Pin dependencies for GH Actions and Docker

.github/workflows/build-release.yml

@@ -25,7 +25,7 @@ jobs:
       CHECKSUM_PATH: ${{ github.event.action == 'released' && 'packages/desktop/dist/latest-linux.yml' || 'packages/desktop/dist/alpha-linux.yml' }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: Setup environment
         uses: ./.github/actions/setup-env
@@ -55,7 +55,7 @@ jobs:
         run: lerna run postBuild --scope quiet
 
       - name: "Push electron-updater new checksum to S3"
-        uses: vinkabuki/upload-s3-action@master
+        uses: vinkabuki/upload-s3-action@c1c7c2268c91fbbc1293455e7b4bb2292267d2bd # master
         with:
           aws_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -65,18 +65,18 @@ jobs:
 
       - name: Get release
         id: get_release
-        uses: bruceadams/[email protected]
+        uses: bruceadams/get-release@3a8733307b85cd96d52772b037617bd63d99522e # v1.2.3
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Get release version
         id: package-version
-        uses: martinbeentjes/npm-get-version-action@main
+        uses: martinbeentjes/npm-get-version-action@3cf273023a0dda27efcd3164bdfb51908dd46a5b # main
         with:
           path: packages/desktop
 
       - name: Upload Release Assets
-        uses: actions/[email protected]
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
@@ -96,13 +96,13 @@ jobs:
       S3_BUCKET: ${{ github.event.action == 'released' && 'quiet' || 'test.quiet' }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
-      - uses: actions-rs/components-nightly@v1
+      - uses: actions-rs/components-nightly@254194ebf6ba07d2bb7cec8be76cee368d44fb90 # v1.1.1
         with:
           component: clippy
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: nightly-2020-08-28
           components: clippy
@@ -138,18 +138,18 @@ jobs:
 
       - name: Get release
         id: get_release
-        uses: bruceadams/[email protected]
+        uses: bruceadams/get-release@3a8733307b85cd96d52772b037617bd63d99522e # v1.2.3
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Extract version
         id: extract_version
-        uses: Saionaro/[email protected]
+        uses: Saionaro/extract-package-version@de8268c348d3a9ed3514c86a9ad8d4568ab8b49e # v1.1.1
         with:
           path: packages/desktop
 
       - name: Upload Release Assets
-        uses: actions/[email protected]
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
@@ -169,15 +169,15 @@ jobs:
       S3_BUCKET: ${{ github.event.action == 'released' && 'quiet' || 'test.quiet' }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: "Fetch jsign"
         shell: bash
         run: cd packages/desktop && curl https://zbay-binaries.s3.us-east-2.amazonaws.com/jsign/jsign-2.1.jar --output ./jsign-2.1.jar
 
       - name: "Add Windows certificate"
         id: write_file
-        uses: TryQuiet/base64-to-file@main
+        uses: TryQuiet/base64-to-file@64eeb40ad3514f57de3a7dee92aee10fd42452c1 # main
         with:
           fileName: 'win-certificate.pfx'
           encodedString: ${{ secrets.WIN_CSC_LINK }}
@@ -208,7 +208,7 @@ jobs:
 
       # - name: E2E - Extract version
       #   id: extract_version
-      #   uses: Saionaro/[email protected]
+      #   uses: Saionaro/extract-package-version@de8268c348d3a9ed3514c86a9ad8d4568ab8b49e # v1.1.1
       #   with:
       #     path: packages/desktop
 
@@ -259,23 +259,23 @@ jobs:
 
       - name: Get release
         id: get_release
-        uses: bruceadams/[email protected]
+        uses: bruceadams/get-release@3a8733307b85cd96d52772b037617bd63d99522e # v1.2.3
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Extract version
         id: extract_version
-        uses: Saionaro/[email protected]
+        uses: Saionaro/extract-package-version@de8268c348d3a9ed3514c86a9ad8d4568ab8b49e # v1.1.1
         with:
           path: packages/desktop
 
 
       - name: Upload Release Assets
-        uses: actions/[email protected]
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
           upload_url: ${{ steps.get_release.outputs.upload_url }}
           asset_path: ./packages/desktop/dist/Quiet Setup ${{ steps.extract_version.outputs.version}}.exe
           asset_name: Quiet Setup ${{ steps.extract_version.outputs.version}}.exe
-          asset_content_type: application/.exe
+          asset_content_type: application/.exe

.github/workflows/check-visual-regression.yml

@@ -17,7 +17,7 @@ jobs:
       - name: "Print OS"
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
         with:
           fetch-depth: 0 # Required to retrieve git history
 
@@ -27,8 +27,8 @@ jobs:
           bootstrap-packages: "@quiet/eslint-config,@quiet/logger,@quiet/common,@quiet/types,@quiet/state-manager,@quiet/backend,@quiet/identity,quiet,backend-bundle"
 
       - name: "Publish to Chromatic"
-        uses: chromaui/action@v1
+        uses: chromaui/action@355e2a05a179e9e89c2b237dcd55adbeb89e577e # v1
         with:
           workingDir: ./packages/desktop
           token: ${{ secrets.GH_TOKEN }}
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}

.github/workflows/check.yml

@@ -16,7 +16,7 @@ jobs:
       - name: "Print OS"
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: "Remove test files workaround (jest types conflicting with cypress types)"
         if: ${{ runner.os == 'Windows' }}
@@ -38,4 +38,4 @@ jobs:
 
       - name: "Lint"
         if: ${{ runner.os != 'Windows' }}
-        run: lerna run lint-ci --stream
+        run: lerna run lint-ci --stream

.github/workflows/deploy-android.yaml

@@ -19,16 +19,16 @@ jobs:
       - name: "Print OS"
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: "Set up JDK"
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2 # v3.12.0
         with:
           distribution: 'temurin'
           java-version: 11
 
       - name: "Set up NDK"
-        uses: nttld/setup-ndk@v1
+        uses: nttld/setup-ndk@8c3b609ff4d54576ea420551943fd34b4d03b0dc # v1.2.0
         id: setup-ndk
         with:
           ndk-version: r21e
@@ -64,7 +64,7 @@ jobs:
         run: cd ./packages/mobile/android && ENVFILE=../.env.production ./gradlew bundleStandardRelease
 
       - name: "Upload Artifact"
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
         with:
           name: app-standard-release.aab
           path: ./packages/mobile/android/app/build/outputs/bundle/standardRelease/app-standard-release.aab
@@ -77,12 +77,12 @@ jobs:
           echo ${{ SECRETS.SERVICE_ACCOUNT_JSON }} | base64 --decode > google-play.json
 
       - name: "Upload to Google Play"
-        uses: r0adkll/[email protected]
+        uses: r0adkll/upload-google-play@7f42989517f00091bb49ec7cf5c68b673bf01205 # v1.0.17
         with:
           serviceAccountJson: google-play.json
           packageName: com.quietmobile
           releaseFiles: ./packages/mobile/android/app/build/outputs/bundle/standardRelease/app-standard-release.aab
           status: completed
           track: internal
           whatsNewDirectory: distribution/whatsnew
-          changesNotSentForReview: true
+          changesNotSentForReview: true

.github/workflows/deploy-ios.yml

@@ -19,15 +19,15 @@ jobs:
       - name: "Print OS"
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
         with:
           lfs: true
 
       - name: Install gpg
         run: brew install gnupg
 
       - name: Setup XCode
-        uses: maxim-lobanov/setup-xcode@v1
+        uses: maxim-lobanov/setup-xcode@9a697e2b393340c3cacd97468baa318e4c883d98 # v1.5.1
         with:
           xcode-version: '14.2'
 
@@ -70,7 +70,7 @@ jobs:
             -exportPath build/
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
         with:
           name: Quiet.ipa
           path: ./packages/mobile/ios/build/Quiet.ipa
@@ -87,4 +87,4 @@ jobs:
             --verbose
         env:
           APPSTORE_USER: ${{ secrets.APPSTORE_USER }}
-          APPSTORE_PASSWORD: ${{ secrets.APPSTORE_PASSWORD }}
+          APPSTORE_PASSWORD: ${{ secrets.APPSTORE_PASSWORD }}

.github/workflows/e2e-linux.yml

@@ -18,7 +18,7 @@ jobs:
       TEST_MODE: true
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: Install WM
         run: sudo apt install fluxbox
@@ -47,21 +47,21 @@ jobs:
         run: chmod +x $FILE_NAME
 
       - name: Run one client test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 15
           max_attempts: 3
           command: cd packages/e2e-tests && npm run test oneClient.test.ts
 
       - name: Run two clients test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 25
           max_attempts: 3
           command: cd packages/e2e-tests && npm run test twoClients.test.ts
 
       - name: Run invitation link test - Includes 2 separate application clients
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 25
           max_attempts: 1
@@ -76,7 +76,7 @@ jobs:
         run: chmod +x Quiet-1.2.0.AppImage
 
       - name: Run Backwards Compatibility test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 15
           max_attempts: 3

.github/workflows/e2e-mac.yml

@@ -11,7 +11,7 @@ jobs:
       IS_E2E: true
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: "Setup environment"
         uses: ./.github/actions/setup-env
@@ -48,24 +48,22 @@ jobs:
         run: cd ~ && cp -R "/Volumes/Quiet $VERSION/Quiet.app" /Applications
 
       - name: Run invitation link test - Includes 2 separate application clients
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 25
           max_attempts: 3
           command: cd packages/e2e-tests && npm run test invitationLink.test.ts
 
       - name: Run one client test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 15
           max_attempts: 3
           command: cd packages/e2e-tests && npm run test oneClient.test.ts
 
       - name: Run two clients test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 25
           max_attempts: 3
           command: cd packages/e2e-tests && npm run test twoClients.test.ts
-
-

.github/workflows/e2e-win.yml

@@ -13,7 +13,7 @@ jobs:
       E2E: true
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: "Setup environment"
         uses: ./.github/actions/setup-env
@@ -41,7 +41,7 @@ jobs:
 
       - name: Extract version
         id: extract_version
-        uses: Saionaro/[email protected]
+        uses: Saionaro/extract-package-version@de8268c348d3a9ed3514c86a9ad8d4568ab8b49e # v1.1.1
         with:
           path: packages/desktop
 
@@ -56,7 +56,7 @@ jobs:
         shell: bash
 
       - name: "Upload built app"
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
         with:
           name: quiet-windows
           path: ./packages/desktop/dist/Quiet Setup ${{ steps.extract_version.outputs.version }}.exe
@@ -80,23 +80,23 @@ jobs:
         shell: powershell
 
       - name: Run one client test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 15
           max_attempts: 3
           shell: bash
           command: cd packages/e2e-tests && npm run test oneClient.test.ts
 
       - name: Run two clients test
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 30
           max_attempts: 3
           shell: bash
           command: cd packages/e2e-tests && npm run test twoClients.test.ts
 
       - name: Run invitation link test - Includes 2 separate application clients
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
         with:
           timeout_minutes: 25
           max_attempts: 3