From 8f0d2cd5f13457d8c73af1bd822d26b22b5c3ad8 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 14:18:12 +0700
Subject: [PATCH 01/15] Update actions versions in deptrac.yml workflow

---
 .github/workflows/deptrac.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deptrac.yml b/.github/workflows/deptrac.yml
index a46702a..0726351 100644
--- a/.github/workflows/deptrac.yml
+++ b/.github/workflows/deptrac.yml
@@ -34,10 +34,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc
         with:
           php-version: '8.1'
           tools: composer
@@ -50,7 +50,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}
@@ -60,7 +60,7 @@ jobs:
         run: mkdir -p build/
 
       - name: Cache Deptrac results
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: build
           key: ${{ runner.os }}-deptrac-${{ github.sha }}

From 22e4f683b1dacc75e708a9591827cf4ac017cd0a Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 14:24:59 +0700
Subject: [PATCH 02/15] Update GitHub Actions workflow dependencies

---
 .github/workflows/infection.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/infection.yml b/.github/workflows/infection.yml
index f6a4ddd..5aac1f3 100644
--- a/.github/workflows/infection.yml
+++ b/.github/workflows/infection.yml
@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc
         with:
           php-version: '8.2'
           tools: infection, phpunit
@@ -42,13 +42,13 @@ jobs:
         run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
 
       - name: Configure matchers
-        uses: mheap/phpunit-matcher-action@v1
+        uses: mheap/phpunit-matcher-action@dcbd4ead41890163b65d0b21534387ce72980ee5
 
       - name: Get composer cache directory
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}

From 9b05efd3ca156772d7208d570515b07335a1d1ef Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 14:37:03 +0700
Subject: [PATCH 03/15] Update deptrac.yml

---
 .github/workflows/deptrac.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deptrac.yml b/.github/workflows/deptrac.yml
index 0726351..19210e2 100644
--- a/.github/workflows/deptrac.yml
+++ b/.github/workflows/deptrac.yml
@@ -34,10 +34,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.1'
           tools: composer
@@ -50,7 +50,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}
@@ -60,7 +60,7 @@ jobs:
         run: mkdir -p build/
 
       - name: Cache Deptrac results
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: build
           key: ${{ runner.os }}-deptrac-${{ github.sha }}

From d6105276c98c857b3917d31f2fd8130d2083b400 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:04:04 +0700
Subject: [PATCH 04/15] Update infection.yml

---
 .github/workflows/infection.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/infection.yml b/.github/workflows/infection.yml
index 5aac1f3..fa346a9 100644
--- a/.github/workflows/infection.yml
+++ b/.github/workflows/infection.yml
@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.2'
           tools: infection, phpunit
@@ -42,13 +42,13 @@ jobs:
         run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
 
       - name: Configure matchers
-        uses: mheap/phpunit-matcher-action@dcbd4ead41890163b65d0b21534387ce72980ee5
+        uses: mheap/phpunit-matcher-action@dcbd4ead41890163b65d0b21534387ce72980ee5 # v1.4.0
 
       - name: Get composer cache directory
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}

From f25eff7377361ebd40617bf39a216dcb25cf84b2 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:08:13 +0700
Subject: [PATCH 05/15] Update checkout action to specific commit version

---
 .github/workflows/label-add-conflict-all-pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/label-add-conflict-all-pr.yml b/.github/workflows/label-add-conflict-all-pr.yml
index 781febd..b51fc02 100644
--- a/.github/workflows/label-add-conflict-all-pr.yml
+++ b/.github/workflows/label-add-conflict-all-pr.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Get PR List
         id: PR-list

From 5b44bf323a0845a2da87e50ddbf815fd234a8854 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:09:43 +0700
Subject: [PATCH 06/15] Update actions versions in label-signing workflow

---
 .github/workflows/label-signing.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/label-signing.yml b/.github/workflows/label-signing.yml
index 685c8d9..b20a982 100644
--- a/.github/workflows/label-signing.yml
+++ b/.github/workflows/label-signing.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check signed commits in PR
-        uses: 1Password/check-signed-commits-action@v1
+        uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52 # v1.2.0
         with:
           comment: |
             You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See Developer's Certificate of Origin. See [signing][1].

From 8a2f2c96c3628c7fe1173f8d1b63e27698d3bdee Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:12:31 +0700
Subject: [PATCH 07/15] Update actions/checkout and shivammathur/setup-php
 versions

---
 .github/workflows/phpcpd.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/phpcpd.yml b/.github/workflows/phpcpd.yml
index edd4540..8448812 100644
--- a/.github/workflows/phpcpd.yml
+++ b/.github/workflows/phpcpd.yml
@@ -39,10 +39,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.1'
           tools: phpcpd

From 2b98c7e1ffa8de2fad0745b830770e6c0a1ab950 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:15:39 +0700
Subject: [PATCH 08/15] Update actions versions in phpcsfixer workflow

---
 .github/workflows/phpcsfixer.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/phpcsfixer.yml b/.github/workflows/phpcsfixer.yml
index c48c83d..83ce8a9 100644
--- a/.github/workflows/phpcsfixer.yml
+++ b/.github/workflows/phpcsfixer.yml
@@ -34,10 +34,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: json, tokenizer

From 7b50cf32b231e848cfde83038ab43fa03a26a78b Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:16:58 +0700
Subject: [PATCH 09/15] Update PHPStan workflow to use new action versions

---
 .github/workflows/phpstan.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index d493d5f..85c0db2 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -38,10 +38,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: phpstan, phpunit
@@ -54,7 +54,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}
@@ -64,7 +64,7 @@ jobs:
         run: mkdir -p build/phpstan
 
       - name: Cache PHPStan results
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: build/phpstan
           key: ${{ runner.os }}-phpstan-${{ github.sha }}

From 18d22e6268d0e3e465a3602988c12a462d99eafe Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:18:19 +0700
Subject: [PATCH 10/15] Update phpunit-lowest.yml

---
 .github/workflows/phpunit-lowest.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/phpunit-lowest.yml b/.github/workflows/phpunit-lowest.yml
index 01a7766..be76056 100644
--- a/.github/workflows/phpunit-lowest.yml
+++ b/.github/workflows/phpunit-lowest.yml
@@ -54,10 +54,10 @@ jobs:
         run: df -h
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: composer, phive, phpunit
@@ -70,7 +70,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-lowest-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}

From da90d6d19876a12ec63daeb3a2a0f42acd538745 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:21:47 +0700
Subject: [PATCH 11/15] Update phpunit-no-db.yml

---
 .github/workflows/phpunit-no-db.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/phpunit-no-db.yml b/.github/workflows/phpunit-no-db.yml
index 60e0df1..e0f63ae 100644
--- a/.github/workflows/phpunit-no-db.yml
+++ b/.github/workflows/phpunit-no-db.yml
@@ -42,10 +42,10 @@ jobs:
         run: df -h
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: composer, phive, phpunit
@@ -58,7 +58,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}

From 94aa8fb34f39c56010cfdf4cf7a7bec620924562 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:24:23 +0700
Subject: [PATCH 12/15] Update phpunit.yml

---
 .github/workflows/phpunit.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 813f718..54dda9a 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -132,10 +132,10 @@ jobs:
         run: sqlcmd -S 127.0.0.1 -U sa -P 1Secure*Password1 -Q "CREATE DATABASE test"
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: composer, phive, phpunit
@@ -148,7 +148,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}

From 82c1f001de779ac226d8f6b10b8252a9abbab698 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:26:04 +0700
Subject: [PATCH 13/15] Update actions versions in psalm.yml workflow

---
 .github/workflows/psalm.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml
index 5cae11c..a0875ce 100644
--- a/.github/workflows/psalm.yml
+++ b/.github/workflows/psalm.yml
@@ -34,10 +34,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.1'
           tools: phpstan, phpunit
@@ -50,7 +50,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}
@@ -60,7 +60,7 @@ jobs:
         run: mkdir -p build/psalm
 
       - name: Cache Psalm results
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: build/psalm
           key: ${{ runner.os }}-psalm-${{ github.sha }}

From 20b3cb21a1b0186d85bb258a8e20f16fcb7eeef7 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:27:32 +0700
Subject: [PATCH 14/15] Update actions versions in rector.yml workflow

---
 .github/workflows/rector.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/rector.yml b/.github/workflows/rector.yml
index b8f188c..4310094 100644
--- a/.github/workflows/rector.yml
+++ b/.github/workflows/rector.yml
@@ -38,10 +38,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: phpstan
@@ -54,7 +54,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}

From 0fc70bb99421ab19b057ff5b5b4a7d0df4f1fc48 Mon Sep 17 00:00:00 2001
From: Denny Septian Panggabean <97607754+ddevsr@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:28:33 +0700
Subject: [PATCH 15/15] Update action versions in unused.yml workflow

---
 .github/workflows/unused.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/unused.yml b/.github/workflows/unused.yml
index f770a2b..f65b960 100644
--- a/.github/workflows/unused.yml
+++ b/.github/workflows/unused.yml
@@ -32,10 +32,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.1'
           tools: composer, composer-unused
@@ -48,7 +48,7 @@ jobs:
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}-${{ hashFiles('**/composer.lock') }}