Simplify if conditions and use hash of actions instead of version

Author: thomass-dev

.github/workflows/backend.yml

@@ -41,7 +41,7 @@ jobs:
   backend-lint:
     runs-on: "ubuntu-latest"
     needs: [backend-changes]
-    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    if: ${{ (github.event_name == 'push') || (needs.backend-changes.outputs.changes == 'true') }}
     permissions:
       contents: read
     steps:
@@ -66,7 +66,7 @@ jobs:
   backend-lockfiles:
     runs-on: "ubuntu-latest"
     needs: [backend-changes]
-    if: ${{ (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    if: ${{ (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name)) && (needs.backend-changes.outputs.changes == 'true') }}
     permissions:
       contents: read
     steps:
@@ -89,7 +89,7 @@ jobs:
 
   backend-test:
     needs: [backend-changes]
-    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    if: ${{ (github.event_name == 'push') || (needs.backend-changes.outputs.changes == 'true') }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/sphinx.yml

@@ -86,7 +86,7 @@ jobs:
   sphinx-version:
     runs-on: ubuntu-latest
     needs: [sphinx-changes]
-    if: ${{ (! contains(fromJSON('["pull_request", "merge_group"]'), github.event_name)) || needs.sphinx-changes.outputs.changes == 'true' }}
+    if: ${{ (contains(fromJSON('["push", "release"]'), github.event_name)) || (needs.sphinx-changes.outputs.changes == 'true') }}
     outputs:
       SPHINX_VERSION: ${{ steps.sphinx-version.outputs.SPHINX_VERSION }}
       SPHINX_RELEASE: ${{ steps.sphinx-version.outputs.SPHINX_RELEASE }}
@@ -112,12 +112,12 @@ jobs:
   sphinx-build:
     runs-on: ubuntu-latest
     needs: [sphinx-version]
-    if: ${{ (! contains(fromJSON('["pull_request", "merge_group"]'), github.event_name)) || needs.sphinx-changes.outputs.changes == 'true' }}
+    if: ${{ (contains(fromJSON('["push", "release"]'), github.event_name)) || (needs.sphinx-changes.outputs.changes == 'true') }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: 'true'
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: '3.12'
           cache: 'pip'
@@ -127,21 +127,21 @@ jobs:
           SPHINX_VERSION: ${{ needs.sphinx-version.outputs.SPHINX_VERSION }}
           SPHINX_RELEASE: ${{ needs.sphinx-version.outputs.SPHINX_RELEASE }}
           SPHINX_DOMAIN: ${{ vars.DOCUMENTATION_DOMAIN }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sphinx-html-artifact
           path: sphinx/build/html/
 
   sphinx-deploy-html:
-    if: ${{ (github.event_name == 'release') || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
+    if: ${{ (contains(fromJSON('["push", "release"]'), github.event_name)) }}
     runs-on: ubuntu-latest
     needs: [sphinx-version, sphinx-build]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Download HTML artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
         with:
           name: sphinx-html-artifact
           path: html/
@@ -171,7 +171,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [sphinx-version, sphinx-build, sphinx-deploy-html]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - shell: python
         run: |
             import os
@@ -251,7 +251,7 @@ jobs:
     if: ${{ always() && (github.event_name != 'pull_request') }}
     needs: [sphinx-version, sphinx-build, sphinx-deploy-html, sphinx-deploy-root-files]
     steps:
-      - uses: geekyeggo/delete-artifact@v5
+      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
         with:
           name: sphinx-html-artifact