diff --git a/.github/workflows/build_docker_images.yml b/.github/workflows/build_docker_images.yml
index 10008a362..d6db20584 100644
--- a/.github/workflows/build_docker_images.yml
+++ b/.github/workflows/build_docker_images.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Build and save Docker image(wasm-debug-server:${{ inputs.ver_num }}) to tar file
         run: |
diff --git a/.github/workflows/build_iwasm_release.yml b/.github/workflows/build_iwasm_release.yml
index 93d89c096..756391005 100644
--- a/.github/workflows/build_iwasm_release.yml
+++ b/.github/workflows/build_iwasm_release.yml
@@ -104,7 +104,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
diff --git a/.github/workflows/build_llvm_libraries.yml b/.github/workflows/build_llvm_libraries.yml
index 336579c0e..3a5fe0ab6 100644
--- a/.github/workflows/build_llvm_libraries.yml
+++ b/.github/workflows/build_llvm_libraries.yml
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install dependencies for non macos-14
         if: inputs.os != 'macos-14'
diff --git a/.github/workflows/build_wamr_lldb.yml b/.github/workflows/build_wamr_lldb.yml
index 03d8d0ba0..3448d733e 100644
--- a/.github/workflows/build_wamr_lldb.yml
+++ b/.github/workflows/build_wamr_lldb.yml
@@ -55,7 +55,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: download and install wasi-sdk
         run: |
diff --git a/.github/workflows/build_wamr_sdk.yml b/.github/workflows/build_wamr_sdk.yml
index 5a3eab829..35c608d6e 100644
--- a/.github/workflows/build_wamr_sdk.yml
+++ b/.github/workflows/build_wamr_sdk.yml
@@ -45,7 +45,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: download wamr-app-framework
         run: |
diff --git a/.github/workflows/build_wamr_vscode_ext.yml b/.github/workflows/build_wamr_vscode_ext.yml
index 5d8674e20..29bf2b579 100644
--- a/.github/workflows/build_wamr_vscode_ext.yml
+++ b/.github/workflows/build_wamr_vscode_ext.yml
@@ -24,7 +24,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v6
diff --git a/.github/workflows/build_wamr_wasi_extensions.yml b/.github/workflows/build_wamr_wasi_extensions.yml
index 5c943db38..b6f4cbb75 100644
--- a/.github/workflows/build_wamr_wasi_extensions.yml
+++ b/.github/workflows/build_wamr_wasi_extensions.yml
@@ -28,7 +28,7 @@ jobs:
         os: [ubuntu-22.04]
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt
diff --git a/.github/workflows/build_wamrc.yml b/.github/workflows/build_wamrc.yml
index 71f53a00a..71a3c43da 100644
--- a/.github/workflows/build_wamrc.yml
+++ b/.github/workflows/build_wamrc.yml
@@ -41,7 +41,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
diff --git a/.github/workflows/check_version_h.yml b/.github/workflows/check_version_h.yml
index 473a5de65..f0586799b 100644
--- a/.github/workflows/check_version_h.yml
+++ b/.github/workflows/check_version_h.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: cmake execute to generate version.h
         run: cmake -B build_version -S .
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0799f9f7e..26dd0c7b9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           submodules: recursive
 
diff --git a/.github/workflows/coding_guidelines.yml b/.github/workflows/coding_guidelines.yml
index 3280cad2d..251a2888a 100644
--- a/.github/workflows/coding_guidelines.yml
+++ b/.github/workflows/coding_guidelines.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/compilation_on_android_ubuntu.yml b/.github/workflows/compilation_on_android_ubuntu.yml
index e08a04fa3..3641054ae 100644
--- a/.github/workflows/compilation_on_android_ubuntu.yml
+++ b/.github/workflows/compilation_on_android_ubuntu.yml
@@ -100,7 +100,7 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_ubuntu_2204.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # since jobs.id can't contain the dot character
       # it is hard to use `format` to assemble the cache key
@@ -271,7 +271,7 @@ jobs:
             extra_options: "-DWAMR_BUILD_SIMD=0"
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # only download llvm cache when needed
       - name: Get LLVM libraries
@@ -322,7 +322,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -379,7 +379,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -444,7 +444,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -501,7 +501,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -667,7 +667,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Set-up OCaml
         uses: ocaml/setup-ocaml@v3
diff --git a/.github/workflows/compilation_on_macos.yml b/.github/workflows/compilation_on_macos.yml
index f69275eba..0d19754bc 100644
--- a/.github/workflows/compilation_on_macos.yml
+++ b/.github/workflows/compilation_on_macos.yml
@@ -86,7 +86,7 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_intel_macos.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -186,7 +186,7 @@ jobs:
             extra_options: "-DWAMR_BUILD_SIMD=0"
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # only download llvm cache when needed
       - name: Get LLVM libraries
@@ -253,7 +253,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -311,7 +311,7 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_arm_macos.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt
diff --git a/.github/workflows/compilation_on_nuttx.yml b/.github/workflows/compilation_on_nuttx.yml
index 70906db28..b92e0e398 100644
--- a/.github/workflows/compilation_on_nuttx.yml
+++ b/.github/workflows/compilation_on_nuttx.yml
@@ -87,21 +87,21 @@ jobs:
 
     steps:
       - name: Checkout NuttX
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: apache/nuttx
           ref: 09a71ec7c16c43398d5acbdcbeee7b08736c3170
           path: nuttx
 
       - name: Checkout NuttX Apps
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: apache/nuttx-apps
           ref: 6bd593459c4af3cef325c3d22bccd5537a8ed755
           path: apps
 
       - name: Checkout WAMR
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: ${{ github.repository }}
           path: apps/interpreters/wamr/wamr
@@ -126,7 +126,7 @@ jobs:
         run: make -j$(nproc) EXTRAFLAGS=-Werror
 
       - name: Checkout Bloaty
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: google/bloaty
           submodules: recursive
diff --git a/.github/workflows/compilation_on_sgx.yml b/.github/workflows/compilation_on_sgx.yml
index 3ddd2409f..699fae6db 100644
--- a/.github/workflows/compilation_on_sgx.yml
+++ b/.github/workflows/compilation_on_sgx.yml
@@ -123,7 +123,7 @@ jobs:
             make_options_feature: "-DWAMR_BUILD_SIMD=0"
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install SGX SDK and necessary libraries
         uses: ./.github/actions/install-linux-sgx
@@ -166,7 +166,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt
@@ -262,7 +262,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         if: matrix.running_mode == 'aot'
diff --git a/.github/workflows/compilation_on_windows.yml b/.github/workflows/compilation_on_windows.yml
index bfdbd3c0c..feb758709 100644
--- a/.github/workflows/compilation_on_windows.yml
+++ b/.github/workflows/compilation_on_windows.yml
@@ -84,7 +84,7 @@ jobs:
             "-DWAMR_BUILD_LIBC_UVWASI=0 -DWAMR_BUILD_LIBC_WASI=1",
           ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: clone uvwasi library
         if: ${{ !contains(matrix.build_options, '-DWAMR_BUILD_LIBC_UVWASI=0') }}
@@ -108,7 +108,7 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_windows.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # since jobs.id can't contain the dot character
       # it is hard to use `format` to assemble the cache key
@@ -150,7 +150,7 @@ jobs:
           ]
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: download and install wasi-sdk
         if: matrix.test_option == '$WASI_TEST_OPTIONS'
diff --git a/.github/workflows/compilation_on_zephyr.yml b/.github/workflows/compilation_on_zephyr.yml
index d9a5d46d0..9861239b7 100644
--- a/.github/workflows/compilation_on_zephyr.yml
+++ b/.github/workflows/compilation_on_zephyr.yml
@@ -78,7 +78,7 @@ jobs:
       # └─── application/    --> DUMMY. keep west_lite.yml here
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           path: modules/wasm-micro-runtime
 
diff --git a/.github/workflows/create_tag.yml b/.github/workflows/create_tag.yml
index 39265e6fb..3138e25dc 100644
--- a/.github/workflows/create_tag.yml
+++ b/.github/workflows/create_tag.yml
@@ -29,7 +29,7 @@ jobs:
       contents: write # create and push tags
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
         # Full git history is needed to get a proper list of commits and tags
         with:
           fetch-depth: 0
diff --git a/.github/workflows/hadolint_dockerfiles.yml b/.github/workflows/hadolint_dockerfiles.yml
index 8d5798628..e304429ae 100644
--- a/.github/workflows/hadolint_dockerfiles.yml
+++ b/.github/workflows/hadolint_dockerfiles.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # on default, hadolint will fail on warnings and errors
       - name: Run hadolint on dockerfiles
diff --git a/.github/workflows/nightly_run.yml b/.github/workflows/nightly_run.yml
index 059e11eee..d4c32ca92 100644
--- a/.github/workflows/nightly_run.yml
+++ b/.github/workflows/nightly_run.yml
@@ -67,7 +67,7 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_ubuntu.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # since jobs.id can't contain the dot character
       # it is hard to use `format` to assemble the cache key
@@ -235,7 +235,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # only download llvm cache when needed
       - name: Get LLVM libraries
@@ -413,7 +413,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
@@ -466,7 +466,7 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_ubuntu.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt
@@ -660,7 +660,7 @@ jobs:
             sanitizer: ubsan
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install-wasi-sdk-wabt
         if: matrix.test_option == '$WASI_TEST_OPTIONS'
diff --git a/.github/workflows/release_process.yml b/.github/workflows/release_process.yml
index b9526dab5..093c4f4eb 100644
--- a/.github/workflows/release_process.yml
+++ b/.github/workflows/release_process.yml
@@ -55,7 +55,7 @@ jobs:
     outputs:
       upload_url: ${{ steps.create_release.outputs.upload_url }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: prepare the release note
         run: |
diff --git a/.github/workflows/reuse_latest_release_binaries.yml b/.github/workflows/reuse_latest_release_binaries.yml
index 165a38db0..c9677a6fc 100644
--- a/.github/workflows/reuse_latest_release_binaries.yml
+++ b/.github/workflows/reuse_latest_release_binaries.yml
@@ -34,7 +34,7 @@ jobs:
       contents: write # for creating realease and uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
         # Full git history is needed to get a proper list of commits and tags
         with:
           fetch-depth: 0
diff --git a/.github/workflows/spec_test_on_nuttx.yml b/.github/workflows/spec_test_on_nuttx.yml
index a4936ab08..64f8fd12e 100644
--- a/.github/workflows/spec_test_on_nuttx.yml
+++ b/.github/workflows/spec_test_on_nuttx.yml
@@ -143,21 +143,21 @@ jobs:
       # Note: we use an unreleased version nuttx for xtensa because
       # 12.4 doesn't contain necessary esp32s3 changes.
       - name: Checkout NuttX
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: apache/nuttx
           ref: ${{ matrix.target_config.target == 'xtensa' && '985d395b025cf2012b22f6bb4461959fa6d87645' || '09a71ec7c16c43398d5acbdcbeee7b08736c3170' }}
           path: nuttx
 
       - name: Checkout NuttX Apps
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: apache/nuttx-apps
           ref: ${{ matrix.target_config.target == 'xtensa' && '2ef3eb25c0cec944b13792185f7e5d5a05990d5f' || '6bd593459c4af3cef325c3d22bccd5537a8ed755' }}
           path: apps
 
       - name: Checkout WAMR
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           repository: ${{ github.repository }}
           path: apps/interpreters/wamr/wamr
diff --git a/.github/workflows/supply_chain.yml b/.github/workflows/supply_chain.yml
index 70ff0ad14..eb746cdcd 100644
--- a/.github/workflows/supply_chain.yml
+++ b/.github/workflows/supply_chain.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v3.1.0
+        uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v3.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/wamr_wasi_extensions.yml b/.github/workflows/wamr_wasi_extensions.yml
index 2a2d3c18f..b184fbe77 100644
--- a/.github/workflows/wamr_wasi_extensions.yml
+++ b/.github/workflows/wamr_wasi_extensions.yml
@@ -30,7 +30,7 @@ jobs:
         os: [ubuntu-22.04, macos-13, macos-14]
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt