Merge pull request #164 from hartwork/pin-github-actions-at-commit-level

Pin GitHub Actions to specific commits for security

.github/workflows/pre_commit_detect_outdated.yml

@@ -18,10 +18,10 @@ jobs:
     name: Detect outdated pre-commit hooks
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab  # v3.5.2
 
       - name: Set up Python 3.11
-        uses: actions/[email protected]
+        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435  # v4.5.0
         with:
           python-version: 3.11
 
@@ -41,7 +41,7 @@ jobs:
 
       - name: Create pull request from changes (if any)
         id: create-pull-request
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@5b4a9f6a9e2af26e5f02351490b90d01eb8ec1e5  # v5.0.0
         with:
           author: 'pre-commit <[email protected]>'
           base: master

.github/workflows/pre_commit_run.yml

@@ -12,10 +12,10 @@ jobs:
     name: Run pre-commit on all files
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab  # v3.5.2
 
       - name: Set up Python 3.8
-        uses: actions/[email protected]
+        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435  # v4.5.0
         with:
           python-version: 3.8
 

.github/workflows/python_test_suite.yml

@@ -15,10 +15,10 @@ jobs:
         python-version: [3.7, 3.11]  # no particular need for in-between versions
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab  # v3.5.2
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/[email protected]
+        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435  # v4.5.0
         with:
           python-version: ${{ matrix.python-version }}