[Kichura]

setup-gradle, setup-java and docker's actions are immutable meaning they no longer need to be pinned, unfortunately checkout and upload-artifact still suffer from possible supply chain attacks whereas crowdin needs a new release to be considered immutable.

[RaphiMC]

Valid changes, but I will hold of with merging it, until all of the used actions have immutable releases

[Kichura]

Valid changes, but I will hold of with merging it, until all of the used actions have immutable releases

I don't think GitHub themselves will care about it given that they are known for ignoring people's warnings all together, especially the checkout's persist-credentials boolean.

[Kichura]

I don't think GitHub themselves will care about it given that they are known for ignoring people's warnings all together, especially the checkout's persist-credentials boolean.

Looked into v7.0.2 of upload-artifact and it's not immutable, so my theory is correct.

[RaphiMC]

Is there actually any reason to switch back to version tags for half of the actions, when dependabot is updating/maintaining them anyway?