Pin github actions by commit

.github/workflows/github-issue-labeler.yml

@@ -2,7 +2,7 @@ name: New issue labeler
 on:
   # Runs on newly opened issues 
   issues:
-    types: [opened]
+    types: [ opened ]
 
 # Sets permissions of the GITHUB_TOKEN
 permissions:
@@ -13,8 +13,8 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: github/[email protected]
-      with:
-        configuration-path: .github/labeler.yml
-        enable-versioned-regex: 0
-        repo-token: "${{secrets.GITHUB_TOKEN}}"
+      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # pin@v3.4
+        with:
+          configuration-path: .github/labeler.yml
+          enable-versioned-regex: 0
+          repo-token: "${{secrets.GITHUB_TOKEN}}"

.github/workflows/github-pages.yml

@@ -3,13 +3,13 @@ name: Pages - deploy
 on:
   # Runs on pushes targeting the default branch
   push:
-    branches: ["main"]
-    paths: [website]
+    branches: [ "main" ]
+    paths: [ website ]
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+    # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
   contents: read
   pages: write
@@ -28,26 +28,26 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: ./website   
+        working-directory: ./website
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
         with:
           ref: main
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # pin@v4
         with:
           node-version: 18.x
       - name: Install dependencies
         run: npm install
       - name: Build
         run: npm run build-github
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # pin@v4
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # pin@v3
         with:
           path: './website/dist'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # pin@v4

.github/workflows/js-docs-builder.yml

@@ -3,15 +3,15 @@ name: JS - generate docs
 on:
   # Runs on pushes targeting the default branch
   push:
-    branches: ["main"]
+    branches: [ "main" ]
     paths:
       - 'js/**'
       - '.github/workflows/**'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN
+    # Sets permissions of the GITHUB_TOKEN
 permissions:
   contents: write
   id-token: write
@@ -21,15 +21,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
         with:
           ref: main
       - name: Generate docs
         working-directory: js
         run: |
-            yarn
-            yarn run build
-            yarn run make-docs
+          yarn
+          yarn run build
+          yarn run make-docs
       - name: Commit
         run: |
           git config --local user.email "[email protected]"

.github/workflows/js-publish.yml

@@ -1,15 +1,15 @@
 name: JS - publish
 on:
   workflow_dispatch:
-  push: 
+  push:
     tags:
-    - 'js-v[0-9]+.[0-9]+.[0-9]+'
+      - 'js-v[0-9]+.[0-9]+.[0-9]+'
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # pin@v4
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/js-test.yml

@@ -17,12 +17,12 @@ jobs:
   unit-testing:
     strategy:
       matrix:
-        node-version: ["18", "20"]
-        os: ["ubuntu-latest", "macos-latest"]
+        node-version: [ "18", "20" ]
+        os: [ "ubuntu-latest", "macos-latest" ]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # pin@v4
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
@@ -34,4 +34,3 @@ jobs:
       - name: Run tests
         working-directory: js
         run: yarn test
-

.github/workflows/python-e2e-test.yml

@@ -1,33 +1,33 @@
 name: Python - integration tests
 on:
-    push:
-      branches:
-        - 'main'
-      paths:
-        - 'python/**'
-        - '.github/workflows/**'
-    pull_request:
-      paths:
-        - 'python/**'
-        - '.github/workflows/**'
+  push:
+    branches:
+      - 'main'
+    paths:
+      - 'python/**'
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - 'python/**'
+      - '.github/workflows/**'
 
 jobs:
   e2e-testing:
     strategy:
       matrix:
-        python-version: ["3.8.x", "3.9.x", "3.10.x", "3.11.x", "3.12.x"]
-        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
+        python-version: [ "3.8.x", "3.9.x", "3.10.x", "3.11.x", "3.12.x" ]
+        os: [ "ubuntu-latest", "macos-latest", "windows-latest" ]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # pin@v5
         with:
           python-version: '${{ matrix.python-version }}'
 
       - name: Install poetry
-        uses: abatilo/actions-poetry@v3
+        uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 # pin@v3
         with:
           poetry-version: "1.7.1"
 

.github/workflows/python-pypi.yml

@@ -1,10 +1,10 @@
-name: Python - publish 
+name: Python - publish
 
 on:
   workflow_dispatch:
-  push: 
+  push:
     tags:
-    - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
 
 jobs:
   deploy:
@@ -16,15 +16,15 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # pin@v5
         with:
           python-version: '3.10.x'
 
       - name: Install Poetry
-        uses: snok/install-poetry@v1
+        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # pin@v1
         with:
           virtualenvs-create: false
 
@@ -36,7 +36,7 @@ jobs:
 
       - name: Mint token
         id: mint
-        uses: tschm/[email protected]
+        uses: tschm/token-mint-action@eef668ab210066f42abfe3f2af4e03ec24f30089 # pin@v1.0.3
 
       - name: Publish the package with poetry
         run: |

.github/workflows/python-test.yml

@@ -19,19 +19,19 @@ jobs:
   unit-testing:
     strategy:
       matrix:
-        python-version: ["3.8.x", "3.9.x", "3.10.x", "3.11.x", "3.12.x"]
-        os: ["ubuntu-latest", "macos-latest"]
+        python-version: [ "3.8.x", "3.9.x", "3.10.x", "3.11.x", "3.12.x" ]
+        os: [ "ubuntu-latest", "macos-latest" ]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # pin@v5
         with:
           python-version: '${{ matrix.python-version }}'
 
       - name: Install poetry
-        uses: abatilo/actions-poetry@v3
+        uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 # pin@v3
         with:
           poetry-version: "1.7.1"