ci: Actions auf Commit-SHAs festnageln

checkout, setup-node, setup-buildx, login, metadata und build-push
laufen jetzt auf dem Commit, auf den der bisherige Major-Tag am
2026-10-16 zeigte (Tag als Kommentar). Ein verschobener Tag kann so
keinen fremden Code mit dem Registry-Token ausführen.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

.gitea/workflows/backend-image.yml

@@ -22,7 +22,7 @@ jobs:
       REGISTRY_PUSH: gitea:80
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Image-Namen in Kleinbuchstaben ermitteln
         # OCI-Registries erlauben nur Kleinbuchstaben im Repository-Pfad;
@@ -31,7 +31,7 @@ jobs:
         run: echo "name=$(echo '${{ gitea.repository_owner }}/apicore-backend' | tr '[:upper:]' '[:lower:]')" >> "$GITEA_OUTPUT"
 
       - name: Docker Buildx einrichten
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
         with:
           # REGISTRY_PUSH ist Klartext-HTTP (Gitea-Service intern ohne TLS)
           # statt HTTPS — BuildKit lehnt das ohne diese Freigabe ab.
@@ -40,7 +40,7 @@ jobs:
               http = true
 
       - name: Bei der Gitea-Container-Registry anmelden
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY_PUSH }}
           username: ${{ gitea.actor }}
@@ -50,7 +50,7 @@ jobs:
 
       - name: Metadaten (Tags/Labels) ermitteln
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY_PUSH }}/${{ steps.image.outputs.name }}
           tags: |
@@ -58,7 +58,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Image bauen und pushen
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ./ApiCore-Backend
           push: true

.gitea/workflows/frontend-image.yml

@@ -22,7 +22,7 @@ jobs:
       REGISTRY_PUSH: gitea:80
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Image-Namen in Kleinbuchstaben ermitteln
         # OCI-Registries erlauben nur Kleinbuchstaben im Repository-Pfad;
@@ -31,7 +31,7 @@ jobs:
         run: echo "name=$(echo '${{ gitea.repository_owner }}/apicore-frontend' | tr '[:upper:]' '[:lower:]')" >> "$GITEA_OUTPUT"
 
       - name: Docker Buildx einrichten
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
         with:
           # REGISTRY_PUSH ist Klartext-HTTP (Gitea-Service intern ohne TLS)
           # statt HTTPS — BuildKit lehnt das ohne diese Freigabe ab.
@@ -40,7 +40,7 @@ jobs:
               http = true
 
       - name: Bei der Gitea-Container-Registry anmelden
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY_PUSH }}
           username: ${{ gitea.actor }}
@@ -50,7 +50,7 @@ jobs:
 
       - name: Metadaten (Tags/Labels) ermitteln
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY_PUSH }}/${{ steps.image.outputs.name }}
           tags: |
@@ -58,7 +58,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Image bauen und pushen
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ./ApiCore-Frontend
           push: true

.gitea/workflows/manifests.yml

@@ -32,10 +32,10 @@ jobs:
       YQ_SHA256: c5f056448f973ae7d39b5401949648a78f2dc1947d6a8eb65be60d5c504b9385
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Node einrichten
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22