Switch versions to SHA

.github/workflows/add-issue-to-project.yml

@@ -12,7 +12,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd
         with:
           # You can target a repository in a different organization
           # to the issue

.github/workflows/pre-commit-ci.yml

@@ -18,25 +18,25 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '3.11'
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
         uv pip install --system .[dev]
         if [ -f requirements.txt ]; then uv pip install --system -r requirements.txt; fi
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
       with:
         extra_args: --all-files --verbose
       env:
         SKIP: "check-lincc-frameworks-template-version,no-commit-to-branch,check-added-large-files,validate-pyproject,sphinx-build,pytest-check"
-    - uses: pre-commit-ci/lite-action@v1.2.0
+    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc
       if: failure() && github.event_name == 'pull_request' && github.event.pull_request.draft == false

.github/workflows/smoke-test.yml

@@ -26,15 +26,15 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -50,7 +50,7 @@ jobs:
     - name: Send status to Slack app
       if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
       id: slack
-      uses: slackapi/slack-github-action@v4
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
       with:
         webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
         webhook-type: webhook-trigger

.github/workflows/testing-and-coverage.yml

@@ -22,16 +22,16 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update

python-project-template/.github/workflows/pre-commit-ci.yml.jinja

@@ -18,25 +18,25 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
         uv pip install --system .[dev]
         if [ -f requirements.txt ]; then uv pip install --system -r requirements.txt; fi
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
       with:
         extra_args: --all-files --verbose
       env:
         SKIP: "check-lincc-frameworks-template-version,no-commit-to-branch,check-added-large-files,validate-pyproject,sphinx-build,pytest-check"
-    - uses: pre-commit-ci/lite-action@v1.2.0
+    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc
       if: failure() && github.event_name == 'pull_request' && github.event.pull_request.draft == false

python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja

@@ -23,11 +23,11 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install dependencies

python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja

@@ -27,15 +27,15 @@ jobs:
         python-version: {{ python_versions }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: {% raw %}${{ matrix.python-version }}{% endraw %}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -50,7 +50,7 @@ jobs:
 {%- if 'email' in failure_notification %}
     - name: Send status to author's email      
       if: {% raw %}${{ failure() }} && github.event_name != 'workflow_dispatch' }}{% endraw %} # Only email if the workflow failed and was not manually started. Customize this as necessary.
-      uses: dawidd6/action-send-mail@v18
+      uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968
       with:
         # Required mail server address if not connection_url:
         server_address: smtp.gmail.com
@@ -87,7 +87,7 @@ jobs:
     - name: Send status to Slack app
       if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
       id: slack
-      uses: slackapi/slack-github-action@v4
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
       with:
         # For posting a rich message using Block Kit
         webhook: ${{ secrets.SLACK_WEBHOOK_URL }}

python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja

@@ -24,15 +24,15 @@ jobs:
         python-version: {{ python_versions }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: {% raw %}${{ matrix.python-version }}{% endraw %}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -42,18 +42,18 @@ jobs:
       run: |
         python -m pytest -o log_cli=true -vv --cov={{package_name}} --cov-report=xml
     - name: Upload coverage report to codecov
-      uses: codecov/codecov-action@v7
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 {%- if test_lowest_version != 'none' %}
   test-lowest-versions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {{ py.min(python_versions)  }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.min(python_versions)  }}'
     - name: Install dependencies

python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja

@@ -32,11 +32,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout main branch of the repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -59,7 +59,7 @@ jobs:
     - name: Run ASV for the main branch
       run: asv run ALL --skip-existing --verbose || true
     - name: Submit new results to the "benchmarks" branch
-      uses: JamesIves/github-pages-deploy-action@v4
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445
       with:
         branch: benchmarks
         folder: ${{env.WORKING_DIR}}/_results
@@ -69,7 +69,7 @@ jobs:
         asv show
         asv publish
     - name: Deploy to Github pages
-      uses: JamesIves/github-pages-deploy-action@v4
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445
       with:
         branch: gh-pages
         folder: ${{env.WORKING_DIR}}/_html

python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja

@@ -30,11 +30,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout main branch of the repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
         echo "yesterday=$(date -d yesterday +'%Y-%m-%d')" >> $GITHUB_OUTPUT
         echo "today=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
     - name: Use last nightly commit hash from cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: ${{env.WORKING_DIR}}
         key: nightly-results-${{steps.nightly-dates.outputs.yesterday}}
@@ -75,7 +75,7 @@ jobs:
         fi
         echo $CURRENT_HASH > $HASH_FILE
     - name: Update last nightly hash in cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: ${{env.WORKING_DIR}}
         key: nightly-results-${{steps.nightly-dates.outputs.today}}

python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja

@@ -37,11 +37,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout PR branch of the repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -55,7 +55,7 @@ jobs:
     - name: Save pull request number
       run: echo ${{github.event.pull_request.number}} > ${{env.ARTIFACTS_DIR}}/pr
     - name: Get current job logs URL
-      uses: Tiryoh/gha-jobid-action@v1
+      uses: Tiryoh/gha-jobid-action@be260d8673c9211a84cdcf37794ebd654ba81eef
       id: jobs
       with:
         github_token: ${{secrets.GITHUB_TOKEN}}
@@ -74,7 +74,7 @@ jobs:
       env:
         STEP_URL: ${{steps.jobs.outputs.html_url}}#step:10:1
     - name: Upload artifacts (PR number and benchmarks output)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
       with:
         name: benchmark-artifacts
         path: ${{env.ARTIFACTS_DIR}}

python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja

@@ -31,7 +31,7 @@ jobs:
         echo "Conclusion: ${{ github.event.workflow_run.conclusion }}"
         echo "Event: ${{ github.event.workflow_run.event }}"
     - name: Download artifact
-      uses: dawidd6/action-download-artifact@v27
+      uses: dawidd6/action-download-artifact@eab87c9830c39eff17e5a6eadb20bfb4bc880477
       with:
         name: benchmark-artifacts
         run_id: ${{ github.event.workflow_run.id }}
@@ -42,14 +42,14 @@ jobs:
         printf "Output:\n$(cat output)"
         printf "pr=$(cat pr)" >> $GITHUB_OUTPUT
     - name: Find benchmarks comment
-      uses: peter-evans/find-comment@v4
+      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
       id: find-comment
       with:
         issue-number: ${{ steps.pr-info.outputs.pr }}
         comment-author: 'github-actions[bot]'
         body-includes: view all benchmarks
     - name: Create or update benchmarks comment
-      uses: peter-evans/create-or-update-comment@v5
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
       with:
         comment-id: ${{ steps.find-comment.outputs.comment-id }}
         issue-number: ${{ steps.pr-info.outputs.pr }}

python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja

@@ -23,15 +23,15 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {{ py.pref(python_versions) }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update