CI: move workflows/actions to actions (#104711)

* move workflows/actions to actions * rerun actions * fix setup-go v5 * unpinned unnecessary pins * update CODEOWONERS * update CODEOWONERS * remove remove-milestone from codeowners * remove bad key
3 weeks ago · 2436b4e097
parent 97d10b5095
commit 2436b4e097
51 changed files with 100 additions and 104 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -768,7 +768,6 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/backend-unit-tests.yml @grafana/grafana-backend-group
 /.github/workflows/backport.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/bump-version.yml @grafana/grafana-developer-enablement-squad
-/.github/workflows/close-milestone.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/release-pr.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/release-comms.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/migrate-prs.yml @grafana/grafana-developer-enablement-squad
@ -780,13 +779,11 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/detect-breaking-changes-* @grafana/plugins-platform-frontend
 /.github/workflows/documentation-ci.yml @grafana/docs-tooling
 /.github/workflows/deploy-pr-preview.yml @grafana/docs-tooling
-/.github/workflows/epic-add-to-platform-ux-parent-project.yml @meanmina
 /.github/workflows/feature-toggles-ci.yml @grafana/docs-tooling
 /.github/workflows/github-release.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/issue-opened.yml @grafana/grafana-community-support
 /.github/workflows/lint-build-docs.yml @grafana/docs-tooling
 /.github/workflows/metrics-collector.yml @torkelo
-/.github/workflows/milestone.yml @tolzhabayev
 /.github/workflows/pr-checks.yml @tolzhabayev
 /.github/workflows/pr-codeql-analysis-javascript.yml @DanCech
 /.github/workflows/pr-codeql-analysis-python.yml @DanCech
@ -797,11 +794,9 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/sync-mirror-event.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/publish-technical-documentation-next.yml @grafana/docs-tooling
 /.github/workflows/publish-technical-documentation-release.yml @grafana/docs-tooling
-/.github/workflows/remove-milestone.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/scripts/json-file-to-job-output.js @grafana/plugins-platform-frontend
 /.github/workflows/stale.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/storybook-verification.yml @grafana/grafana-frontend-platform
-/.github/workflows/update-changelog.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/update-make-docs.yml @grafana/docs-tooling
 /.github/workflows/scripts/kinds/verify-kinds.go @grafana/platform-monitoring
 /.github/workflows/publish-kinds-next.yml @grafana/platform-monitoring
@ -824,13 +819,15 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/go-lint.yml @grafana/grafana-backend-services-squad
 /.github/workflows/trivy-scan.yml @grafana/grafana-backend-services-squad
 /.github/workflows/changelog.yml @zserge
-/.github/workflows/actions/changelog @zserge
+/.github/actions/changelog @zserge
 /.github/workflows/pr-frontend-unit-tests.yml @grafana/grafana-frontend-platform
 /.github/workflows/frontend-lint.yml @grafana/grafana-frontend-platform
 /.github/workflows/analytics-events-report.yml @grafana/grafana-frontend-platform
 /.github/workflows/pr-e2e-tests.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/run-e2e-suite.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/skye-add-to-project.yml @grafana/grafana-frontend-platform
+/.github/workflows/zizmor.yml @grafana/grafana-developer-enablement-squad
+/.github/zizmor.yml @grafana/grafana-developer-enablement-squad

 # Generated files not requiring owner approval
 /packages/grafana-data/src/types/featureToggles.gen.ts @grafanabot
--- a/.github/workflows/actions/changelog/action.yml
+++ b/.github/workflows/actions/changelog/action.yml
--- a/.github/workflows/actions/changelog/index.js
+++ b/.github/workflows/actions/changelog/index.js
--- a/.github/workflows/actions/changelog/package.json
+++ b/.github/workflows/actions/changelog/package.json
--- a/.github/workflows/alerting-swagger-gen.yml
+++ b/.github/workflows/alerting-swagger-gen.yml
@ -10,7 +10,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          fetch-depth: 2
          persist-credentials: false
--- a/.github/workflows/alerting-update-module.yml
+++ b/.github/workflows/alerting-update-module.yml
@ -17,7 +17,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        uses: actions/checkout@v4 # 4.2.2
        with:
          persist-credentials: false
      - name: Check if update branch exists
--- a/.github/workflows/analytics-events-report.yml
+++ b/.github/workflows/analytics-events-report.yml
@ -8,12 +8,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Node.js
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'yarn'
--- a/.github/workflows/backend-code-checks.yml
+++ b/.github/workflows/backend-code-checks.yml
@ -1,5 +1,4 @@
 name: Backend Code Checks
-description: Validate go.mod and OpenAPI specifications

 on:
  pull_request:
@ -24,11 +23,11 @@ jobs:
    name: Validate Backend Configs
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          # Explicitly set Go version to 1.24.1 to ensure consistent OpenAPI spec generation
          # The crypto/x509 package has additional fields in Go 1.24.1 that affect the generated specs
--- a/.github/workflows/backend-unit-tests.yml
+++ b/.github/workflows/backend-unit-tests.yml
@ -32,11 +32,11 @@ jobs:
      id-token: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Generate Go code
@ -54,11 +54,11 @@ jobs:
      id-token: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Setup Enterprise
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        uses: actions/checkout@v4 # 4.2.2
        with:
          persist-credentials: false
      - run: git config --local user.name "github-actions[bot]"
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@ -21,7 +21,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Grafana
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Update package.json versions
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@ -73,7 +73,7 @@ jobs:
          app_id: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_ID }}
          private_key: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_PEM }}
      - name: "Checkout Grafana repo"
-        uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+        uses: "actions/checkout@v4"
        with:
          ref: main
          sparse-checkout: |
@ -86,7 +86,7 @@ jobs:
          fetch-tags: true
          persist-credentials: false
      - name: Setup nodejs environment
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - name: "Configure git user"
@ -98,7 +98,7 @@ jobs:
        run: git checkout -b "changelog/${RUN_ID}/${VERSION}"
      - name: "Generate changelog"
        id: changelog
-        uses: ./.github/workflows/actions/changelog
+        uses: ./.github/actions/changelog
        with:
          previous: ${{ inputs.previous_version }}
          github_token: ${{ steps.generate_token.outputs.token }}
--- a/.github/workflows/codeowners-validator.yml
+++ b/.github/workflows/codeowners-validator.yml
@ -9,7 +9,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      # Checks-out your repository, which is validated in the next step
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: GitHub CODEOWNERS Validator
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -40,7 +40,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@v4
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@ -53,7 +53,7 @@ jobs:
          private_key: ${{ env.GH_APP_PEM }}

      - name: Checkout Actions
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4 # v4.2.2
        with:
          repository: "grafana/grafana-github-actions"
          path: ./actions
--- a/.github/workflows/core-plugins-build-and-release.yml
+++ b/.github/workflows/core-plugins-build-and-release.yml
@ -43,7 +43,7 @@ jobs:
      version: ${{ steps.build_frontend.outputs.version }}
    steps:
      - name: checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Verify inputs
@ -64,7 +64,7 @@ jobs:
      - name: 'Set up Cloud SDK'
        uses: 'google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a'
      - name: Setup nodejs environment
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: yarn
--- a/.github/workflows/detect-breaking-changes-levitate.yml
+++ b/.github/workflows/detect-breaking-changes-levitate.yml
@ -27,11 +27,11 @@ jobs:
      id-token: write

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          path: './pr'
          persist-credentials: false
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+      - uses: actions/setup-node@v4
        with:
          node-version: 22.11.0

@ -77,12 +77,12 @@ jobs:
        working-directory: './base'

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          path: './base'
          ref: ${{ github.event.pull_request.base.ref }}

-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+      - uses: actions/setup-node@v4
        with:
          node-version: 22.11.0

@ -128,8 +128,8 @@ jobs:
      id-token: 'write'

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
          node-version: 22.11.0

@ -197,7 +197,7 @@ jobs:
          app_id: ${{ secrets.GRAFANA_PR_AUTOMATION_APP_ID }}
          private_key: ${{ secrets.GRAFANA_PR_AUTOMATION_APP_PEM }}

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4

      - name: 'Download artifact'
        uses: actions/download-artifact@v4
--- a/.github/workflows/documentation-ci.yml
+++ b/.github/workflows/documentation-ci.yml
@ -10,7 +10,7 @@ jobs:
    container:
      image: grafana/vale:latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: grafana/writers-toolkit/vale-action@vale-action/v1 # zizmor: ignore[unpinned-uses]
--- a/.github/workflows/ephemeral-instances-pr-comment.yml
+++ b/.github/workflows/ephemeral-instances-pr-comment.yml
@ -41,7 +41,7 @@ jobs:
          private_key: ${{ secrets.EI_APP_PRIVATE_KEY }}

      - name: Checkout ephemeral instances repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          repository: grafana/ephemeral-grafana-instances-github-action
          token: ${{ steps.generate_token.outputs.token }}
--- a/.github/workflows/feature-toggles-ci.yml
+++ b/.github/workflows/feature-toggles-ci.yml
@ -11,12 +11,12 @@ jobs:
  test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: true
--- a/.github/workflows/frontend-lint.yml
+++ b/.github/workflows/frontend-lint.yml
@ -16,10 +16,10 @@ jobs:
      contents: read
      id-token: write
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - uses: actions/checkout@v4
      with:
        persist-credentials: false
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
@ -46,8 +46,8 @@ jobs:
    name: Lint
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
@ -64,8 +64,8 @@ jobs:
    name: Lint
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
@ -87,8 +87,8 @@ jobs:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
@ -104,8 +104,8 @@ jobs:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
@ -123,8 +123,8 @@ jobs:
    name: Betterer
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
--- a/.github/workflows/go-lint.yml
+++ b/.github/workflows/go-lint.yml
@ -16,10 +16,10 @@ jobs:
  lint-go:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
-      - uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+      - uses: actions/setup-go@v5
        with:
          go-version-file: ./go.mod
      - run: make gen-go
--- a/.github/workflows/i18n-crowdin-create-tasks.yml
+++ b/.github/workflows/i18n-crowdin-create-tasks.yml
@ -11,12 +11,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Node.js
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

--- a/.github/workflows/i18n-crowdin-download.yml
+++ b/.github/workflows/i18n-crowdin-download.yml
@ -22,7 +22,7 @@ jobs:
          app_id: ${{ secrets.GRAFANA_PR_AUTOMATION_APP_ID }}
          private_key: ${{ secrets.GRAFANA_PR_AUTOMATION_APP_PEM }}

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
          token: ${{ steps.generate_token.outputs.token }}
--- a/.github/workflows/i18n-crowdin-upload.yml
+++ b/.github/workflows/i18n-crowdin-upload.yml
@ -14,7 +14,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

--- a/.github/workflows/issue-opened.yml
+++ b/.github/workflows/issue-opened.yml
@ -22,7 +22,7 @@ jobs:
    steps:

      - name: Checkout Actions
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4 # v4.2.2
        with:
          repository: "grafana/grafana-github-actions"
          path: ./actions
@ -88,7 +88,7 @@ jobs:
          private_key: ${{ env.GH_APP_PEM }}

      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4 # v4.2.2

      - name: Send issue to the auto triager action
        id: auto_triage
--- a/.github/workflows/lint-build-docs.yml
+++ b/.github/workflows/lint-build-docs.yml
@ -22,12 +22,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Node.js
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version: '22.11.0'
          cache: 'yarn'
--- a/.github/workflows/metrics-collector.yml
+++ b/.github/workflows/metrics-collector.yml
@ -38,7 +38,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Actions
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4 # v4.2.2
        with:
          repository: "grafana/grafana-github-actions"
          path: ./actions
--- a/.github/workflows/pr-backend-coverage.yml
+++ b/.github/workflows/pr-backend-coverage.yml
@ -23,11 +23,11 @@ jobs:
    runs-on: ubuntu-latest-8-cores
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@ -31,7 +31,7 @@ jobs:
    if: github.event.pull_request.draft == false
    steps:
      - name: Checkout Actions
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4 # v4.2.2
        with:
          repository: "grafana/grafana-github-actions"
          path: ./actions
--- a/.github/workflows/pr-codeql-analysis-javascript.yml
+++ b/.github/workflows/pr-codeql-analysis-javascript.yml
@ -20,7 +20,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@v4
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
--- a/.github/workflows/pr-codeql-analysis-python.yml
+++ b/.github/workflows/pr-codeql-analysis-python.yml
@ -18,7 +18,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@v4
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
--- a/.github/workflows/pr-commands.yml
+++ b/.github/workflows/pr-commands.yml
@ -30,7 +30,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Actions
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4 # v4.2.2
        with:
          repository: "grafana/grafana-github-actions"
          path: ./actions
--- a/.github/workflows/pr-dependabot-update-go-workspace.yml
+++ b/.github/workflows/pr-dependabot-update-go-workspace.yml
@ -37,7 +37,7 @@ jobs:
        private-key: ${{ env.PRIVATE_KEY }}

    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@v4
      with:
        repository: ${{ github.event.pull_request.head.repo.full_name }}
        ref: ${{ github.event.pull_request.head.ref }}
--- a/.github/workflows/pr-e2e-tests.yml
+++ b/.github/workflows/pr-e2e-tests.yml
@ -18,12 +18,12 @@ jobs:
    outputs:
      artifact: ${{ steps.artifact.outputs.artifact }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          repository: 'grafana/grafana-build'
          ref: 'main'
          persist-credentials: false
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          path: ./grafana
      - run: echo "GRAFANA_GO_VERSION=$(grep "go 1." grafana/go.work |  cut -d\  -f2)" >> "$GITHUB_ENV"
--- a/.github/workflows/pr-frontend-unit-tests.yml
+++ b/.github/workflows/pr-frontend-unit-tests.yml
@ -23,10 +23,10 @@ jobs:
      matrix:
        chunk: [1, 2, 3, 4, 5, 6, 7, 8]
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - uses: actions/checkout@v4
      with:
        persist-credentials: false
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
@ -51,8 +51,8 @@ jobs:
      matrix:
        chunk: [1, 2, 3, 4, 5, 6, 7, 8]
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        cache: 'yarn'
--- a/.github/workflows/pr-go-workspace-check.yml
+++ b/.github/workflows/pr-go-workspace-check.yml
@ -21,7 +21,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@v4
      with:
        persist-credentials: false

--- a/.github/workflows/pr-k8s-codegen-check.yml
+++ b/.github/workflows/pr-k8s-codegen-check.yml
@ -19,7 +19,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@v4
      with:
        persist-credentials: false

--- a/.github/workflows/pr-test-integration.yml
+++ b/.github/workflows/pr-test-integration.yml
@ -17,11 +17,11 @@ jobs:
    runs-on: ubuntu-latest-8-cores
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
@ -47,9 +47,9 @@ jobs:
          - 3306:3306
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
@ -72,9 +72,9 @@ jobs:
          - 5432:5432
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
      - name: Setup Go
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
--- a/.github/workflows/publish-kinds-next.yml
+++ b/.github/workflows/publish-kinds-next.yml
@ -29,7 +29,7 @@ jobs:
    runs-on: "ubuntu-latest"
    steps:
      - name: "Checkout Grafana repo"
-        uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+        uses: "actions/checkout@v4"
        with:
          fetch-depth: 0
          persist-credentials: false
--- a/.github/workflows/publish-kinds-release.yml
+++ b/.github/workflows/publish-kinds-release.yml
@ -31,7 +31,7 @@ jobs:
    runs-on: "ubuntu-latest"
    steps:
      - name: "Checkout Grafana repo"
-        uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+        uses: "actions/checkout@v4"
        with:
          # required for the `grafana/grafana-github-actions/has-matching-release-tag` action to work
          fetch-depth: 0
@ -46,7 +46,7 @@ jobs:
        run: go run .github/workflows/scripts/kinds/verify-kinds.go

      - name: "Checkout Actions library"
-        uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+        uses: "actions/checkout@v4"
        with:
          repository: "grafana/grafana-github-actions"
          path: "./actions"
--- a/.github/workflows/publish-technical-documentation-next.yml
+++ b/.github/workflows/publish-technical-documentation-next.yml
@ -15,7 +15,7 @@ jobs:
      id-token: write
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
      - uses: grafana/writers-toolkit/publish-technical-documentation@publish-technical-documentation/v1 # zizmor: ignore[unpinned-uses]
        with:
          website_directory: content/docs/grafana/next
--- a/.github/workflows/publish-technical-documentation-release.yml
+++ b/.github/workflows/publish-technical-documentation-release.yml
@ -17,7 +17,7 @@ jobs:
      id-token: write
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@ -72,14 +72,14 @@ jobs:
          ownerRepo: 'grafana/grafana'
          pattern: ${{ inputs.target }}
      - name: Checkout Grafana
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          ref: ${{ steps.branch.outputs.branch }}
          fetch-tags: true
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: false
      - name: Checkout Grafana (main)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: '0'
@ -88,7 +88,7 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: false
      - name: Setup nodejs environment
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - name: Configure git user
@ -107,7 +107,7 @@ jobs:
          private_key: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_PEM }}
      - name: Generate changelog
        id: changelog
-        uses: ./.grafana-main/.github/workflows/actions/changelog
+        uses: ./.grafana-main/.github/actions/changelog
        with:
          github_token: ${{ steps.generate_changelog_token.outputs.token }}
          target: v${{ env.VERSION }}
--- a/.github/workflows/run-dashboard-search-e2e.yml
+++ b/.github/workflows/run-dashboard-search-e2e.yml
@ -25,16 +25,16 @@ jobs:
      id-token: write
    steps:
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Pin Go version to mod file
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: true
      - run: go version
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'yarn'
@ -94,7 +94,7 @@ jobs:

      steps:
        - name: Checkout repository
-          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+          uses: actions/checkout@v4
        - name: Restore Cached Node Modules
          uses: actions/cache@v3
          with:
--- a/.github/workflows/run-e2e-suite.yml
+++ b/.github/workflows/run-e2e-suite.yml
@ -14,7 +14,7 @@ jobs:
  main:
    runs-on: ubuntu-latest-8-cores
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v4
--- a/.github/workflows/run-schema-v2-e2e.yml
+++ b/.github/workflows/run-schema-v2-e2e.yml
@ -18,15 +18,15 @@ jobs:
    if: github.event.pull_request.draft == false
    steps:
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Pin Go version to mod file
-        uses: actions/setup-go@111f3307d8850f501ac008e886eec1fd1932a34
+        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go version
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'yarn'
--- a/.github/workflows/storybook-verification.yml
+++ b/.github/workflows/storybook-verification.yml
@ -21,12 +21,12 @@ jobs:
    
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      
      - name: Setup Node.js
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@v4
        with:
          node-version-file: 'package.json'
          cache: 'yarn'
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@ -16,7 +16,7 @@ jobs:
  trivy-scan:
    runs-on: ubuntu-22.04
    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - uses: actions/checkout@v4
      with:
        persist-credentials: false
    - name: Install Trivy
--- a/.github/workflows/update-make-docs.yml
+++ b/.github/workflows/update-make-docs.yml
@ -8,7 +8,7 @@ jobs:
    if: github.repository == 'grafana/grafana'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: grafana/writers-toolkit/update-make-docs@update-make-docs/v1 # zizmor: ignore[unpinned-uses]
--- a/.github/workflows/verify-kinds.yml
+++ b/.github/workflows/verify-kinds.yml
@ -11,7 +11,7 @@ jobs:
    runs-on: "ubuntu-latest"
    steps:
      - name: "Checkout Grafana repo"
-        uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+        uses: "actions/checkout@v4"
        with:
          fetch-depth: 0
          persist-credentials: false