Use hashes

Author: nabobalis

.github/workflows/release_schedule.yaml

@@ -17,29 +17,24 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # We're going to make a tag that we can we release so we'll need the full history for that
           fetch-depth: 0
-
-      - uses: prefix-dev/setup-pixi@v0.9.2
+      - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           pixi-version: "v0.49.0"
-
       - name: Generate artifacts
         run: |
           pixi run generate-schedule --locked
-
       - name: Test json artifact
         run: |
           cat schedule.json | jq
-
       - name: setup git
         run: |
           # git will complain if we don't do this first
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-
       - name: determine tag name
         id: tag_name
         run: |
@@ -53,7 +48,6 @@ jobs:
           git tag ${{ steps.tag_name.outputs.TAG_NAME }}
           git push origin main
           git push origin tag ${{ steps.tag_name.outputs.TAG_NAME }}
-
       - name: Publish github release
         uses: softprops/action-gh-release@v2
         env:

action.yaml

@@ -35,19 +35,19 @@ runs:
   using: "composite"
   steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Set up Git
       shell: bash
       run: |
         git config user.name "Scientific Python [bot]"
         git config user.email "scientific-python@users.noreply.github.com"
-    - uses: prefix-dev/setup-pixi@v0.9.3
+    - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
       name: Setup Pixi
       with:
         pixi-version: v0.49.0
         manifest-path: ${{ github.action_path }}/pyproject.toml
     - name: Fetch Schedule from release
-      uses: robinraju/release-downloader@v1.3
+      uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
       with:
         repository: "savente93/SPEC0-schedule"
         latest: true
@@ -71,7 +71,7 @@ runs:
         fi
     - name: Create Pull Request
       if: ${{ fromJSON(inputs.create_pr) && fromJSON(steps.changes.outputs.changes_detected) }}
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.2
       with:
         token: ${{ inputs.token }}
         commit-message: ${{ inputs.commit_msg }}