Pin dependencies

Author: renovate[bot]

.github/workflows/build.yml

@@ -20,11 +20,11 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: 2025.7.12
-      - uses: SonarSource/ci-github-actions/build-maven@v1
+          version: 2025.12.13
+      - uses: SonarSource/ci-github-actions/build-maven@e376b863d475fc797a611fef8689eb5b46420b1d # 1.8.5
         with:
           deploy-pull-request: true
           artifactory-reader-role: private-reader
@@ -41,9 +41,9 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: 2025.7.12
+          version: 2025.12.13
           cache_save: false
-      - uses: SonarSource/ci-github-actions/promote@v1
+      - uses: SonarSource/ci-github-actions/promote@e376b863d475fc797a611fef8689eb5b46420b1d # 1.8.5

.github/workflows/pr-cleanup.yml

@@ -10,4 +10,4 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: SonarSource/ci-github-actions/pr_cleanup@v1
+      - uses: SonarSource/ci-github-actions/pr_cleanup@e376b863d475fc797a611fef8689eb5b46420b1d # 1.8.5

.github/workflows/pre-commit.yml

@@ -8,7 +8,7 @@ jobs:
     name: "pre-commit"
     runs-on: github-ubuntu-latest-s
     steps:
-      - uses: SonarSource/gh-action_pre-commit@0ecedc4e4070444a95f6b6714ddc3ebcdde697c4 # 1.1.0
+      - uses: SonarSource/gh-action_pre-commit@ea734ef4ee748f680f3b4ac268c1ba90e245effc # 1.2.1
         with:
           extra-args: >
             --from-ref=origin/${{ github.event.pull_request.base.ref }}

.github/workflows/releasability.yaml

@@ -20,6 +20,6 @@ jobs:
       contents: read
     if: github.event.workflow_run.conclusion == 'success'
     steps:
-      - uses: SonarSource/gh-action_releasability/releasability-status@v3
+      - uses: SonarSource/gh-action_releasability/releasability-status@f6c1978d7b7642e57846be4823bb28ec9e7ff39b # 3.1.0
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       id-token: write
       contents: write
-    uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v7
+    uses: SonarSource/gh-action_release/.github/workflows/main.yaml@0c9c1cc54cbdd24258f135601d1b77cfc87e67ae # 7.4.0
     with:
       version: ${{ inputs.version }}
       publishToBinaries: false

.github/workflows/unified-dogfooding.yml

@@ -13,11 +13,11 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: 2026.6.1
-      - uses: SonarSource/ci-github-actions/build-maven@v1
+          version: 2026.7.7
+      - uses: SonarSource/ci-github-actions/build-maven@e376b863d475fc797a611fef8689eb5b46420b1d # 1.8.5
         with:
           run-shadow-scans: true
           artifactory-reader-role: private-reader