Set github actions to use commit hashes (#8852)

Author: hsubox76

.github/workflows/check-changeset.yml

@@ -57,22 +57,25 @@ jobs:
     - name: Print blocking failure status
       run: echo "${{steps.check-changeset.outputs.BLOCKING_FAILURE}}"
     - name: Find Comment
-      uses: peter-evans/find-comment@v3
+      # This commit represents v3.1.0
+      uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e
       id: fc
       with:
         issue-number: ${{github.event.number}}
         body-includes: Changeset File Check
     - name: Create comment (missing packages)
       if: ${{!steps.fc.outputs.comment-id && steps.check-changeset.outputs.CHANGESET_ERROR_MESSAGE}}
-      uses: peter-evans/create-or-update-comment@v4
+      # This commit represents v4.0.0
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
       with:
         issue-number: ${{github.event.number}}
         body: |
           ### Changeset File Check :warning:
           ${{steps.check-changeset.outputs.CHANGESET_ERROR_MESSAGE}}
     - name: Update comment (missing packages)
       if: ${{steps.fc.outputs.comment-id && steps.check-changeset.outputs.CHANGESET_ERROR_MESSAGE}}
-      uses: peter-evans/create-or-update-comment@v4
+      # This commit represents v4.0.0
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
       with:
         comment-id: ${{steps.fc.outputs.comment-id}}
         edit-mode: replace
@@ -81,7 +84,8 @@ jobs:
           ${{steps.check-changeset.outputs.CHANGESET_ERROR_MESSAGE}}
     - name: Update comment (no missing packages)
       if: ${{steps.fc.outputs.comment-id && !steps.check-changeset.outputs.CHANGESET_ERROR_MESSAGE}}
-      uses: peter-evans/create-or-update-comment@v4
+      # This commit represents v4.0.0
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
       with:
         comment-id: ${{steps.fc.outputs.comment-id}}
         edit-mode: replace

.github/workflows/check-vertexai-responses.yml

@@ -35,14 +35,16 @@ jobs:
           echo "latest_tag=$LATEST" >> $GITHUB_ENV
         working-directory: packages/vertexai/test-utils/vertexai-sdk-test-data
       - name: Find comment from previous run if exists
-        uses: peter-evans/find-comment@v3
+        # This commit represents v3.1.0
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e
         id: fc
         with:
           issue-number: ${{github.event.number}}
           body-includes: Vertex AI Mock Responses Check
       - name: Comment on PR if newer version is available
         if: ${{env.cloned_tag != env.latest_tag && !steps.fc.outputs.comment-id}}
-        uses: peter-evans/create-or-update-comment@v4
+        # This commit represents v4.0.0
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
         with:
           issue-number: ${{github.event.number}}
           body: >

.github/workflows/health-metrics-pull-request.yml

@@ -42,10 +42,12 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22.10.0
-      - uses: 'google-github-actions/auth@v0'
+      # This commit represents v0.8.3
+      - uses: 'google-github-actions/auth@c4799db9111fba4461e9f9da8732e5057b394f72'
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
-      - uses: google-github-actions/setup-gcloud@v2
+      # This commit represents v2.1.4
+      - uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a
       - run: yarn install
       - run: yarn build
       - name: Run health-metrics/binary-size test
@@ -59,10 +61,12 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22.10.0
-      - uses: 'google-github-actions/auth@v0'
+        # This commit represents v0.8.3
+      - uses: 'google-github-actions/auth@c4799db9111fba4461e9f9da8732e5057b394f72'
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
-      - uses: google-github-actions/setup-gcloud@v2
+      # This commit represents v2.1.4
+      - uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a
       - run: yarn install
       - run: yarn build
       - name: Run health-metrics/modular-exports-binary-size test

.github/workflows/health-metrics-release.yml

@@ -23,11 +23,14 @@ jobs:
     name: Release Diffing
     runs-on: ubuntu-latest
     steps:
-      - uses: 'google-github-actions/auth@v0'
+      # This commit represents v0.8.3
+      - uses: 'google-github-actions/auth@c4799db9111fba4461e9f9da8732e5057b394f72'
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
-      - uses: google-github-actions/setup-gcloud@v2
-      - uses: FirebaseExtended/github-actions/health-metrics/release-diffing@master
+      # This commit represents v2.1.4
+      - uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a
+      # This commit represents v1.4
+      - uses: FirebaseExtended/github-actions/health-metrics/release-diffing@41c787c37157e4c5932b951e531c041efa5bb7a4
         with:
           repo: ${{ github.repository }}
           ref: ${{ github.ref }}

.github/workflows/merge-release-branch.yml

@@ -33,15 +33,17 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
-    - uses: 'google-github-actions/auth@v0'
+    # This commit represents v0.8.3
+    - uses: 'google-github-actions/auth@c4799db9111fba4461e9f9da8732e5057b394f72'
       if: ${{ fromJSON(env.run_terraform_steps) }}
       with:
         credentials_json: '${{ secrets.JSSDK_ACTIONS_SA_KEY }}'
 
     # create composite indexes with Terraform
     - name: Setup Terraform
       if: ${{ fromJSON(env.run_terraform_steps) }}
-      uses: hashicorp/setup-terraform@v2
+      # This commit represents v3.1.2
+      uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
     - name: Terraform Init
       if: ${{ fromJSON(env.run_terraform_steps) }}
       run: |