Merge pull request #853 from bennettoxford/renovate/pin-dependencies

Pin dependencies

Author: rebkwok

.github/workflows/main.yml

@@ -22,8 +22,8 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
           install-uv: true
@@ -37,8 +37,8 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
           install-uv: true
@@ -51,8 +51,8 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
       - name: Check formatting, linting and import sorting on docker
@@ -62,8 +62,8 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
       - name: Run tests in docker
@@ -83,8 +83,8 @@ jobs:
     concurrency: deploy-production
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
 

.github/workflows/uvmirror-update.yml

@@ -18,8 +18,8 @@ jobs:
     outputs:
       changed: ${{ steps.check_for_changes.outputs.changed }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
           install-uv: true
@@ -45,18 +45,18 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         id: generate-token
         with:
           app-id: ${{ vars.CREATE_PR_APP_ID }}
           private-key: ${{ secrets.CREATE_PR_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ env.BRANCH_NAME }}
           token: ${{ steps.generate-token.outputs.token }}
 
-      - uses: opensafely-core/setup-action@v1
+      - uses: opensafely-core/setup-action@c458795dc9c6f219fa1cbf6148940db57c3ac03d # v1
         with:
           install-just: true
           install-uv: true