chore: modernize GitHub Actions

.github/workflows/PR_build_extension.yml

@@ -21,18 +21,19 @@ jobs:
     if: github.repository == 'prisma/language-tools'
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    outputs:
-      tag_name: ${{ steps.names.outputs.tag_name }}
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.branch }}
+          persist-credentials: false
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
 
       # Build the extension
@@ -52,7 +53,7 @@ jobs:
 
       # Upload to the current job run
       # This is very limited: Only 90 days rentention and cannot get a link easily
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pr-artifact
           path: ./packages/vscode/*.vsix

.github/workflows/bump_prisma.yml

@@ -58,16 +58,16 @@ jobs:
               ;;
           esac
           echo "ref=$REF" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.validate.outputs.ref }}
           persist-credentials: false
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '22'
+          node-version: '24'
           cache: 'pnpm'
       - name: Install Dependencies
         run: pnpm install
@@ -78,7 +78,7 @@ jobs:
       - name: Update the lockfile
         run: pnpm install --no-frozen-lockfile
       - name: Upload the pinned manifests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pinned-manifests
           path: |
@@ -95,20 +95,23 @@ jobs:
       REF: ${{ needs.pin.outputs.ref }}
       PRISMA_VERSION: ${{ inputs.prisma_version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.pin.outputs.ref }}
-          token: ${{ secrets.PRISMA_BOT_TOKEN }}
+          persist-credentials: false
       - name: Download the pinned manifests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pinned-manifests
       - name: Commit and push
+        env:
+          GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }}
         run: |
           if git diff --quiet; then
             echo "Dependencies are already pinned to $PRISMA_VERSION, nothing to commit."
             exit 0
           fi
           sh scripts/set_git_credentials.sh
           git commit -am "bump Prisma CLI to $PRISMA_VERSION"
+          gh auth setup-git
           git push origin "HEAD:$REF"

.github/workflows/check_for_prisma_update.yml

@@ -36,16 +36,16 @@ jobs:
       latest_version: ${{ steps.check_update.outputs.latest_version }}
       patch_dev_version: ${{ steps.check_update.outputs.patch-dev_version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           persist-credentials: false
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '22'
+          node-version: '24'
           cache: 'pnpm'
       - name: Install Dependencies
         run: pnpm install
@@ -64,14 +64,17 @@ jobs:
       LATEST_VERSION: ${{ needs.check.outputs.latest_version }}
       PATCH_DEV_VERSION: ${{ needs.check.outputs.patch_dev_version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
-          token: ${{ secrets.PRISMA_BOT_TOKEN }}
           fetch-depth: 0 # patch branches are created from release tags
+          persist-credentials: false
       - name: Record new versions
+        env:
+          GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }}
         run: |
           sh scripts/set_git_credentials.sh
+          gh auth setup-git
           if [ -n "$DEV_VERSION" ]; then echo "$DEV_VERSION" > scripts/versions/prisma_dev; fi
           if [ -n "$LATEST_VERSION" ]; then echo "$LATEST_VERSION" > scripts/versions/prisma_latest; fi
           if [ -n "$PATCH_DEV_VERSION" ]; then echo "$PATCH_DEV_VERSION" > scripts/versions/prisma_patch-dev; fi
@@ -80,6 +83,8 @@ jobs:
       - name: Create the patch branch if it is new
         id: patch_branch
         if: needs.check.outputs.patch_dev_version
+        env:
+          GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }}
         run: |
           BRANCH=$(node scripts/setup_branch.mjs patch-dev)
           if [ -z "$(git ls-remote --heads origin "$BRANCH")" ]; then

.github/workflows/codeql-analysis.yml

@@ -30,11 +30,13 @@ jobs:
         language: ['javascript']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -43,4 +45,4 @@ jobs:
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

.github/workflows/continuous-integration.yml

@@ -32,17 +32,21 @@ jobs:
     name: Tests + Shellcheck
     runs-on: ${{ matrix.os }}
     timeout-minutes: 25
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '22'
+          node-version: '24'
           cache: 'pnpm'
       - name: Install Dependencies
         run: pnpm install
@@ -55,7 +59,7 @@ jobs:
       - name: Run unit tests in all packages
         run: pnpm test
       - name: Run VS Code extension E2E tests in headless mode
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: pnpm test:e2e
 
@@ -66,15 +70,15 @@ jobs:
           npx playwright install chromium
 
       - name: Run Playwright UI tests
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: pnpm test:playwright
           working-directory: packages/vscode
         env:
           CI: true
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
         with:
           name: playwright-report-${{ matrix.os }}
@@ -87,7 +91,7 @@ jobs:
       - name: Catch version incompatibilities
         if: matrix.os == 'ubuntu-latest'
         run: pnpm test:scripts
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./scripts/__tests__/coverage/clover.xml,./packages/language-server/coverage/clover.xml
           flags: ${{ matrix.os }}

.github/workflows/e2e_check_for_new_published_vsix.yml

@@ -8,21 +8,24 @@ on:
   #   - cron: '*/10 * * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check-version:
     name: Check for new version
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ secrets.PRISMA_BOT_TOKEN }}
+          persist-credentials: false
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
       - name: Install Dependencies
         run: pnpm install
@@ -32,18 +35,21 @@ jobs:
           node scripts/e2eTestsOnVsix/check_marketplace_version.mjs
       - name: Check new release of stable and Insider
         id: check_published_version
+        env:
+          INSIDER_VERSION: ${{ steps.versions.outputs.insider_version }}
+          STABLE_VERSION: ${{ steps.versions.outputs.stable_version }}
         run: |
-          node scripts/e2eTestsOnVsix/check_for_new_release.mjs ${{ steps.versions.outputs.insider_version }} ${{ steps.versions.outputs.stable_version }}
+          node scripts/e2eTestsOnVsix/check_for_new_release.mjs "$INSIDER_VERSION" "$STABLE_VERSION"
       - name: Trigger e2e tests for Insider
         if: ${{ steps.check_published_version.outputs.new_insider_version }}
-        uses: benc-uk/workflow-dispatch@v1
+        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1.3.3
         with:
           workflow: E2E tests after release on VSIX
           token: ${{ secrets.PRISMA_BOT_TOKEN }}
           inputs: '{ "extension_type": "insider", "extension_version": "${{ steps.check_published_version.outputs.new_insider_version }}" }'
       - name: Trigger e2e tests for stable
         if: ${{ steps.check_published_version.outputs.new_stable_version }}
-        uses: benc-uk/workflow-dispatch@v1
+        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1.3.3
         with:
           workflow: E2E tests after release on VSIX
           token: ${{ secrets.PRISMA_BOT_TOKEN }}

.github/workflows/e2e_published_vsix.yml

@@ -11,8 +11,13 @@ on:
         description: 'VS Code extension version'
         required: true
 
+permissions:
+  contents: read
+
 env:
   ENVIRONMENT: ${{ secrets.ENVIRONMENT }}
+  EXTENSION_TYPE: ${{ inputs.extension_type }}
+  EXTENSION_VERSION: ${{ inputs.extension_version }}
   # * Enables github logging
   # ACTIONS_STEP_DEBUG: true
 
@@ -28,41 +33,43 @@ jobs:
     outputs:
       installed-extension: ${{ steps.install.outputs.installed-extension }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ secrets.PRISMA_BOT_TOKEN }}
+          persist-credentials: false
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
       - name: Install Dependencies
         run: pnpm install
       - name: Install extension via CLI
         id: install
         run: |
-          node scripts/e2eTestsOnVsix/install_extension.mjs ${{ github.event.inputs.extension_type }} ${{ github.event.inputs.extension_version }}
+          node scripts/e2eTestsOnVsix/install_extension.mjs "$EXTENSION_TYPE" "$EXTENSION_VERSION"
       - name: Run test
         if: ${{ steps.install.outputs.installed-extension }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
-          run: pnpm test:e2e:vsix ${{ github.event.inputs.extension_type }} ${{ matrix.os }} ${{ github.event.inputs.extension_version }}
+          run: pnpm test:e2e:vsix "$EXTENSION_TYPE" "${{ matrix.os }}" "$EXTENSION_VERSION"
 
   after-test:
     name: Bump tested version and commit # scripts/versions/tested_extension_stable & tested_extension_insider
     runs-on: ubuntu-latest
     needs: [test]
     if: always()
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ secrets.PRISMA_BOT_TOKEN }}
+          persist-credentials: false
       - name: echo new version
-        run: echo ${{ needs.test.outputs.installed-extension }}
+        env:
+          INSTALLED_EXTENSION: ${{ needs.test.outputs.installed-extension }}
+        run: echo "$INSTALLED_EXTENSION"
       - name: Bump version
         if: ${{needs.test.result == 'success' && needs.test.outputs.installed-extension }}
-        run: pnpm test:e2e:bump ${{ github.event.inputs.extension_type }} ${{ github.event.inputs.extension_version }}
+        run: pnpm test:e2e:bump "$EXTENSION_TYPE" "$EXTENSION_VERSION"
         env:
           GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }} # Needed and used in the shell script behind test:bump

.github/workflows/pr-code-security.yml

@@ -7,8 +7,8 @@ on:
 jobs:
   secret-detection:
     name: Secret Detection
-    uses: prisma/.github/.github/workflows/secret_detection.yml@main
+    uses: prisma/.github/.github/workflows/secret_detection.yml@7e808313ce87dfbd166654e9819606097a68d8c8 # main (2026-05-26)
     secrets: inherit
   code-scanning:
     name: Code Scanning
-    uses: prisma/.github/.github/workflows/code_scanning.yml@main
+    uses: prisma/.github/.github/workflows/code_scanning.yml@7e808313ce87dfbd166654e9819606097a68d8c8 # main (2026-05-26)