to image repository
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: apps/agent
           platforms: linux/amd64

.github/workflows/apply-issue-labels-to-pr.yml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Apply labels from linked issue to PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/autofix.ci.yaml

@@ -10,19 +10,19 @@ jobs:
     if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
       - name: Setup Node with pnpm cache
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
           cache: "pnpm"
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Go (for formatting)
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version-file: ./go/go.mod
           cache-dependency-path: ./go/go.sum
@@ -33,13 +33,13 @@ jobs:
       - run: pnpm biome format . --write && pnpm biome check . --write
         env:
           CI: 1
-      - uses: autofix-ci/action@ff86a557419858bb967097bfc916833f5647fa8c
+      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2
   lint_docs:
     name: Docs
     if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Lint main docs
         run: npx mintlify@latest broken-links
         working-directory: apps/docs

.github/workflows/build.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Run containers
         run: docker compose -f ./deployment/docker-compose.yaml up -d mysql planetscale
       - name: Setup Node

.github/workflows/check_quotas.yml

@@ -12,8 +12,8 @@ jobs:
     name: Check quota usage
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        name: Checkout code
       - name: Delete huge unnecessary tools folder
         run: rm -rf /opt/hostedtoolcache
       - name: Setup Go

.github/workflows/deploy.yaml

@@ -67,7 +67,7 @@ jobs:
       - api_production_deployment
     name: Deploy docs
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Redeploy
         run: |
           curl --request POST \

.github/workflows/deploy_trigger.yaml

@@ -5,9 +5,9 @@ jobs:
   deploy_trigger:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Node (minimal for pnpx)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: lts/*
       - name: Deploy Trigger.dev

.github/workflows/ghcr_retention_policy.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Delete old test images
     steps:
-      - uses: snok/[email protected].0
+      - uses: snok/container-retention-policy@3b0972b2276b171b212f8c4efbca59ebba26eceb # v3.0.1
         with:
           account: unkeyed
           token: ${{ secrets.PAT }}