ci: pin actions to sha (#1462)

* ci: pin actions to sha

refs: equinor/ecalc-internal#1658

* ci: add version comment to pinned actions

Author: Aleksander-Karlsson

.github/workflows/ensure-code-quality.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   workflow_call:
 
-permissions: {}
+permissions: { }
 
 env:
   UV_SYSTEM_PYTHON: 1
@@ -16,10 +16,10 @@ jobs:
     name: Build & Run Pre Commit hooks to verify code structure, quality etc. from pre-commit hooks
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -35,10 +35,10 @@ jobs:
     name: Type check with basedpyright
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 

.github/workflows/license-scan.yml

@@ -12,16 +12,16 @@ jobs:
       contents: read
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: 'Dependency Review'
         id: review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         with:
           allow-licenses: 0BSD, BSD-1-Clause, BSD-2-Clause, BSD-3-Clause, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, MIT, WTFPL, Apache-2.0, MPL-2.0, ISC
-# Note that we explicitly allow LGPL-2.x-or-later, since LGPL-2.x (only) is not compatible with LGPL-3.x
-#          allow-dependencies-licenses: 'pkg:pypi/numpy'
-#
+      # Note that we explicitly allow LGPL-2.x-or-later, since LGPL-2.x (only) is not compatible with LGPL-3.x
+      #          allow-dependencies-licenses: 'pkg:pypi/numpy'
+      #
       - name: 'Disallow unlicensed/unknown license'
         shell: bash
         env:

.github/workflows/publish-docs.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   workflow_call:
 
-permissions: {}
+permissions: { }
 
 env:
   GITHUB_PAGES_BRANCH: gh-pages
@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -43,7 +43,7 @@ jobs:
           uv run python generate_json_schema.py > ../docs/docs/about/getting_started/yaml/ecalc_json_schema.json
 
       - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 24
           cache: npm

.github/workflows/publish-libecalc.yml

@@ -2,7 +2,7 @@ name: Publish libeCalc package to PyPI
 
 on:
   workflow_run:
-    workflows: [release-please]
+    workflows: [ release-please ]
     types:
       - completed
   # Note! We cannot trigger on published event, since that can only be triggered when done manually (or with a
@@ -16,17 +16,17 @@ on:
   # NOTE!: When using Trusted Publishing to PyPI, we cannot do that from within a reusable workflow, therefore
   # we make it independent, and trigger it with published event from release-please workflow, instead of calling explicitly.
 
-permissions: {}
+permissions: { }
 
 jobs:
-  check-release-created:  # Parses JSON file from release-please workflow to see if a release was created
+  check-release-created: # Parses JSON file from release-please workflow to see if a release was created
     permissions:
       actions: read # to dl artifacts from triggering workflow
       contents: read
     runs-on: ubuntu-24.04
     steps:
       - name: Download release-please outputs
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-please-outputs
           run-id: ${{ github.event.workflow_run.id }}
@@ -55,13 +55,13 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # NOTE: Make sure we publish from the main branch, not the triggering ref
           ref: ${{ github.event.repository.default_branch }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -75,7 +75,7 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           # repository-url: https://test.pypi.org/legacy/ # NOTE: Only needed to specify for Test PyPI
           packages-dir: dist/

.github/workflows/release-please.yml

@@ -7,7 +7,7 @@ on:
     types:
       - completed
 
-permissions: {}
+permissions: { }
 
 jobs:
   release-please:
@@ -17,7 +17,7 @@ jobs:
       issues: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         id: release
         with:
           config-file: 'release-please-config.json'
@@ -39,13 +39,13 @@ jobs:
       - name: set release created
         if: ${{ needs.release-please.outputs.release_created == 'true' }}
         run: |
-            echo '{"release_created":"true"}' > release-please-data/outputs.json
+          echo '{"release_created":"true"}' > release-please-data/outputs.json
       - name: set release NOT created
         if: ${{ needs.release-please.outputs.release_created != 'true' }}
         run: |
           echo '{"release_created":"false"}' > release-please-data/outputs.json
       - name: Upload release-please data
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: release-please-outputs
           path: release-please-data/

.github/workflows/test-docs.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   workflow_call:
 
-permissions: {}
+permissions: { }
 
 jobs:
   build-docs:
@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -37,7 +37,7 @@ jobs:
           uv run python generate_json_schema.py > ../docs/docs/about/getting_started/yaml/ecalc_json_schema.json
 
       - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 24
           cache: npm

.github/workflows/test-library.yml

@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
   workflow_call:
 
-permissions: {}
+permissions: { }
 
 jobs:
   test-library:
@@ -17,10 +17,10 @@ jobs:
         group: [ 1,2,3,4,5 ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}