fix(ci): use allowlisted action versions (#7301)

ea7aa617 · Archer · GitHub · 0d4a40de · ea7aa617 · ea7aa617
Commit ea7aa617 authored Jul 14, 2026 by Archer Committed by GitHub Jul 14, 2026
27 changed files
--- a/.forgejo/workflows/build-agent-sandbox.yml
+++ b/.forgejo/workflows/build-agent-sandbox.yml
@@ -69,7 +69,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -96,7 +96,7 @@ jobs:
          echo "SOURCE_URL=${{ github.server_url }}/${{ github.repository }}" >> "$GITHUB_ENV"
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -104,7 +104,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -181,7 +181,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -200,7 +200,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -290,7 +290,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -317,7 +317,7 @@ jobs:
          echo "SOURCE_URL=${{ github.server_url }}/${{ github.repository }}" >> "$GITHUB_ENV"
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -325,7 +325,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -403,7 +403,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -422,7 +422,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

--- a/.forgejo/workflows/build-code-sandbox.yml
+++ b/.forgejo/workflows/build-code-sandbox.yml
@@ -89,7 +89,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -116,7 +116,7 @@ jobs:
          echo "SOURCE_URL=${{ github.server_url }}/${{ github.repository }}" >> "$GITHUB_ENV"
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -124,7 +124,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -201,7 +201,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -220,7 +220,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

--- a/.forgejo/workflows/build-fastgpt-ide-agent.yml
+++ b/.forgejo/workflows/build-fastgpt-ide-agent.yml
@@ -80,7 +80,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -107,7 +107,7 @@ jobs:
          echo "SOURCE_URL=${{ github.server_url }}/${{ github.repository }}" >> "$GITHUB_ENV"
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -115,7 +115,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -199,7 +199,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -218,7 +218,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

--- a/.forgejo/workflows/build-fastgpt.yml
+++ b/.forgejo/workflows/build-fastgpt.yml
@@ -95,7 +95,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -123,7 +123,7 @@ jobs:
      # login docker
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -131,7 +131,7 @@ jobs:
      - name: Build for ${{ matrix.archs.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -215,7 +215,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -234,7 +234,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

--- a/.forgejo/workflows/build-marketplace.yml
+++ b/.forgejo/workflows/build-marketplace.yml
@@ -52,7 +52,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -80,7 +80,7 @@ jobs:
      # login docker
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -88,7 +88,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -165,7 +165,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -184,7 +184,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

--- a/.forgejo/workflows/build-mcp-server.yml
+++ b/.forgejo/workflows/build-mcp-server.yml
@@ -69,7 +69,7 @@ jobs:
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
@@ -97,7 +97,7 @@ jobs:
      # login docker
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -105,7 +105,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        env:
          GODEBUG: madvdontneed=0
        with:
@@ -181,7 +181,7 @@ jobs:
          EOF
      - name: Login to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
@@ -200,7 +200,7 @@ jobs:
          path: ${{ runner.temp }}/digests
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

--- a/.forgejo/workflows/test-fastgpt.yaml
+++ b/.forgejo/workflows/test-fastgpt.yaml
@@ -38,7 +38,7 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name ||
            github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
@@ -69,7 +69,7 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name ||
            github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
@@ -124,7 +124,7 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name ||
            github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:

--- a/.forgejo/workflows/test-sandbox.yaml
+++ b/.forgejo/workflows/test-sandbox.yaml
@@ -18,7 +18,7 @@ jobs:
          ref: ${{ github.event.pull_request.head.ref || github.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:

--- a/.github/workflows/build-admin.yml
+++ b/.github/workflows/build-admin.yml
@@ -67,7 +67,7 @@ jobs:
          fi
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
@@ -82,7 +82,7 @@ jobs:
      # login docker (GHCR only; Ali tags are pushed in release job via imagetools)
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -90,7 +90,7 @@ jobs:
      - name: Build for ${{ matrix.archs.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: pro/admin/Dockerfile
@@ -136,13 +136,13 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
@@ -156,7 +156,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-agent-sandbox.yml
+++ b/.github/workflows/build-agent-sandbox.yml
@@ -45,7 +45,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -57,7 +57,7 @@ jobs:
            ${{ runner.os }}-agent-sandbox-buildx-
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -65,7 +65,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: projects/agent-sandbox/Dockerfile
@@ -101,19 +101,19 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_NAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -126,7 +126,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |
@@ -188,7 +188,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -200,7 +200,7 @@ jobs:
            ${{ runner.os }}-volume-manager-buildx-
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -208,7 +208,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: projects/volume-manager/Dockerfile
@@ -245,19 +245,19 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_NAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -270,7 +270,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-browser-sandbox.yml
+++ b/.github/workflows/build-browser-sandbox.yml
@@ -64,7 +64,7 @@ jobs:
          fi
      - name: Install pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@v4
        with:
          version: 10.33.4
@@ -126,7 +126,7 @@ jobs:
          fi
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
@@ -139,7 +139,7 @@ jobs:
            ${{ runner.os }}-browser-sandbox-buildx-
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -147,7 +147,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: pro/browser-sandbox/Dockerfile
@@ -205,21 +205,21 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_NAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -232,7 +232,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-code-sandbox.yml
+++ b/.github/workflows/build-code-sandbox.yml
@@ -64,7 +64,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -77,7 +77,7 @@ jobs:
      # ghcr + any extra names in outputs (Ali is pushed only in release via imagetools)
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -85,7 +85,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: projects/code-sandbox/Dockerfile
@@ -121,13 +121,13 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
@@ -140,7 +140,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -93,7 +93,7 @@ jobs:
      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: |
@@ -103,7 +103,7 @@ jobs:
          flavor: latest=false
      - name: Login to Aliyun
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
@@ -114,7 +114,7 @@ jobs:
      - name: Build and push Docker images (CN)
        if: matrix.domain_config.suffix == 'cn'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        uses: docker/build-push-action@v5
        with:
          context: ./document
          file: ./document/Dockerfile
@@ -129,7 +129,7 @@ jobs:
      - name: Build and push Docker images (IO)
        if: matrix.domain_config.suffix == 'io'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        uses: docker/build-push-action@v5
        with:
          context: ./document
          file: ./document/Dockerfile

--- a/.github/workflows/build-fastgpt-ide-agent.yml
+++ b/.github/workflows/build-fastgpt-ide-agent.yml
@@ -52,7 +52,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -65,7 +65,7 @@ jobs:
      # Push per-arch images by digest first; the release job publishes the final manifest tag.
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -73,7 +73,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
@@ -114,14 +114,14 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
        if: matrix.image == 'fastgpt-agent-sandbox-proxy'
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
@@ -134,7 +134,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-fastgpt.yml
+++ b/.github/workflows/build-fastgpt.yml
@@ -57,7 +57,7 @@ jobs:
          fetch-depth: 1
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
@@ -71,7 +71,7 @@ jobs:
      # login docker
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -79,7 +79,7 @@ jobs:
      - name: Build for ${{ matrix.archs.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: projects/app/Dockerfile
@@ -123,19 +123,19 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_NAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -148,7 +148,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-marketplace.yml
+++ b/.github/workflows/build-marketplace.yml
@@ -22,7 +22,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -35,7 +35,7 @@ jobs:
      # login docker
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -43,7 +43,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: projects/marketplace/Dockerfile
@@ -79,13 +79,13 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
@@ -99,7 +99,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Generate random tag
        id: tag

--- a/.github/workflows/build-mcp-server.yml
+++ b/.github/workflows/build-mcp-server.yml
@@ -44,7 +44,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -57,7 +57,7 @@ jobs:
      # login docker
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -65,7 +65,7 @@ jobs:
      - name: Build for ${{ matrix.arch }}
        id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: projects/mcp_server/Dockerfile
@@ -101,19 +101,19 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_NAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -126,7 +126,7 @@ jobs:
          merge-multiple: true
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Set image name and tag
        run: |

--- a/.github/workflows/build-sso-service-image.yml
+++ b/.github/workflows/build-sso-service-image.yml
@@ -52,9 +52,9 @@ jobs:
        run: |
          sudo apt update && sudo apt install -y nodejs npm
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host
      - name: Cache Docker layers
@@ -65,13 +65,13 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-buildx-
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: labring
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Ali Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}

--- a/.github/workflows/preview-admin-build.yml
+++ b/.github/workflows/preview-admin-build.yml
@@ -52,10 +52,10 @@ jobs:
          fi
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Build Docker image (no push)
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: pro/admin/Dockerfile

--- a/.github/workflows/preview-admin-push.yml
+++ b/.github/workflows/preview-admin-push.yml
@@ -42,10 +42,10 @@ jobs:
        run: docker load --input /tmp/fastgpt-pro-image.tar
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}

--- a/.github/workflows/preview-docs-build.yml
+++ b/.github/workflows/preview-docs-build.yml
@@ -26,13 +26,13 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Prepare Docker workspace catalog
        run: cp pnpm-workspace.yaml document/pnpm-workspace.yaml
      - name: Build Docker image (no push)
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: ./document
          file: ./document/Dockerfile

--- a/.github/workflows/preview-docs-push.yml
+++ b/.github/workflows/preview-docs-push.yml
@@ -103,10 +103,10 @@ jobs:
        run: docker load --input /tmp/docs-image.tar
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}

--- a/.github/workflows/preview-fastgpt-build.yml
+++ b/.github/workflows/preview-fastgpt-build.yml
@@ -105,10 +105,10 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Build Docker image (no push)
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}

--- a/.github/workflows/preview-fastgpt-push.yml
+++ b/.github/workflows/preview-fastgpt-push.yml
@@ -135,10 +135,10 @@ jobs:
        run: docker load --input /tmp/${{ matrix.image_name }}-image.tar
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}

--- a/.github/workflows/test-fastgpt-pro.yaml
+++ b/.github/workflows/test-fastgpt-pro.yaml
@@ -63,7 +63,7 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
@@ -101,7 +101,7 @@ jobs:
        continue-on-error: true
      - name: Report Coverage
        if: hashFiles('pro/admin/coverage/coverage-summary.json') != ''
-        uses: davelosert/vitest-coverage-report-action@3c054a2d2e2ca45446417ad5d6d5eb33092af8f1 # v2
+        uses: davelosert/vitest-coverage-report-action@v2
        with:
          json-final-path: pro/admin/coverage/coverage-final.json
          json-summary-path: pro/admin/coverage/coverage-summary.json
--- a/.github/workflows/test-fastgpt.yaml
+++ b/.github/workflows/test-fastgpt.yaml
@@ -107,7 +107,7 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name ||
            github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
@@ -141,7 +141,7 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name ||
            github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
@@ -175,7 +175,7 @@ jobs:
          repository: ${{ github.event.pull_request.head.repo.full_name ||
            github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:

--- a/.github/workflows/test-sandbox.yaml
+++ b/.github/workflows/test-sandbox.yaml
@@ -18,7 +18,7 @@ jobs:
          ref: ${{ github.event.pull_request.head.ref || github.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: