Pin all dependencies, verify checksums and harden GitHub actions

.github/workflows/benchmarks.yml

@@ -11,13 +11,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '21'
-          distribution: 'adopt'
+          distribution: 'temurin'
 
       - name: Build with Gradle
         working-directory: ./
@@ -27,7 +29,7 @@ jobs:
           make build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pkg-build
           path: ./
@@ -42,14 +44,14 @@ jobs:
         java-version: [ 17, 18, 19, 20, 21 ]
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pkg-build
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version:  ${{ matrix.java-version }}
-          distribution: 'adopt'
+          distribution: 'temurin'
       - name: Start mock server
         working-directory: ./end2end/server
         run: |

.github/workflows/end2end.yml

@@ -11,13 +11,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '21'
-          distribution: 'adopt'
+          distribution: 'temurin'
 
       - name: Build with Gradle
         working-directory: ./
@@ -27,7 +29,7 @@ jobs:
           make build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pkg-build
           path: ./
@@ -50,20 +52,20 @@ jobs:
           - { name: SpringBoot2.7Postgres, test_file: end2end/spring_boot_2.7_postgres.py, db: postgres_database }
           - { name: SpringBootHyperSQL, test_file: end2end/spring_boot_hypersql.py, db: "" }
         java-version: [17, 18, 19, 20, 21, 24, 25]
-        distribution: ['adopt', 'corretto', 'oracle']
+        distribution: ['temurin', 'corretto', 'oracle']
         exclude:
           # Spring Boot 2.7 uses the legacy javax stack and does not support JDK 25;
           # keep this app on Java 17-24 only (its javax coverage stays exercised there).
           - app: { name: SpringBoot2.7Postgres, test_file: end2end/spring_boot_2.7_postgres.py, db: postgres_database }
             java-version: 25
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pkg-build
 
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ matrix.java-version }}
           distribution: ${{ matrix.distribution }}

.github/workflows/gradle-security.yml

@@ -0,0 +1,25 @@
+name: Gradle Wrapper Validation
+
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+
+permissions:
+    contents: read
+
+# Dependency checksums and lockfiles are enforced by Gradle
+# Only the wrapper jar itself cannot be verified by Gradle, so it is checked here.
+jobs:
+    wrapper-validation:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Check out code
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false
+
+            # Verifies gradle/wrapper/gradle-wrapper.jar against checksums of official Gradle releases
+            - name: Validate Gradle wrapper
+              uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

.github/workflows/gradle-tests.yml

@@ -14,13 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '21'
-          distribution: 'adopt'
+          distribution: 'temurin'
 
       - name: Build with Gradle
         working-directory: ./
@@ -30,7 +32,7 @@ jobs:
           make build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pkg-build
           path: ./
@@ -42,16 +44,16 @@ jobs:
     strategy:
       matrix:
         java-version: [17, 18, 19, 20, 21, 24, 25]
-        distribution: ['adopt', 'corretto', 'oracle']
+        distribution: ['temurin', 'corretto', 'oracle']
 
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pkg-build
 
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ matrix.java-version }}
           distribution: ${{ matrix.distribution }}
@@ -85,7 +87,7 @@ jobs:
 
       - name: Upload coverage report to Codecov
         if: matrix.java-version == '21'  # Only upload coverage for Java 21
-        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           fail_ci_if_error: true
           files: ./agent_api/build/jacoco/test/jacocoTestReport.xml

.github/workflows/opentel.yml

@@ -11,13 +11,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '21'
-          distribution: 'adopt'
+          distribution: 'temurin'
 
       - name: Build with Gradle
         working-directory: ./
@@ -27,7 +29,7 @@ jobs:
           make build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pkg-build
           path: ./
@@ -41,15 +43,15 @@ jobs:
         java-version: [17, 18, 19, 20, 21]
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pkg-build
 
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ matrix.java-version }}
-          distribution: 'adopt'
+          distribution: 'temurin'
 
       - name: Start mock server
         working-directory: ./end2end/server
@@ -91,15 +93,15 @@ jobs:
         agent-order: [runWithOpentel, runWithZenFirstOpentel]
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pkg-build
 
       - name: Set up JDK
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ matrix.java-version }}
-          distribution: 'adopt'
+          distribution: 'temurin'
 
       - name: Start mock server
         working-directory: ./end2end/server

.github/workflows/qa-tests.yml

@@ -11,20 +11,22 @@ jobs:
         timeout-minutes: 30
         steps:
             - name: Checkout firewall-java
-              uses: actions/checkout@v5
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   path: firewall-java
+                  persist-credentials: false
 
             - name: Checkout zen-demo-java
-              uses: actions/checkout@v5
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   repository: Aikido-demo-apps/zen-demo-java
                   path: zen-demo-java
                   ref: main
                   submodules: true
+                  persist-credentials: false
 
             - name: Set up JDK 21
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
               with:
                   java-version: '21'
                   distribution: 'temurin'

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - "v*"
 
+permissions:
+      contents: read
+
 jobs:
   extract-version:
     runs-on: ubuntu-latest
@@ -23,14 +26,19 @@ jobs:
     runs-on: open-source-releaser
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Set the version for this release
-        run: make replace_version version=${{ needs.extract-version.outputs.version }}
+        env:
+          RELEASE_VERSION: ${{ needs.extract-version.outputs.version }}
+        run: make replace_version version="$RELEASE_VERSION"
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '21'
-          distribution: 'adopt'
+          distribution: 'temurin'
       - name: Build with Gradle
         run: |
           chmod +x gradlew
@@ -46,7 +54,7 @@ jobs:
           shasum -a 256 zen.zip > zen.zip.sha256sum
           shasum -a 256 zen.tar.gz > zen.tar.gz.sha256sum
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-artifacts
           path: |
@@ -62,13 +70,16 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-artifacts
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           draft: true
           files: |

.github/workflows/smoke-tests.yml

@@ -6,6 +6,9 @@ on:
             - main
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     smoke-test-native:
         name: Smoke Test (${{ matrix.os }}, Java 21)
@@ -16,10 +19,12 @@ jobs:
                 os: [ubuntu-latest, macos-latest]
         steps:
             - name: Check out code
-              uses: actions/checkout@v4
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                persist-credentials: false
 
             - name: Set up JDK 21
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
               with:
                   java-version: '21'
                   distribution: 'temurin'
@@ -50,7 +55,9 @@ jobs:
                 ]
         steps:
             - name: Check out code
-              uses: actions/checkout@v4
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                persist-credentials: false
 
             - name: Build with Gradle (native)
               working-directory: ./