BUILD-9877 pin external action versions

actions/checkout v5.0.0
actions/setup-python v5.6.0

Author: julien-carsique-sonarsource

.cursor/cirrus-github-migration.md

@@ -73,7 +73,7 @@ Update this section when newer versions are released:
 
 #### Core GitHub Actions
 
-- [ ] `actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8`
+- [ ] `actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0`
 - [ ] `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2`
 - [ ] `actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0`
 
@@ -394,7 +394,7 @@ build_task:
 jobs:
   build:
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       # Step 1: Retrieve secrets from Vault
       - name: Vault
@@ -951,7 +951,7 @@ jobs:
   build:
     runs-on: github-ubuntu-latest-s
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - run: echo "Custom GitHub-hosted runner"
 ```
 
@@ -977,7 +977,7 @@ jobs:
   build:
     runs-on: sonar-m
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - run: echo "Private self-hosted (new generation)"
 ```
 
@@ -1192,7 +1192,7 @@ permissions:
 
 Standard order:
 
-1. `actions/checkout@v4`
+1. `actions/checkout`
 2. `jdx/mise-action` (tool setup)
 3. Build action (`build-maven@v1`, etc.)
 4. `promote@v1` (promote job only)

README.md

@@ -153,7 +153,7 @@ permissions:
   id-token: write
   contents: write
 steps:
-  - uses: actions/checkout@v5
+  - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
   - uses: SonarSource/ci-github-actions/config-maven@v1
   - run: mvn verify
 ```
@@ -254,7 +254,7 @@ permissions:
   id-token: write
   contents: write
 steps:
-  - uses: actions/checkout@v5
+  - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
   - uses: SonarSource/ci-github-actions/config-maven@v1
   - uses: SonarSource/ci-github-actions/build-maven@v1
 ```
@@ -363,7 +363,7 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: SonarSource/ci-github-actions/build-poetry@v1
         with:
           public: false                                        # Defaults to `true` if the repository is public
@@ -471,7 +471,7 @@ permissions:
   id-token: write
   contents: write
 steps:
-  - uses: actions/checkout@v5
+  - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
   - uses: SonarSource/ci-github-actions/config-gradle@v1
   - run: ./gradlew build
 ```
@@ -594,7 +594,7 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: SonarSource/ci-github-actions/build-gradle@v1
         with:
           # Enable shadow scans for unified platform dogfooding (optional)
@@ -890,7 +890,7 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: SonarSource/ci-github-actions/build-npm@v1
         with:
           # Enable shadow scans for unified platform dogfooding (optional)
@@ -1004,7 +1004,7 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: SonarSource/ci-github-actions/build-yarn@v1
         with:
           # Enable shadow scans for unified platform dogfooding (optional)
@@ -1086,8 +1086,8 @@ permissions:
   id-token: write
   contents: read
 steps:
-  - uses: actions/checkout@v5
-  - uses: actions/setup-python@v5
+  - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+  - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
     with:
       python-version: 3.12
   - uses: SonarSource/ci-github-actions/config-pip@v1