Backport workflow-hardening fix (unpinned-uses) to 4 release branches

Summary

The default branch already hardened .github/workflows/nightly.yml against the issue(s) below, but 4 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

• https://github.com/edgedb/edgedb/commit/4920ab7dc9af41fa7fbae0e34d8868d1f8609254

Affected release branches (4)

• release-tag (still present as of HEAD bc532406)
• release/5.x (still present as of HEAD 3e7b97fb)
• release/4.x (still present as of HEAD aee9bc78)
• release/3.x (still present as of HEAD fb210d5c)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

File .github/workflows/nightly.yml; suggested edits:

• • jobs.$J.steps[uses=docker/build-push-action].uses = 'docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• ~ jobs.$J.steps[uses=docker/setup-buildx-action].uses : pin(docker/setup-buildx-action -> target_ref SHA)
• ~ jobs.$J.steps[uses=docker/setup-qemu-action].uses : pin(docker/setup-qemu-action -> target_ref SHA)

--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2597,8 +2597,7 @@
           echo "tags=${tags[*]}" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7  # v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345 # v3

File .github/workflows/nightly.yml; suggested edits:

• • jobs.$J.steps[uses=docker/build-push-action].uses = 'docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• ~ jobs.$J.steps[uses=docker/setup-buildx-action].uses : pin(docker/setup-buildx-action -> target_ref SHA)
• ~ jobs.$J.steps[uses=docker/setup-qemu-action].uses : pin(docker/setup-qemu-action -> target_ref SHA)

--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2615,8 +2615,7 @@
           echo "tags=${tags[*]}" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7  # v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345 # v3

File .github/workflows/nightly.yml; suggested edits:

• • jobs.$J.steps[uses=docker/build-push-action].uses = 'docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• ~ jobs.$J.steps[uses=docker/setup-buildx-action].uses : pin(docker/setup-buildx-action -> target_ref SHA)
• ~ jobs.$J.steps[uses=docker/setup-qemu-action].uses : pin(docker/setup-qemu-action -> target_ref SHA)

--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2723,11 +2723,9 @@
           echo "tags=${tags[*]}" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7  # v2
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55  # v2
       - name: Publish Docker Image (docker.io)
         uses: elgohr/Publish-Docker-Github-Action@43dc228e327224b2eda11c8883232afd5b34943b # v5
         with:

File .github/workflows/nightly.yml; suggested edits:

• • jobs.$J.steps[uses=docker/build-push-action].uses = 'docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=docker/login-action].uses = 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567'
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• • jobs.$J.steps[uses=elgohr/Publish-Docker-Github-Action].uses
• ~ jobs.$J.steps[uses=docker/setup-buildx-action].uses : pin(docker/setup-buildx-action -> target_ref SHA)
• ~ jobs.$J.steps[uses=docker/setup-qemu-action].uses : pin(docker/setup-qemu-action -> target_ref SHA)

--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2448,11 +2448,9 @@
           echo "tags=${tags[*]}" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7  # v2
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55  # v2
       - name: Publish Docker Image (docker.io)
         uses: elgohr/Publish-Docker-Github-Action@43dc228e327224b2eda11c8883232afd5b34943b # v5
         with:

Happy to open pull requests instead if that's preferred.