ci: Update PR template, expand action tags

.github/pull_request_template.md

@@ -1,44 +1,25 @@
-## Description
-
-<!--
-Using AI? READ FIRST: https://holoviz.org/contribute.html#ai-readme
+<!-- Using AI? READ FIRST: https://holoviz.org/contribute.html#ai-readme -->
+<!-- First time contributor: https://www.holoviews.org/developer_guide/index.html#making-a-pull-requests -->
 
-- Summarize the change and which issue is fixed.
-- Include relevant motivation and context.
-- Add visuals when possible, e.g. before/after screenshots with full code snippets.
--->
+## Description
+<!-- Summarize the change and which issue is fixed. Be sure to include relevant motivation and context. Describe the tests run to verify these changes and how to reproduce them (copy-pastable minimal, reproducible example). Include visuals when possible (e.g. before/after screenshots). -->
 
 Fixes #{issue}
 
-## How Has This Been Tested?
-
-<!-- Describe the tests that you ran to verify your changes. Provide instructions so it can be reproduced while reviewing your changes. -->
 
 ## AI Disclosure
+<!-- Delete this section if AI was not used, else specify the tool/model (e.g. Cursor + Sonnet 4.6, Claude Code + Opus 4.6, ChatGPT) and briefly describe how it was used. Failure to disclose AI usage may result in a ban. -->
 
-<!-- Remove this section if your PR does not contain AI-generated content. -->
-<!-- Failure in disclosing the use of AI will result in a ban. -->
+- Tool & Model:
+- Usage:
 
-- [ ] This PR contains AI-generated content.
-  - [ ] I have tested all AI-generated content in my PR.
-  - [ ] I take responsibility for all AI-generated content in my PR.
+- [ ] I have tested all AI-generated content in my PR.
+- [ ] I take responsibility for all AI-generated content in my PR.
 
-<!-- If you used AI to generate code, please specify the tool and model used, and briefly describe how they were used. -->
-
-Tools and Models: {e.g., Cursor + Sonnet 4.6, Claude Code + Opus 4.6, Antigravity + Gemini Flash 3, ChatGPT, etc.}
 
 ## Checklist
-
 <!-- Remove the non relevant items. -->
 
 - [ ] Pull request title follows the conventional format
-- [ ] Tests added and is passing
+- [ ] Tests added and are passing
 - [ ] Added documentation
-
-<!--
-Conventional format: <Type>(<Scope>): <Subject>
-Valid Types: `build`, `chore`, `ci`, `compat`, `docs`, `enh`, `feat`, `fix`, `perf`, `refactor`, `test`, and `type`
-Valid Scopes (optional): `dev`, `data`, `plotting`, `bokeh`, `matplotlib`, `plotly`, and `notebook`
-
-For more information on how to contribute to this repository, see the [developer guide](https://www.holoviews.org/developer_guide/index.html)
--->

.github/workflows/build.yaml

@@ -49,7 +49,7 @@ jobs:
           install: false
       - name: conda build
         run: pixi run -e build build-conda
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: artifacts-conda
@@ -62,7 +62,7 @@ jobs:
     needs: [conda_build, waiting_room]
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: artifacts-conda
           path: dist/
@@ -91,7 +91,7 @@ jobs:
           install: false
       - name: Build package
         run: pixi run -e build build-pip
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: artifacts-pip
@@ -106,10 +106,10 @@ jobs:
     runs-on: "ubuntu-latest"
     needs: [pip_build]
     steps:
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: artifacts-pip
           path: dist/
@@ -126,12 +126,12 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: artifacts-pip
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1.14
 
   announce:
     name: Announce GitHub
@@ -143,10 +143,10 @@ jobs:
     env:
       TAG: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: artifacts-*
           path: artifacts/

.github/workflows/docs.yaml

@@ -46,7 +46,7 @@ jobs:
           environments: docs
       - name: Build documentation
         run: pixi run -e docs docs-build
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: docs
@@ -63,7 +63,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: docs
           path: builtdocs/

.github/workflows/lock.yaml

@@ -16,7 +16,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
         with:
           issue-inactive-days: "100"
           pr-inactive-days: "100"

.github/workflows/test.yaml

@@ -46,22 +46,33 @@
     steps:
       - uses: holoviz-dev/holoviz_tasks/pre-commit@ffddda04b2894fea39b407f64d3622d2f19e5a9f # v1
 
+  png_optimize:
+    name: Run pre-commit
+    needs: [setup]
+    runs-on: "ubuntu-latest"
+    if: needs.setup.outputs.img_change == 'true'
+    permissions:
+      contents: write
+    steps:
+      - uses: holoviz-dev/holoviz_tasks/png-optimize@optimize-png
+
   setup:
     name: Setup workflow
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
     outputs:
       code_change: ${{ steps.filter.outputs.code }}
+      img_change: ${{ steps.filter.outputs.img }}
       matrix: ${{ env.MATRIX }}
       matrix_option: ${{ env.MATRIX_OPTION }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: github.event_name != 'pull_request'
         with:
           persist-credentials: false
       - name: Check for code changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
@@ -71,6 +82,8 @@
               - 'pixi.toml'
               - 'pyproject.toml'
               - '.github/workflows/test.yaml'
+            img:
+              - '**/*.png'
       - name: Set matrix option
         env:
           GITHUB_EVENT_INPUTS_TARGET: ${{ github.event.inputs.target }}
@@ -146,7 +159,7 @@
       - name: Test Examples
         run: |
           pixi run -e "${ENV}" test-example
-      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
+      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -175,13 +188,13 @@
           echo "[run]\nconcurrency = greenlet" > .uicoveragerc
           FAIL="--screenshot only-on-failure --full-page-screenshot --output ui_screenshots --tracing retain-on-failure"
           pixi run -e "${ENV}" test-ui $COV --cov-config=.uicoveragerc $FAIL
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: ui_screenshots_${{ runner.os }}
           path: ./ui_screenshots
           if-no-files-found: ignore
-      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
+      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -232,7 +245,14 @@
 
   result_test_suite:
     name: result:test
-    needs: [unit_test_suite, ui_test_suite, core_test_suite, type_suite]
+    needs:
+      [
+        unit_test_suite,
+        ui_test_suite,
+        core_test_suite,
+        type_suite,
+        png_optimize,
+      ]
     if: always()
     runs-on: ubuntu-latest
     steps:

.github/workflows/zizmor.yaml

@@ -24,6 +24,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@b572f7b1a1c2d41efaab43d504f68d215c3cd727 # v0.5.4
         # with:
         #   persona: auditor

.pre-commit-config.yaml

@@ -38,7 +38,7 @@ repos:
     rev: fb4fd26ea947350ec231580772317ec7261c8e21 # frozen: v3.8.3
     hooks:
       - id: prettier
-        exclude: conda.recipe/meta.yaml
+        exclude: conda.recipe/meta.yaml|pull_request_template.md
         types_or:
           - markdown
           - yaml