Pin Github actions, group dependabot

.github/dependabot.yml

@@ -4,3 +4,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/autoupdate.yml

@@ -1,23 +1,23 @@
 name: Auto-update mamba
 on:
- schedule:
-   - cron: "0 */6 * * *"
+  schedule:
+    - cron: "0 */6 * * *"
 jobs:
   createPullRequest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
         with:
           ssh-key: ${{ secrets.MINIFORGE_AUTOUPDATE_SSH_PRIVATE_KEY }}
-      - uses: conda-incubator/[email protected]
+      - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
         with:
           miniforge-variant: Miniforge3
           environment-file: .github/actions/autoupdate/environment.yml
       - run: python .github/actions/autoupdate/update.py
       - name: Create Pull Request
         id: cpr
         # This is the v3 tag but for security purposes we pin to the exact commit.
-        uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e
+        uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # 6d6857d36972b65feb161a90e484f2984215f83e
         with:
           commit-message: "Update mamba version"
           title: "Update mamba version"

.github/workflows/ci.yml

@@ -1,5 +1,5 @@
 name: Build miniforge
-on: [push, pull_request]
+on: [ push, pull_request ]
 
 jobs:
   build:
@@ -186,64 +186,64 @@ jobs:
             TEST_IMAGE_NAMES: "centos:7"
 
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - uses: conda-incubator/[email protected]
-      with:
-        miniforge-version: "latest"
-        miniforge-variant: Mambaforge
-        use-mamba: true
-      if: ${{ ! contains(matrix.OS_NAME, 'Linux') }}
-
-    - name: Build and test miniforge
-      env:
-        ARCH: ${{ matrix.ARCH }}
-        MINIFORGE_NAME: ${{ matrix.MINIFORGE_NAME }}
-        OS_NAME: ${{ matrix.OS_NAME }}
-        DOCKERIMAGE: ${{ matrix.DOCKERIMAGE }}
-        DOCKER_ARCH: ${{ matrix.DOCKER_ARCH }}
-        TARGET_PLATFORM: ${{ matrix.TARGET_PLATFORM }}
-        TEST_IMAGE_NAMES: ${{ matrix.TEST_IMAGE_NAMES }}
-      run: |
-        if [[ "$GITHUB_REF" == refs/tags/* ]]; then
-          export MINIFORGE_VERSION=${GITHUB_REF##*/};
-        fi
-        if [[ "$OS_NAME" == "Linux" ]]; then
-          export EXT=sh
-          bash build_miniforge.sh;
-        fi
-        if [[ "$OS_NAME" == "MacOSX" ]]; then
-          export EXT=sh
-          bash build_miniforge_osx.sh;
-        fi
-        if [[ "$OS_NAME" == "Windows" ]]; then
-          export EXT=exe
-          echo "WINDIR:$WINDIR"
-          source "${CONDA}"/Scripts/activate;
-          source build_miniforge_win.sh;
-        fi
-        # Copy for latest release
-        cp build/$MINIFORGE_NAME-*-$OS_NAME-$ARCH.$EXT build/$MINIFORGE_NAME-$OS_NAME-$ARCH.$EXT
-        if [[ "$OS_NAME" == "MacOSX" ]]; then
-          cp build/$MINIFORGE_NAME-*-$OS_NAME-$ARCH.$EXT build/$MINIFORGE_NAME-Darwin-$ARCH.$EXT
-        fi
-        ls -alh build
-      shell: bash
-
-    - name: Upload miniforge to Github artifact
-      if: always()
-      uses: actions/upload-artifact@v4
-      with:
-        path: build/${{ matrix.MINIFORGE_NAME }}-${{ matrix.OS_NAME }}-${{ matrix.ARCH }}*
-        name: ${{ matrix.MINIFORGE_NAME }}-${{ matrix.OS_NAME }}-${{ matrix.ARCH }}
-
-    - name: Upload miniforge to release
-      uses: svenstaro/upload-release-action@v2
-      with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        file: build/M*forge*
-        tag: ${{ github.ref }}
-        overwrite: true
-        file_glob: true
-      if: startsWith(github.ref, 'refs/tags/')
+      - name: Checkout code
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+
+      - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
+        with:
+          miniforge-version: "latest"
+          miniforge-variant: Mambaforge
+          use-mamba: true
+        if: ${{ ! contains(matrix.OS_NAME, 'Linux') }}
+
+      - name: Build and test miniforge
+        env:
+          ARCH: ${{ matrix.ARCH }}
+          MINIFORGE_NAME: ${{ matrix.MINIFORGE_NAME }}
+          OS_NAME: ${{ matrix.OS_NAME }}
+          DOCKERIMAGE: ${{ matrix.DOCKERIMAGE }}
+          DOCKER_ARCH: ${{ matrix.DOCKER_ARCH }}
+          TARGET_PLATFORM: ${{ matrix.TARGET_PLATFORM }}
+          TEST_IMAGE_NAMES: ${{ matrix.TEST_IMAGE_NAMES }}
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            export MINIFORGE_VERSION=${GITHUB_REF##*/};
+          fi
+          if [[ "$OS_NAME" == "Linux" ]]; then
+            export EXT=sh
+            bash build_miniforge.sh;
+          fi
+          if [[ "$OS_NAME" == "MacOSX" ]]; then
+            export EXT=sh
+            bash build_miniforge_osx.sh;
+          fi
+          if [[ "$OS_NAME" == "Windows" ]]; then
+            export EXT=exe
+            echo "WINDIR:$WINDIR"
+            source "${CONDA}"/Scripts/activate;
+            source build_miniforge_win.sh;
+          fi
+          # Copy for latest release
+          cp build/$MINIFORGE_NAME-*-$OS_NAME-$ARCH.$EXT build/$MINIFORGE_NAME-$OS_NAME-$ARCH.$EXT
+          if [[ "$OS_NAME" == "MacOSX" ]]; then
+            cp build/$MINIFORGE_NAME-*-$OS_NAME-$ARCH.$EXT build/$MINIFORGE_NAME-Darwin-$ARCH.$EXT
+          fi
+          ls -alh build
+        shell: bash
+
+      - name: Upload miniforge to Github artifact
+        if: always()
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
+        with:
+          path: build/${{ matrix.MINIFORGE_NAME }}-${{ matrix.OS_NAME }}-${{ matrix.ARCH }}*
+          name: ${{ matrix.MINIFORGE_NAME }}-${{ matrix.OS_NAME }}-${{ matrix.ARCH }}
+
+      - name: Upload miniforge to release
+        uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: build/M*forge*
+          tag: ${{ github.ref }}
+          overwrite: true
+          file_glob: true
+        if: startsWith(github.ref, 'refs/tags/')

.github/workflows/conda_release.yml

@@ -1,16 +1,16 @@
 name: Check for new conda releases
 on:
- schedule:
-   - cron: "0 */6 * * *"
+  schedule:
+    - cron: "0 */6 * * *"
 jobs:
   check_conda_release:
     name: "Check for release and open issue"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
       - name: Run Actions script
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             const script = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/conda_release.js`)

.github/workflows/docs.yml

@@ -1,21 +1,21 @@
 name: Build docs
-on: [push, pull_request]
+on: [ push, pull_request ]
 jobs:
   docs:
     runs-on: ubuntu-20.04
     defaults:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v4
-      - uses: conda-incubator/[email protected]
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
       - run: python -m pip install -r docs/requirements.txt
       - run: python docs/releases.py
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
         with:
           path: build/docs
           name: docs
-      - uses: peaceiris/actions-gh-pages@v3
+      - uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: build/docs/all-releases

.github/workflows/lint.yml

@@ -1,15 +1,15 @@
 name: Lint
-on: [pull_request]
+on: [ pull_request ]
 jobs:
   lint:
     runs-on: ubuntu-latest
     defaults:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
       - name: Setup Miniconda
-        uses: conda-incubator/[email protected]
+        uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
       - name: Install dependencies
         run: |
           conda install -c conda-forge shellcheck