Update OpenSSL version to 3.5.5 in workflow

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/build-installer.yml

@@ -19,7 +19,7 @@ jobs:
       WIX_DIR: "C:/Program Files (x86)/WiX Toolset v3.14/bin"
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       # Configure build environment/dependencies
       - name: Install MySQL client libs
@@ -29,17 +29,19 @@ jobs:
 
       - name: Install OpenSSL 3
         run: |
-          curl -L https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.3.1.zip -o openssl3.zip
-          unzip -d C:/ openssl3.zip
+          curl -L https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip -o openssl3.zip
+          echo "3739c845f86906eed4b8e1c321a240a756e2eb5140537cddc796a85e36dc71d9  openssl3.zip" | shasum -a 256 -c
+          mkdir C:/openssl-3
+          unzip -d C:/openssl-3 openssl3.zip
           cp -r C:/openssl-3/x64/bin/libssl-3-x64.dll C:/Windows/System32/
           cp -r C:/openssl-3/x64/bin/libcrypto-3-x64.dll C:/Windows/System32/
 
       - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
 
       - name: Cache AWS SDK libraries
         id: cache-dynamic-aws-sdk
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             aws_sdk
@@ -52,23 +54,23 @@ jobs:
           .\build_aws_sdk_win.ps1 x64 ${{ env.BUILD_TYPE}} ON "${{env.CMAKE_GENERATOR}}"
 
       - name: Setup nmake
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
 
       - name: Run build installer script
         shell: pwsh
         run: |
           .\build_installer.ps1 x64 ${{ env.BUILD_TYPE}} "${{env.CMAKE_GENERATOR}}" C:/mysql-${{ vars.MYSQL_VERSION }}-winx64 "${{env.WIX_DIR}}" "C:/openssl-3/x64/include/"
 
       - name: Configure AWS credentials OIDC
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
         with:
           role-skip-session-tagging: true
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
           role-session-name: mysql-win-signer
 
       - name: Configure AWS credentials Signer
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
         with:
           role-skip-session-tagging: true
           role-chaining: true
@@ -86,7 +88,7 @@ jobs:
 
       - name: Upload Windows installer as artifact
         if: success()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: installers
           path: ${{ github.workspace }}/wix/*.msi

.github/workflows/codebuild.yml

@@ -28,14 +28,14 @@ jobs:
 
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install build dependencies
         run: sudo apt-get update && sudo apt-get install libcurl4 && sudo apt-get install libcurl4-openssl-dev
 
       - name: Cache AWS SDK libraries
         id: cache-dynamic-aws-sdk
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             aws_sdk
@@ -48,13 +48,13 @@ jobs:
           ./build_aws_sdk_unix.sh $BUILD_TYPE
 
       - name: 'Set up JDK'
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: 'corretto'
           java-version: 17
 
       - name: 'Configure AWS Credentials'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
         with:
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
@@ -76,7 +76,7 @@ jobs:
       - name: 'Get Github Action IP'
         if: always()
         id: ip
-        uses: haythem/public-ip@v1.3
+        uses: haythem/public-ip@bdddd92c198b0955f0b494a8ebeac529754262ff # v1.3
 
       - name: 'Remove Github Action IP'
         if: always()
@@ -101,7 +101,7 @@ jobs:
 
       - name: 'Archive log results'
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: 'integration-test-logs'
           path: reports/tests/

.github/workflows/dockerized.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install build dependencies
         run: sudo apt-get update && sudo apt-get install libcurl4 && sudo apt-get install libcurl4-openssl-dev
@@ -41,7 +41,7 @@ jobs:
           ./build_aws_sdk_unix.sh $BUILD_TYPE
 
       - name: 'Set up JDK'
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: 'corretto'
           java-version: 17

.github/workflows/failover.yml

@@ -17,6 +17,10 @@ on:
       - 'ISSUE_TEMPLATE/**'
       - '**/remove-old-artifacts.yml'
 
+permissions:
+  id-token: write
+  contents: read
+
 env:
   LINUX_BUILD_TYPE: Release
   WINDOWS_BUILD_TYPE: Debug
@@ -31,7 +35,7 @@ jobs:
       MYSQL_DIR: C:/mysql-${{ vars.MYSQL_VERSION }}-winx64
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       # Configure build environment/dependencies
       - name: Install MySQL client libs and include files
@@ -45,15 +49,17 @@ jobs:
 
       - name: Install OpenSSL 3
         run: |
-          curl -L https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.3.1.zip -o openssl3.zip
-          unzip -d C:/ openssl3.zip
+          curl -L https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip -o openssl3.zip
+          echo "3739c845f86906eed4b8e1c321a240a756e2eb5140537cddc796a85e36dc71d9  openssl3.zip" | shasum -a 256 -c
+          mkdir C:/openssl-3
+          unzip -d C:/openssl-3 openssl3.zip
 
       - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
 
       - name: Cache AWS SDK libraries
         id: cache-static-aws-sdk
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             aws_sdk
@@ -106,25 +112,25 @@ jobs:
       # Upload artifacts
       - name: Upload build artifacts - Binaries
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: windows-failover-sln
           path: ${{ github.workspace }}/build/MySQL_Connector_ODBC.sln
       - name: Upload build artifacts - Binaries
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: windows-failover-binaries
           path: ${{ github.workspace }}/build/bin/
       - name: Upload build artifacts - Libraries
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: windows-failover-libraries
           path: ${{ github.workspace }}/build/lib/
       - name: Upload failover test artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: windows-failover-results
           path: ${{ github.workspace }}/build/unit_testing/Testing/Temporary/LastTest.log
@@ -137,7 +143,7 @@ jobs:
 #      CXX: g++-11
 #    steps:
 #      - name: Checkout source code
-#        uses: actions/checkout@v4
+#        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 #
 #      # Configure build environment/dependencies
 #      - name: Install build dependencies
@@ -156,7 +162,7 @@ jobs:
 #
 #      - name: Cache AWS SDK libraries
 #        id: cache-dynamic-aws-sdk
-#        uses: actions/cache@v4
+#        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
 #        with:
 #          path: |
 #            aws_sdk
@@ -203,32 +209,32 @@ jobs:
 #      # Upload artifacts
 #      - name: Upload build artifacts - Binaries
 #        if: always()
-#        uses: actions/upload-artifact@v4
+#        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 #        with:
 #          name: linux-failover-binaries
 #          path: ${{ github.workspace }}/build/bin/
 #      - name: Upload build artifacts - Libraries
 #        if: always()
-#        uses: actions/upload-artifact@v2
+#        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2
 #        with:
 #          name: linux-failover-libraries
 #          path: ${{ github.workspace }}/build/lib/
 #      - name: Upload test artifacts
 #        if: always()
-#        uses: actions/upload-artifact@v2
+#        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2
 #        with:
 #          name: linux-failover-results
 #          path: ${{ github.workspace }}/build/unit_testing/Testing/Temporary/LastTest.log
 
   build-mac:
     name: MacOS
-    runs-on: macos-13
+    runs-on: macos-15-intel
     env:
       CMAKE_GENERATOR: Unix Makefiles
       ODBC_DM_INCLUDES: /usr/local/include
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       # Configure build environment/dependencies
       # Removing some /usr/local/bin files to avoid symlink issues wih brew update
@@ -263,7 +269,7 @@ jobs:
 
       - name: Cache AWS SDK libraries
         id: cache-dynamic-aws-sdk
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             aws_sdk
@@ -320,25 +326,25 @@ jobs:
       # Upload artifacts
       - name: Upload build artifacts - Binaries
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: macos-binaries
           path: ${{ github.workspace }}/build/bin/
       - name: Upload build artifacts - Libraries
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: macos-libraries
           path: ${{ github.workspace }}/build/lib/
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: macos-failover-results
           path: ${{ github.workspace }}/build/unit_testing/Testing/Temporary/LastTest.log
       - name: Upload memory leaks check
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: macos-memory-leaks-results
           path: ${{ github.workspace }}/build/unit_testing/leaks_unit_testing.txt

.github/workflows/integration.yml

@@ -42,27 +42,27 @@ jobs:
 
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install build dependencies
         run: sudo apt-get update && sudo apt-get install libcurl4 && sudo apt-get install libcurl4-openssl-dev
 
       - name: Cache AWS SDK libraries
         id: cache-dynamic-aws-sdk
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             aws_sdk
           key: ${{ runner.os }}-aws-sdk-dynamic-lib
 
       - name: 'Set up JDK'
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: 'corretto'
           java-version: 17
 
       - name: 'Configure AWS Credentials'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
         with:
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
@@ -83,7 +83,7 @@ jobs:
       - name: 'Get Github Action IP'
         if: always()
         id: ip
-        uses: haythem/public-ip@v1.3
+        run: echo "ipv4=$(curl -s https://checkip.amazonaws.com)" >> $GITHUB_OUTPUT
 
       - name: 'Remove Github Action IP'
         if: always()
@@ -108,7 +108,7 @@ jobs:
 
       - name: 'Archive log results'
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: 'integration-test-logs-${{ matrix.engine_version }}'
           path: reports/tests/