chore: Use only Renovate and pin GitHub Actions to commit SHAs

.github/workflows/build-and-test.yml

@@ -30,14 +30,14 @@ jobs:
           - target_arch: osx-64
             os: macos-15-intel
     steps:
-      - uses: actions/checkout@v7
-      - uses: prefix-dev/setup-pixi@v0.10.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1
         with:
           cache: true
       - name: Build installer
         run: pixi run build-installer
       - name: Upload installer
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: installer-${{ matrix.target_arch }}
           path: DIRACOS-*.sh
@@ -52,7 +52,7 @@ jobs:
         target_arch: ["linux-64"]
     steps:
       - name: Download installer
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: installer-${{ matrix.target_arch }}
       - name: Generate environment.yaml
@@ -61,7 +61,7 @@ jobs:
           source diracos/diracosrc
           conda env export --file environment.yaml --prefix $DIRACOS
       - name: Upload environment.yaml
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: environment-yaml-${{ matrix.target_arch }}
           path: |
@@ -73,13 +73,13 @@ jobs:
     needs: get-info
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: prefix-dev/setup-pixi@v0.10.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1
         with:
           cache: true
           environments: release
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: artifacts
       - name: Create release notes
@@ -90,7 +90,7 @@ jobs:
             > release-notes.md
           cat release-notes.md
       - name: Upload release-notes.md
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-notes
           path: |
@@ -121,9 +121,9 @@ jobs:
             installer: installer-linux-aarch64
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download installer
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ matrix.installer }}
       - name: Run tests
@@ -139,9 +139,9 @@ jobs:
       matrix:
         os: [macos-15-intel]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download installer
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: installer-osx-64
       - name: Run tests
@@ -161,9 +161,9 @@ jobs:
       matrix:
         os: [macos-14, macos-15]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download installer
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: installer-osx-arm64
       - name: Run tests
@@ -186,12 +186,12 @@ jobs:
           - rel-v9r0
           - integration
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14'
       - name: Download installer
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: installer-linux-64
       - name: Prepare environment

.github/workflows/release.yaml

@@ -17,8 +17,8 @@ jobs:
     if: github.repository == 'DIRACGrid/DIRACOS2'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: prefix-dev/setup-pixi@v0.10.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1
         with:
           cache: true
           environments: release
@@ -29,9 +29,3 @@ jobs:
             --run-id="${{ github.event.inputs.run_id }}" \
             --version="${{ github.event.inputs.version }}" \
             --make-release
-      - name: Setup upterm session
-        # uses: lhotari/action-upterm@v1
-        uses: chrisburr/action-upterm@patch-1
-        if: ${{ failure() }}
-        with:
-          limit-access-to-actor: true

renovate.json

@@ -3,14 +3,19 @@
   "extends": [
     "config:recommended",
     ":dependencyDashboard",
-    "group:allNonMajor"
+    "group:allNonMajor",
+    "helpers:pinGitHubActionDigests"
   ],
   "minimumReleaseAge": "7 days",
   "internalChecksFilter": "strict",
   "packageRules": [
     {
       "matchManagers": ["pixi"],
       "groupName": "pixi dependencies"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
     }
   ]
 }