[Bug]: Workflow actions

[gcatanese]

Description

We have recently conducted a security scan of our GitHub repositories to ensure our CI/CD pipelines are secure. We identified misconfigurations in GitHub Actions workflows (e.g., injection risks, unpinned actions).

Steps to reproduce

Using tags like @v1, @master, or @latest allows the action code to change without your review. If the action author is compromised, your pipeline is compromised.
Pin to the immutable Commit SHA.

❌ Bad

uses: actions/checkout@v4

✅ Good

uses: actions/checkout@b4ffde6 # v4.1.1

All existing workflows shall be updated to pin the version of the actions to a specific commit SHA.

Actual behavior

No response

Expected behavior

Action versions must be pinned

Code snippet or screenshots (if applicable)

No response

Adyen Node API Library version

Lastest

Node.js version

22

NPM version

No response

Operating System

Windows

Additional context

No response