diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000000..322a2b6ea8f9
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/cache_retain.yml b/.github/workflows/cache_retain.yml
index 1931ca309c2c..45d70d82bb11 100644
--- a/.github/workflows/cache_retain.yml
+++ b/.github/workflows/cache_retain.yml
@@ -38,17 +38,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '11'
       - name: Restore read-only cache of local Maven repository
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         id: cache
         with:
           path: ~/.m2/repository
diff --git a/.github/workflows/icu4c.yml b/.github/workflows/icu4c.yml
deleted file mode 100644
index 77e8655a1f39..000000000000
--- a/.github/workflows/icu4c.yml
+++ /dev/null
@@ -1,571 +0,0 @@
-# Copyright (C) 2016 and later: Unicode, Inc. and others.
-# License & terms of use: http://www.unicode.org/copyright.html
-#
-# GitHub Action configuration script for ICU continuous integration tasks.
-
-name: GHA ICU4C
-
-on:
-  push:
-    branches:
-      - main
-      - 'maint/maint*'
-    paths:
-      - 'icu4c/**'
-      - '.github/workflows/**'
-  pull_request:
-    branches: '**'
-    paths:
-      - 'icu4c/**'
-      - '.github/workflows/**'
-  workflow_dispatch:
-    # To trigger the Env Test workflow manually, follow the instructions in
-    # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
-
-permissions:
-  contents: read
-
-jobs:
-
-  # ICU4C docs build using doxygen..
-  icu4c-docs-build:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C doc
-        run: |
-          sudo apt-get -y install doxygen;
-          cd icu4c/source;
-          ./runConfigureICU Linux --disable-renaming;
-           # Fail if 'warning:' appears in doxygen's output, but ignore warnings from file Doxyfile.
-           # Regex note: (?! ... ) is a negative lookahead. Succeed if the pattern is not present. 
-          set +o pipefail && make doc 2>&1 | tee doxygen.log && ( ! grep -P 'warning:(?! .* file .?Doxyfile)' doxygen.log )
-
-  # gcc debug build.
-  # Includes dependency checker.
-  # Note - the dependency checker needs to be run on both a debug and an optimized build.
-  # This one (gcc) for debug, and linux clang (see job below) for optimized.
-  #
-  # Test both out-of-source and in-source builds. This one (gcc) for out-of-source,
-  # and linux clang (below) for in-source.
-  #
-  # Invokes test/hdrtst to check public headers compliance.
-  gcc-debug-build-and-test:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with gcc
-        env:
-          PREFIX: /tmp/icu-prefix
-        run: |
-          mkdir build;
-          cd build;
-          ../icu4c/source/runConfigureICU --enable-debug --disable-release Linux/gcc --prefix=$PREFIX --enable-tracing;
-          make -j -l4.5 check;
-          ( cd ../icu4c/source/test/depstest && ./depstest.py ../../../../build/ );
-          make install;
-          PATH=$PREFIX/bin:$PATH make -C test/hdrtst check
-
-  # clang release build with some options to enforce useful constraints.
-  # Includes dependency checker on an in-source, optimized build.
-  # Includes checking @draft etc. API tags vs. ifndef guards like
-  # U_HIDE_DRAFT_API and U_FORCE_HIDE_DRAFT_API.
-  # (FORCE guards make this tool pass but won't compile to working code.
-  # See the testtagsguards.sh script for details.)
-  clang-release-build-and-test:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install doxygen
-        run: |
-          sudo apt-get -y install doxygen;
-      - name: Build ICU4C with clang
-        env:
-          CPPFLAGS: -DU_NO_DEFAULT_INCLUDE_UTF_HEADERS=1
-          CFLAGS: -Wimplicit-fallthrough
-          CXXFLAGS: -Wimplicit-fallthrough
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux/clang;
-          make -j -l4.5 check;
-      - name: Test Dependency
-        run: |
-          cd icu4c/source/test/depstest;
-          python3 depstest.py ../../../source/;
-      - name: Test Tags Guards
-        run: |
-          cd icu4c;
-          source/test/hdrtst/testtagsguards.sh;
-      - name: Make Dist
-        env:
-          CPPFLAGS: -DU_NO_DEFAULT_INCLUDE_UTF_HEADERS=1
-          CFLAGS: -Wimplicit-fallthrough
-          CXXFLAGS: -Wimplicit-fallthrough
-        run: |
-          cd icu4c/source;
-          make dist
-
-  # clang build with some options
-  clang-options-build-and-test:
-    strategy:
-      # "fail-fast: false" lets other jobs keep running even if the test breaks in some other options.
-      fail-fast: false
-      matrix:
-        build_option:
-         [ --enable-static, --enable-static --disable-shared ]
-         # --disable-shared has a build problem.
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Build ICU4C with clang
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux/clang ${{ matrix.build_option }};
-          make -j -l4.5 tests;
-      - name: Test
-        run: |
-          cd icu4c/source;
-          make check;
-
-  # Out of source build with gcc 10, c++14, and extra warnings; executes icuinfo.
-  gcc-10-stdlib17:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with gcc 10 and c++17 and extra warnings.
-        env:
-          PREFIX: /tmp/icu-prefix
-          CC: gcc-10
-          CXX: g++-10
-          CXXFLAGS: -std=c++17 -Wextra
-        run: |
-          mkdir build;
-          cd build;
-          ../icu4c/source/runConfigureICU Linux --disable-layout --disable-layoutex --prefix=$PREFIX;
-          make -j -l4.5 check;
-          make -j -l4.5 install;
-          cd $PREFIX/bin;
-          LD_LIBRARY_PATH=../lib ./icuinfo
-
-  # Clang Linux with address sanitizer.
-  clang-asan:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with clang and asan
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU --enable-debug --disable-release Linux/clang --disable-renaming --enable-tracing;
-          make -j -l4.5 check;
-        env:
-          CPPFLAGS: -fsanitize=address
-          LDFLAGS: -fsanitize=address
-  # Clang Linux with undefined-behavior sanitizer.
-  clang-ubsan:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with clang and ubsan +alignment
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU --enable-debug --disable-release Linux/clang --disable-renaming;
-          make -j -l4.5 check;
-        env:
-          CPPFLAGS: -fsanitize=undefined -fsanitize=alignment -fno-sanitize-recover=undefined,alignment
-          CFLAGS: -fsanitize=undefined -fsanitize=alignment -fno-sanitize-recover=undefined,alignment
-          LDFLAGS: -fsanitize=undefined -fsanitize=alignment -fno-sanitize-recover=undefined,alignment
-  # Control Flow Integrity.
-  clang-cfi:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with clang using CFI
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux --disable-renaming;
-          make -j -l4.5 check;
-        env:
-          CC: clang
-          CXX: clang++
-          # add -fsanitize=cfi-vcall -fsanitize=cfi-icall  later
-          CXXFLAGS: -flto -fvisibility=hidden -fsanitize=cfi-derived-cast -fno-sanitize-trap=cfi -fno-inline-functions -fno-inline -fno-omit-frame-pointer -O1
-          # add -fsanitize=cfi-vcall -fsanitize=cfi-icall  later
-          LDFLAGS: -flto -fvisibility=hidden -fuse-ld=gold -fsanitize=cfi-derived-cast -fsanitize=cfi-unrelated-cast -fno-sanitize-trap=cfi -fsanitize-cfi-icall-generalize-pointers
-
-  # Clang Linux with thread sanitizer.
-  clang-tsan:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with clang and tsan
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU --enable-debug --disable-release Linux/clang --disable-renaming
-          make -j -l4.5;
-          make -j -l4.5 -C test;
-          make -j -l4.5 -C test/intltest check
-        env:
-          INTLTEST_OPTS: utility/MultithreadTest
-          CPPFLAGS: -fsanitize=thread
-          LDFLAGS: -fsanitize=thread
-
-  # MacOS with clang
-  macos-clang:
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C with clang on MacOS
-        run: |
-          cd icu4c/source;
-          PYTHON=python3 ./runConfigureICU MacOSX;
-          make -j -l4.5 check
-
-  # Run ICU4C tests with stubdata.
-  run-with-stubdata:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C tests with stubdata
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux;
-          make -j -l4.5 check;
-          rm lib/libicudata.so*;
-          cp -P stubdata/libicudata.so* lib;
-
-          cd test/cintltst;
-          echo 'Running ICU4C cintltst with stubdata.';
-          # Note: 'Elapsed Time: ' is printed by makefile upon final success.
-          CINTLTST_OPTS=-w make -j -l4.5 check 2>&1 | tee stubdata_ctest.log;
-          if ! grep 'Elapsed Time: ' stubdata_ctest.log
-          then
-            echo
-            echo cintltst run with stubdata failed
-            echo
-            echo See
-            echo https://unicode-org.github.io/icu/processes/release/tasks/integration.html#run-tests-without-icu-data
-            echo for how to reproduce and debug the failure
-            exit 1
-          fi
-
-          cd ../intltest;
-          echo 'Running ICU4C intltest with stubdata.';
-          INTLTEST_OPTS=-w make -j -l4.5 check 2>&1 | tee stubdata_intltest.log;
-          if ! grep 'Elapsed Time: ' stubdata_intltest.log
-          then
-            echo
-            echo intltest run with stubdata failed
-            echo
-            echo See
-            echo https://unicode-org.github.io/icu/processes/release/tasks/integration.html#run-tests-without-icu-data
-            echo for how to reproduce and debug the failure
-            exit 1
-          fi
-
-  # Test U_CHARSET_IS_UTF8
-  u-charset-is-utf8-test:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux CPPFLAGS="-DU_CHARSET_IS_UTF8=1";
-          make -j -l4.5 check
-
-  # Test U_OVERRIDE_CXX_ALLOCATION-is-0-test
-  u-override-cxx-allocation-is-0-test:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux CPPFLAGS="-DU_OVERRIDE_CXX_ALLOCATION=0";
-          make clean;
-          make -j -l4.5 check
-
-  # Test LSTM
-  lstm-test:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: |
-          cd icu4c/source;
-          ICU_DATA_FILTER_FILE=../../.github/lstm_for_th_my.json ./runConfigureICU --enable-debug --disable-release Linux -disable-layoutex;
-          make clean;
-          make -j -l4.5 check
-
-  # Test adaboost
-  adaboost-test:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: |
-          cd icu4c/source;
-          ICU_DATA_FILTER_FILE=../../.github/adaboost.json CPPFLAGS=-DUCONFIG_USE_ML_PHRASE_BREAKING=1 ./runConfigureICU --enable-debug --disable-release Linux -disable-layoutex;
-          make clean;
-          make -j -l4.5 check
-
-  # Build and run testmap
-  testmap:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: |
-          cd icu4c/source;
-          ./runConfigureICU Linux;
-          make -j -l4.5 check;
-          CONFIG_FILES=test/testmap/Makefile ./config.status;
-          cd test/testmap;
-          make -j -l4.5 check | grep '*** PASS PASS PASS, test PASSED!!!!!!!!'
-
-  # Copyright scan
-  copyright-scan:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: perl tools/scripts/cpysearch/cpyscan.pl
-
-  # Check compilation of internal headers.
-  internal-header-compilation:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: cd icu4c/source; test/hdrtst/testinternalheaders.sh
-
-  # Check source files for valid UTF-8 and for absence of BOM.
-  valid-UTF-8-and-no-BOM-check:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - run: tools/scripts/icu-file-utf8-check.py
-
-  # Run unit tests with UCONFIG_NO_XXX variations.
-  uconfig-unit-tests:
-    runs-on: ubuntu-20.04
-    strategy:
-      # "fail-fast: false" lets other jobs keep running even if the test breaks in some other uconfig.
-      fail-fast: false
-      matrix:
-        uconfig_cppflags:
-         # Ignore the following two.
-         # - "-DUCONFIG_NO_FILE_IO=1"
-         # - "-DUCONFIG_NO_CONVERSION=1"
-         - "-DUCONFIG_NO_LEGACY_CONVERSION=1"
-         - "-DUCONFIG_NO_NORMALIZATION=1"
-         - "-DUCONFIG_NO_BREAK_ITERATION=1"
-         - "-DUCONFIG_NO_IDNA=1"
-         - "-DUCONFIG_NO_COLLATION=1"
-         - "-DUCONFIG_NO_FORMATTING=1"
-         - "-DUCONFIG_NO_TRANSLITERATION=1"
-         - "-DUCONFIG_NO_REGULAR_EXPRESSIONS=1"
-         - "-DUCONFIG_NO_SERVICE=1"
-         - "-DUCONFIG_NO_FILTERED_BREAK_ITERATION=1"
-         # Turn on all the options in one test.
-         - "-DUCONFIG_NO_LEGACY_CONVERSION=1 -DUCONFIG_NO_NORMALIZATION=1 -DUCONFIG_NO_BREAK_ITERATION=1 -DUCONFIG_NO_IDNA=1 -DUCONFIG_NO_COLLATION=1 -DUCONFIG_NO_FORMATTING=1 -DUCONFIG_NO_TRANSLITERATION=1 -DUCONFIG_NO_REGULAR_EXPRESSIONS=1 -DUCONFIG_NO_SERVICE=1 -DUCONFIG_NO_FILTERED_BREAK_ITERATION=1"
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Verify no additional new UCONFIG_NO_xxx added
-        run: |
-          # Test that we have exactly 12 "#ifndef UCONFIG_NO_" in uconfig.h. If the number changes, we need to also
-          # adjust the uconfig_cppflags above to include the new one and update the "12" below.
-          expected_count="12";
-          count=`egrep "#ifndef UCONFIG_NO_" icu4c/source/common/unicode/uconfig.h| wc -l`;
-          if [ $expected_count != $count ]; then
-              echo "More than %s UCONFIG_NO_* defined in uconfig.h, please adjust uconfig_cppflags above to include any newly added flag" % $expected_count;
-              echo "Currently UCONFIG_NO_* defined in uconfig.h:";
-              egrep "#ifndef UCONFIG_NO_" icu4c/source/common/unicode/uconfig.h;
-              exit -1
-          fi
-      - name: Build and Test
-        env:
-          CPPFLAGS: ${{ matrix.uconfig_cppflags }}
-        run: |
-          cd icu4c/source/;
-          ./runConfigureICU Linux;
-          make -j -l4.5 tests;
-
-  # Run header tests with UCONFIG_NO_XXX variations.
-  uconfig-header-tests:
-    runs-on: ubuntu-20.04
-    strategy:
-      # "fail-fast: false" lets other jobs keep running even if the test breaks in some other uconfig.
-      fail-fast: false
-      matrix:
-        uconfig_cppflags:
-         # Ignore the following two.
-         # - "-DUCONFIG_NO_FILE_IO=1"
-         # - "-DUCONFIG_NO_CONVERSION=1"
-         - "-DUCONFIG_NO_LEGACY_CONVERSION=1"
-         - "-DUCONFIG_NO_NORMALIZATION=1"
-         - "-DUCONFIG_NO_BREAK_ITERATION=1"
-         - "-DUCONFIG_NO_IDNA=1"
-         - "-DUCONFIG_NO_COLLATION=1"
-         - "-DUCONFIG_NO_FORMATTING=1"
-         - "-DUCONFIG_NO_TRANSLITERATION=1"
-         - "-DUCONFIG_NO_REGULAR_EXPRESSIONS=1"
-         - "-DUCONFIG_NO_SERVICE=1"
-         - "-DUCONFIG_NO_FILTERED_BREAK_ITERATION=1"
-         # Turn on all the options in one test.
-         - "-DUCONFIG_NO_LEGACY_CONVERSION=1 -DUCONFIG_NO_NORMALIZATION=1 -DUCONFIG_NO_BREAK_ITERATION=1 -DUCONFIG_NO_IDNA=1 -DUCONFIG_NO_COLLATION=1 -DUCONFIG_NO_FORMATTING=1 -DUCONFIG_NO_TRANSLITERATION=1 -DUCONFIG_NO_REGULAR_EXPRESSIONS=1 -DUCONFIG_NO_SERVICE=1 -DUCONFIG_NO_FILTERED_BREAK_ITERATION=1"
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Verify no additional new UCONFIG_NO_xxx added
-        run: |
-          # Test that we have exactly 12 "#ifndef UCONFIG_NO_" in uconfig.h. If the number changes, we need to also
-          # adjust the uconfig_cppflags above to include the new one and update the "12" below.
-          count=`egrep "#ifndef UCONFIG_NO_" icu4c/source/common/unicode/uconfig.h| wc -l`;
-          if [ "12" != $count ]; then
-              echo "More than %s UCONFIG_NO_* defined in uconfig.h, please adjust uconfig_cppflags above to include any newly added flag" % $count;
-              echo "Currently UCONFIG_NO_* defined in uconfig.h:";
-              egrep "#ifndef UCONFIG_NO_" icu4c/source/common/unicode/uconfig.h;
-              exit -1
-          fi
-      - name: Build and Install
-        run: |
-          cd icu4c/source/;
-          mkdir /tmp/icu_cnfg;
-          ./runConfigureICU Linux --prefix=/tmp/icu_cnfg;
-          make -j -l4.5 install;
-      - name: Test
-        env:
-          UCONFIG_NO: ${{ matrix.uconfig_cppflags }}
-        run: |
-          cd icu4c/source/;
-          PATH=/tmp/icu_cnfg/bin:$PATH make -C test/hdrtst check;
-
-  # Build Unicode update tools
-  unicode-update-tools:
-    runs-on: ubuntu-20.04
-    steps:
-    - uses: actions/checkout@v3
-    - uses: bazelbuild/setup-bazelisk@v2
-    - name: Get CI Linux runner VM version
-      id: linux-version
-      run: |
-        echo "LINUX_VERSION=$(grep -F VERSION_ID /etc/os-release | cut -d'"' -f2)" >> $GITHUB_OUTPUT
-    - name: Mount bazel cache
-      uses: actions/cache@v3
-      with:
-        path: "~/.cache/bazel"
-        key: bazel-${{ runner.os }}-${{ steps.linux-version.outputs.LINUX_VERSION }}
-
-    - name: Generate the data
-      run: |
-        export ICU_SRC=`pwd`;
-        icu4c/source/data/unidata/generate.sh;
-        if $?
-        then
-          echo
-          echo Build of Unicode update tools failed.
-          echo See
-          echo https://unicode-org.github.io/icu/processes/unicode-update#bazel-build-process
-          echo for how to reproduce and debug the failure
-          exit 1
-        fi
-
-        git diff --exit-code;
-        if $?
-        then
-          echo
-          echo ICU unicode data has changed!
-          echo Did you forget to include the changed data files in this PR?
-          exit 1
-        fi
-
-# Build and run ICU4C samples
-  icu4c-test-samples:
-      runs-on: ubuntu-20.04
-      steps:
-      - uses: actions/checkout@v3
-
-      - name: ICU4C configure and build
-        run: |
-          # Perform an out-of-source build of icu4c
-          mkdir /tmp/icu_samples
-          cd icu4c/source
-          ./runConfigureICU Linux -prefix=/tmp/icu_samples
-          make install
-          # Reference the paths in the new build
-          cd samples
-          # To clean all the test binaries
-          make clean-samples-recursive
-          # To rebuild them all
-          echo "Make all samples"
-          PATH=$PATH:/tmp/icu_samples/bin LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/tmp/icu_samples/lib make all-samples-recursive
-          # To run all tests serially
-          echo "Run all samples"
-          pwd
-          PATH=$PATH:/tmp/icu_samples/bin LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/tmp/icu_samples/lib make check-samples-recursive
-
-  # https://unicode-org.github.io/icu/processes/release/tasks/integration.html#verify-that-icu4c-tests-pass-without-collation-rule-strings
-  icu4c-without-collation-rule-strings:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install hjson dependency
-        run: |
-          sudo apt-get install python3-pip
-          pip3 install hjson
-      - name: Create data filter file to remove collation rule strings
-        run: |
-          cat > icu4c/coll-norules.hjson <<EOL
-          {
-            resourceFilters: [
-              {
-                categories: [
-                  coll_tree
-                ]
-                rules: [
-                  -/UCARules
-                  -/collations/*/Sequence
-                ]
-              }
-            ]
-          }
-          EOL
-      - name: Configure ICU4C with the data filter file
-        env:
-          ICU_DATA_FILTER_FILE: ../coll-norules.hjson
-        run: |
-          cd icu4c/source
-          ./runConfigureICU Linux
-      - name: Run tests with data-errors-as-warnings
-        env:
-          INTLTEST_OPTS: -w
-          CINTLTST_OPTS: -w
-        run: |
-          cd icu4c/source
-          make -j -l4.5 check
-  
-  # https://unicode-org.github.io/icu/processes/release/tasks/healthy-code.html#test-uconfig_no_conversion
-  icu4c-uconfig-no-conversion:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set UCONFIG_NO_CONVERSION and configure ICU4C
-        env:
-          UCONFIG_NO_CONVERSION: 1
-        run: |
-          cd icu4c/source
-          ./runConfigureICU Linux
-      - name: Run make for stubdata, common, i18n
-        run: |
-          cd icu4c/source
-          pushd stubdata && make -j -l4.5 && popd
-          # Ensure lib directory for output object file exists
-          mkdir -p lib
-          pushd common && make -j -l4.5 && popd
-          pushd i18n && make -j -l4.5 && popd
diff --git a/.github/workflows/icu4j.yml b/.github/workflows/icu4j.yml
deleted file mode 100644
index 0665dd502ea4..000000000000
--- a/.github/workflows/icu4j.yml
+++ /dev/null
@@ -1,180 +0,0 @@
-# Copyright (C) 2016 and later: Unicode, Inc. and others.
-# License & terms of use: http://www.unicode.org/copyright.html
-#
-# GitHub Action configuration script for ICU continuous integration tasks.
-
-name: GHA ICU4J
-
-on:
-  push:
-    branches:
-      - main
-      - 'maint/maint*'
-    paths:
-      - 'icu4j/**'
-      - '.github/workflows/**'
-  pull_request:
-    branches: '**'
-    paths:
-      - 'icu4j/**'
-      - '.github/workflows/**'
-  workflow_dispatch:
-    # To trigger the Env Test workflow manually, follow the instructions in
-    # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
-
-env:
-  SHARED_MVN_ARGS: '--show-version --no-transfer-progress'
-
-permissions:
-  contents: read
-
-jobs:
-
-  # Initialize the Maven artifact cache
-  #
-  # This job is created according to the cache strategy of reuse from a single job:
-  # https://github.com/actions/cache/blob/main/caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job
-  icu4j-mvn-init-cache:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout and setup
-        uses: actions/checkout@v3
-        with:
-          lfs: true
-      - name: Checkout lfs objects
-        run: git lfs pull
-      - name: Cache local Maven repository
-        uses: actions/cache@v3
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-      - uses: actions/setup-java@v3
-        with:
-          distribution: 'temurin'
-          java-version: '8'
-      # Download all of the artifacts needed for the code and build plugins, but
-      # exclude any needed by profiles depending on system artifacts
-      - name: Download all artifacts
-        run: |
-          cd icu4j;
-          mvn ${SHARED_MVN_ARGS} dependency:go-offline -P '!old_jdk_taglet'
-          
-  # ICU4J build and unit test using Maven
-  # https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven
-  icu4j-mvn-build-and-test:
-    needs: icu4j-mvn-init-cache
-    strategy:
-      fail-fast: false
-      matrix:
-        java-version: [ '8', '11', '17' ]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout and setup
-        uses: actions/checkout@v3
-        with:
-          lfs: true
-      - name: Checkout lfs objects
-        run: git lfs pull
-      - name: Restore read-only cache of local Maven repository
-        uses: actions/cache/restore@v3
-        id: cache
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-      - uses: actions/setup-java@v3
-        with:
-          distribution: 'temurin'
-          java-version: ${{ matrix.java-version }}
-      - name: ICU4J
-        run: |
-          cd icu4j;
-          mvn ${SHARED_MVN_ARGS} verify
-      - name: List failures (if any)
-        run: |
-          cd icu4j && cat `find . -name surefire-reports -type d -exec grep -l  -r --include="*.txt" FAILED {} \;`;
-        if: ${{ failure() }}
-
-  # ICU4J build and unit test under lstm
-  lstm-icu4j-build-and-test:
-    if: false  # TODO(ICU-22505)
-    needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout and setup
-        uses: actions/checkout@v3
-        with:
-          lfs: true
-      - name: Checkout lfs objects
-        run: git lfs pull
-      - name: Restore read-only cache of local Maven repository
-        uses: actions/cache/restore@v3
-        id: cache
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-          lookup-only: true
-      - uses: actions/setup-java@v3
-        with:
-          distribution: 'temurin'
-          java-version: '11'
-      - name: Config LSTM and Rebuild data jar
-        run: |
-          cd icu4c/source;
-          ICU_DATA_BUILDTOOL_OPTS=--include_uni_core_data ICU_DATA_FILTER_FILE=../../.github/lstm_for_th_my.json ./runConfigureICU --enable-debug --disable-release Linux -disable-layoutex;
-          make clean;
-          make -j -l4.5 ICU4J_ROOT=../../../icu4j icu4j-data-install;
-          cd ../..
-      - name: ICU4J
-        run: |
-          cd icu4j;
-          mvn ${SHARED_MVN_ARGS} verify
-      - name: List failures (if any)
-        run: |
-          cd icu4j && cat `find . -name surefire-reports -type d -exec grep -l  -r --include="*.txt" FAILED {} \;`;
-        if: ${{ failure() }}
-
-  # ICU4J build and unit test under adaboost
-  adaboost-icu4j-build-and-test:
-    if: false # Temporary disable, until we disable the .jar creation from C and distribute the individual files
-    needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout and setup
-        uses: actions/checkout@v3
-        with:
-          lfs: true
-      - name: Checkout lfs objects
-        run: git lfs pull
-      - name: Restore read-only cache of local Maven repository
-        uses: actions/cache/restore@v3
-        id: cache
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-          lookup-only: true
-      - uses: actions/setup-java@v3
-        with:
-          distribution: 'temurin'
-          java-version: '11'
-      - name: Config Adaboost and Rebuild data jar
-        run: |
-          cd icu4c/source;
-          ICU_DATA_BUILDTOOL_OPTS=--include_uni_core_data ICU_DATA_FILTER_FILE=../../.github/adaboost.json CPPFLAGS=-DUCONFIG_USE_ML_PHRASE_BREAKING=1 ./runConfigureICU --enable-debug --disable-release Linux -disable-layoutex;
-          make clean;
-          make -j -l4.5 ICU4J_ROOT=../../../icu4j icu4j-data-install;
-          cd ../..
-      - name: ICU4J
-        run: |
-          cd icu4j;
-          mvn ${SHARED_MVN_ARGS} -Dcom.ibm.icu.impl.breakiter.useMLPhraseBreaking=true verify
-      - name: List failures (if any)
-        run: |
-          cd icu4j && cat `find . -name surefire-reports -type d -exec grep -l  -r --include="*.txt" FAILED {} \;`;
-        if: ${{ failure() }}
-
diff --git a/.github/workflows/icu_common.yml b/.github/workflows/icu_common.yml
deleted file mode 100644
index 03de448f1be3..000000000000
--- a/.github/workflows/icu_common.yml
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright (C) 2016 and later: Unicode, Inc. and others.
-# License & terms of use: http://www.unicode.org/copyright.html
-#
-# GitHub Action configuration script for ICU continuous integration tasks.
-
-name: ICU Common
-
-on:
-  push:
-    branches:
-      - main
-      - 'maint/maint*'
-  pull_request:
-    branches: '**'
-  workflow_dispatch:
-    # To trigger the Env Test workflow manually, follow the instructions in
-    # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
-
-env:
-  SHARED_MVN_ARGS: '--show-version --no-transfer-progress'
-
-permissions:
-  contents: read
-
-jobs:
-
-  # Copyright scan
-  copyright-scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - run: perl tools/scripts/cpysearch/cpyscan.pl
-
-  # Check source files for valid UTF-8 and for absence of BOM.
-  valid-UTF-8-and-no-BOM-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - run: tools/scripts/icu-file-utf8-check.py
-
-  # Initialize the Maven artifact cache
-  #
-  # This job is created according to the cache strategy of reuse from a single job:
-  # https://github.com/actions/cache/blob/main/caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job
-  icu4j-mvn-init-cache:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout and setup
-        uses: actions/checkout@v3
-        with:
-          lfs: true
-      - name: Checkout lfs objects
-        run: git lfs pull
-      - name: Cache local Maven repository
-        uses: actions/cache@v3
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-      - uses: actions/setup-java@v3
-        with:
-          distribution: 'temurin'
-          java-version: '8'
-      # Download all of the artifacts needed for the code and build plugins, but
-      # exclude any needed by profiles depending on system artifacts
-      - name: Download all artifacts
-        run: |
-          cd icu4j;
-          mvn ${SHARED_MVN_ARGS} dependency:go-offline -P '!old_jdk_taglet'
-
-  # Verify icu4c release tools buildability.
-  icu4c-release-tools:
-    needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Restore read-only cache of local Maven repository
-        uses: actions/cache/restore@v3
-        id: cache
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-      - run: mvn ${SHARED_MVN_ARGS} -f tools/release/java/pom.xml package dependency:analyze
diff --git a/.github/workflows/icu_docs.yml b/.github/workflows/icu_docs.yml
deleted file mode 100644
index 35cd1902b8e5..000000000000
--- a/.github/workflows/icu_docs.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-# Copyright (C) 2016 and later: Unicode, Inc. and others.
-# License & terms of use: http://www.unicode.org/copyright.html
-#
-# GitHub Action configuration script for ICU continuous integration tasks.
-
-name: GHA ICU Docs
-
-on:
-  push:
-    branches:
-      - main
-      - 'maint/maint*'
-    paths:
-      - 'docs/**'
-      - '.github/workflows/**'
-  pull_request:
-    branches: '**'
-    paths:
-      - 'docs/**'
-      - '.github/workflows/**'
-  workflow_dispatch:
-    # To trigger the Env Test workflow manually, follow the instructions in
-    # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
-
-permissions:
-  contents: read
-
-jobs:
-  # Build job
-  # Keep in sync with deploy workflow in `jekyll-gh-pages.yml`
-  test-docs-build:
-    name: Test build of User Guide docs
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: '2.7.4' # Not needed with a .ruby-version file
-          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
-          cache-version: 0 # Increment this number if you need to re-download cached gems
-      - name: Setup Pages
-        id: pages
-        uses: actions/configure-pages@v3
-        with:
-          generator_config_file: docs/_config.yml
-      - name: Build with Jekyll
-        # Outputs to the './_site' directory by default
-        run: |
-          cd docs  # root directory of markdown, also contains Jekyll configs, etc.
-          bundle install
-          # The baseurl arg is parsed from the `baseurl` field of _config.yml.
-          bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
-        env:
-          JEKYLL_ENV: production
diff --git a/.github/workflows/icu_envtest.yml b/.github/workflows/icu_envtest.yml
index 4b6a9c56e405..198fd49968d9 100644
--- a/.github/workflows/icu_envtest.yml
+++ b/.github/workflows/icu_envtest.yml
@@ -43,7 +43,7 @@ jobs:
         run: |
           locale -a;
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Build
         run: |
           cd icu4c/source/;
@@ -102,7 +102,7 @@ jobs:
           find /usr/share/zoneinfo/ -type f,l|egrep -v "/(right|posix)/"|egrep -v "\.tab"|wc -l;
           find /usr/share/zoneinfo/ -type f,l|egrep -v "/(right|posix)/"|egrep -v "\.tab"|cut -d '/' -f5-50;
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Build
         run: |
           cd icu4c/source/;
diff --git a/.github/workflows/icu_merge_ci.yml b/.github/workflows/icu_merge_ci.yml
index 4235730cdbf6..9ff860f3b1da 100644
--- a/.github/workflows/icu_merge_ci.yml
+++ b/.github/workflows/icu_merge_ci.yml
@@ -32,17 +32,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Cache local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -58,20 +58,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -92,7 +92,7 @@ jobs:
     if: github.repository == 'unicode-org/icu' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Build ICU libraries
         run: |
@@ -102,7 +102,7 @@ jobs:
           cd lib;
           cp -Ps ../tools/ctestfw/libicutest* .
       - name: Upload ICU libraries
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: icu-perf-libs
           path: icu4c/source/lib
@@ -133,11 +133,11 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Create directory for lib files
         run: mkdir icu4c/source/perflib
       - name: Get ICU libs
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: icu-perf-libs
           path: icu4c/source/lib
@@ -207,11 +207,11 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Create directory for lib files
         run: mkdir icu4c/source/perflib
       - name: Get ICU libs
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: icu-perf-libs
           path: icu4c/source/lib
@@ -272,11 +272,11 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Create directory for lib files
         run: mkdir icu4c/source/perflib
       - name: Get ICU libs
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: icu-perf-libs
           path: icu4c/source/lib
@@ -322,20 +322,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -384,20 +384,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -448,20 +448,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -517,20 +517,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -656,20 +656,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -739,20 +739,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout and setup
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
       - name: Checkout lfs objects
         run: git lfs pull
       - name: Lookup read-only cache of local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven-
           lookup-only: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '8'
@@ -802,7 +802,7 @@ jobs:
     needs: [icu4c-performance-tests, icu4c-performance-tests-with-files, icu4c-strsrchperf, icu4j-unicodesetperf, icu4j-ucharacterperf, icu4j-decimalformatperf, icu4j-normperf, icu4j-converterperf, icu4j-dateformatperf]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Switch to benchmark data storage branch.
         run: |
@@ -810,7 +810,7 @@ jobs:
           git checkout perfdata
 
       - name: Publish data
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           deploy_key: ${{ secrets.ACTIONS_DEPLOY_KEY }}
           external_repository: unicode-org/icu-perf
diff --git a/.github/workflows/icu_valgrind.yml b/.github/workflows/icu_valgrind.yml
deleted file mode 100644
index ab62f36d680c..000000000000
--- a/.github/workflows/icu_valgrind.yml
+++ /dev/null
@@ -1,110 +0,0 @@
-# Copyright (C) 2023 and later: Unicode, Inc. and others.
-# License & terms of use: http://www.unicode.org/copyright.html
-#
-# GitHub Action configuration script for ICU continuous integration tasks
-# for Valgrind
-
-name: GHA CI Valgrind
-
-on:
-  push:
-    branches:
-      - main
-      - 'maint/maint*'
-    paths:
-      - 'icu4c/**'
-      - '.github/workflows/**'
-  pull_request:
-    branches: '**'
-    paths:
-      - 'icu4c/**'
-      - '.github/workflows/**'
-
-permissions:
-  contents: read
-
-jobs:
-  clang-valgrind-test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install valgrind
-        run: |
-          set -ex;
-          sudo apt-get -y update;
-          sudo apt-get install -y valgrind;
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Build with debug enable
-        env:
-          CC: clang
-          CFLAGS: -gdwarf-4
-          CXX: clang++
-          CXXFLAGS: -gdwarf-4
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU --enable-debug Linux --disable-renaming && make -j -l4.5 tests;
-      - name: Test iotest with valgrind
-        run: |
-          cd icu4c/source/test/iotest
-          LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH \
-              valgrind --tool=memcheck --error-exitcode=1 --leak-check=full \
-              --show-reachable=yes ./iotest
-      - name: Test cintltst with valgrind
-        run: |
-          cd icu4c/source/test/cintltst
-          LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH \
-              valgrind --tool=memcheck --error-exitcode=1 --leak-check=full \
-              --show-reachable=yes ./cintltst
-      - name: Test icuinfo with valgrind
-        run: |
-          cd icu4c/source/tools/icuinfo
-          LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH \
-              valgrind --tool=memcheck --error-exitcode=1 --leak-check=full \
-              --show-reachable=yes ./icuinfo;
-
-  clang-valgrind-intltest:
-    runs-on: ubuntu-latest
-    strategy:
-      # "fail-fast: false" lets other jobs keep running even if the test breaks in some other test.
-      fail-fast: false
-      matrix:
-        case: [utility, normalize, collator, regex, format, translit,
-              rbbi, rbnf, rbnfrt, icuserv, idna, convert, rbnfp, csdet,
-              spoof, bidi]
-    steps:
-      - name: Install valgrind
-        run: |
-          set -ex;
-          sudo apt-get -y update;
-          sudo apt-get install -y valgrind;
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Build with debug enable
-        env:
-          CC: clang
-          CFLAGS: -gdwarf-4
-          CXX: clang++
-          CXXFLAGS: -gdwarf-4
-        run: |
-          cd icu4c/source;
-          ./runConfigureICU --enable-debug Linux --disable-renaming && make -j -l4.5 tests;
-      - name: Check all top path in intltest is covered
-        run: |
-          cd icu4c/source/test/intltest;
-          if [ $(LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH \
-              ./intltest LIST |
-              egrep "^   [a-z]+$" | awk '{print $1;}' | sort | tr '\n' '|') != \
-              "bidi|collate|convert|csdet|format|icuserv|idna|normalize|rbbi|rbnf|rbnfp|rbnfrt|regex|spoof|translit|utility|" ]
-          then
-              echo ICU has made changes to the top level tests in intltest!
-              echo Please update this workflow file to include those top level tests in
-              echo the "case" list.
-              exit -1
-          fi
-
-      - name: Test with valgrind
-        run: |
-          cd icu4c/source/test/intltest
-          LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH \
-              valgrind --tool=memcheck --error-exitcode=1 --leak-check=full \
-              --show-reachable=yes ./intltest ${{ matrix.case }};
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index 40948e996582..8333cf13c700 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -37,16 +37,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@8575951200e472d5f2d95c625da0c7bec8217c42 # v1.161.0
         with:
           ruby-version: '2.7.4' # Not needed with a .ruby-version file
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
           cache-version: 0 # Increment this number if you need to re-download cached gems
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v3
+        uses: actions/configure-pages@f156874f8191504dae5b037505266ed5dda6c382 # v3.0.6
         with:
           generator_config_file: docs/_config.yml
       - name: Build with Jekyll
@@ -59,7 +59,7 @@ jobs:
         env:
           JEKYLL_ENV: production
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v1
+        uses: actions/upload-pages-artifact@a753861a5debcf57bf8b404356158c8e1e33150c # v2.0.0
         with:
           path: docs/_site
 
@@ -76,4 +76,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@9dbe3824824f8a1377b8e298bafde1a50ede43e5 # v2.0.4
diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml
index bfcb5fed2947..d926b68c3453 100644
--- a/.github/workflows/maven.yaml
+++ b/.github/workflows/maven.yaml
@@ -18,10 +18,10 @@ jobs:
     permissions:
       packages: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           lfs: true
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '11'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b0bdaef3c3db..79bb4ad289e7 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -29,12 +29,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@v2.2.0
+        uses: ossf/scorecard-action@v2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -51,7 +51,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v3.1.2
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: SARIF file
           path: results.sarif
@@ -59,6 +59,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v2.20.1
+        uses: github/codeql-action/upload-sarif@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
         with:
           sarif_file: results.sarif