chore(ci): harden the build and release supply chain (#1631)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/fair-falcons-attend.md

@@ -0,0 +1,4 @@
+---
+---
+
+No release note: updates CI and build dependencies without changing shipped behavior.

.github/workflows/cd-docs-teardown.yml

@@ -36,15 +36,15 @@ jobs:
         continue-on-error: true
 
       - name: Update PR comment
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: docs-preview
           message: |
             ## 📚 Documentation Preview
 
             ~~Preview has been removed~~ (PR closed)
       - name: Update Storybook PR comment
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: storybook-preview
           message: |

.github/workflows/cd-docs.yml

@@ -105,7 +105,7 @@ jobs:
         env:
           SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
         run: ./node_modules/.bin/surge ./docs-build "$PREVIEW_URL" --token "$SURGE_TOKEN"
-      - uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: docs-preview
           message: |
@@ -149,8 +149,8 @@ jobs:
         with:
           name: docs-build-production
           path: docs-build
-      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: docs-build
       - id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/ci-security-scan.yml

@@ -42,14 +42,14 @@ jobs:
       - name: Upload Trivy results
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: "trivy-results.sarif"
 
       - name: Secret detection
         id: secrets
         continue-on-error: true
-        uses: trufflesecurity/trufflehog@7c0734f987ad0bb30ee8da210773b800ee2016d3 # v3.93.4
+        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b # v3.97.1
         with:
           path: ./
           base: ${{ github.event_name == 'pull_request' && github.base_ref || '' }}

.github/workflows/ci-tests.yml

@@ -198,7 +198,7 @@ jobs:
         if: >-
           success() &&
           (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: chromaui/action@1cfa065cbdab28f6ca3afaeb3d761383076a35aa # v11
+        uses: chromaui/action@4cc98810d00b34b8f9e89d454d64a8ac3d088340 # v18.7.1
         with:
           projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
           workingDir: webapp
@@ -224,7 +224,7 @@ jobs:
         run: ./node_modules/.bin/surge ./webapp/storybook-static "$PREVIEW_URL" --token "$SURGE_TOKEN"
       - name: Add Storybook preview to the pull request
         if: steps.storybook_preview.outcome == 'success'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: storybook-preview
           message: |

.github/workflows/cicd.yml

@@ -330,7 +330,7 @@ jobs:
     if: always()
     steps:
       - name: Generate workflow timeline
-        uses: Kesin11/actions-timeline@7c7e0821d38f27460f4a71ef874a1c8cf23602e4 # v2
+        uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
           show-waiting-runner: true
 

.github/workflows/cleanup-preview.yml

@@ -77,7 +77,7 @@ jobs:
         # Always overwrites the sticky comment, closed pull requests included: a torn-down preview
         # must never leave a live-looking link behind.
         if: always() && steps.tombstone.outcome == 'success'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: app-preview
           number: ${{ github.event.pull_request.number }}

.github/workflows/deploy-preview.yml

@@ -62,7 +62,7 @@ jobs:
 
       - name: Explain why the preview did not deploy
         if: steps.context.outputs.announce == 'true'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: app-preview
           number: ${{ steps.context.outputs.pr_number }}
@@ -110,7 +110,7 @@ jobs:
 
       - name: Announce the deployment
         if: steps.github_deployment.outputs.deployment_id != ''
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: app-preview
           number: ${{ steps.context.outputs.pr_number }}
@@ -167,7 +167,7 @@ jobs:
 
       - name: Publish the preview link
         if: steps.finalize.outputs.final_state == 'success'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: app-preview
           number: ${{ steps.context.outputs.pr_number }}
@@ -185,7 +185,7 @@ jobs:
           steps.context.outputs.eligible == 'true' &&
           steps.recheck.outputs.opted_out != 'true' &&
           steps.wait.outputs.state != 'success'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: app-preview
           number: ${{ steps.context.outputs.pr_number }}

.github/workflows/pull-request.yml

@@ -49,14 +49,14 @@ jobs:
         continue-on-error: true
 
       - name: "Comment on PR with validation error"
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: steps.commitlint.outcome == 'failure'
         with:
           header: pr-title-lint-error
           path: ${{ runner.temp }}/commitlint-comment.md
 
       - name: "Remove error comment on success"
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: steps.commitlint.outcome == 'success'
         with:
           header: pr-title-lint-error
@@ -74,7 +74,7 @@ jobs:
       pull-requests: write
     if: github.event.action == 'opened'
     steps:
-      - uses: technote-space/assign-author@9558557c5c4816f38bd06176fbc324ba14bb3160 # v1
+      - uses: technote-space/assign-author@9558557c5c4816f38bd06176fbc324ba14bb3160 # v1.6.2
 
   labeler:
     name: "Apply labels"
@@ -87,12 +87,12 @@ jobs:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           configuration-path: .github/labeler.yml
 
       - name: "Apply size and semantic labels"
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { default: labelPullRequest } = await import(

.github/workflows/release.yml

@@ -347,7 +347,7 @@ jobs:
           cat subjects.sha256
 
       - name: Attest release image lock
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-checksums: subjects.sha256
           predicate-type: https://in-toto.io/attestation/release/v0.1