Pin dependencies

Author: renovate[bot]

.github/workflows/build_and_publish.yml

@@ -23,7 +23,7 @@ jobs:
     outputs:
       new_version: ${{ steps.tag.outputs.new_version }} # no prefix, may be `undefined`
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # all history
       - id: tag
@@ -42,8 +42,8 @@ jobs:
     needs: tag-new-version
     if: needs.tag-new-version.outputs.new_version
     steps:
-      - uses: actions/checkout@v6
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: opensafely-core/setup-action@93841f27c28c75bf85b1a0a915e2391a06c6c8a6 # v1
         with:
           install-just: true
       - name: Set VERSION environment variable

.github/workflows/main.yml

@@ -11,8 +11,8 @@ jobs:
   check:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: "opensafely-core/setup-action@v1"
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: "opensafely-core/setup-action@93841f27c28c75bf85b1a0a915e2391a06c6c8a6" # v1
         with:
           install-just: true
           install-uv: true
@@ -23,8 +23,8 @@ jobs:
   test:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: "opensafely-core/setup-action@v1"
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: "opensafely-core/setup-action@93841f27c28c75bf85b1a0a915e2391a06c6c8a6" # v1
         with:
           install-just: true
           install-uv: true

.github/workflows/update-dependencies.yml

@@ -12,26 +12,26 @@ jobs:
   update-dependencies:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v6
-    - uses: "opensafely-core/setup-action@v1"
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: "opensafely-core/setup-action@93841f27c28c75bf85b1a0a915e2391a06c6c8a6" # v1
       with:
         install-uv: true
         install-just: true
 
-    - uses: actions/create-github-app-token@v3
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
       id: generate-token
       with:
         app-id: 1031449  # opensafely-core Create PR app
         private-key: ${{ secrets.CREATE_PR_APP_PRIVATE_KEY }}
 
-    - uses: bennettoxford/update-dependencies-action@v1
+    - uses: bennettoxford/update-dependencies-action@b77a22bcfe1d06020d908e64c9828fe944da3a5e # v1
       id: update
       with:
         token: ${{ steps.generate-token.outputs.token }}
 
     - name: Notify slack of PR
       if: ${{ steps.update.outputs.pull-request-operation != 'none' }}
-      uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c  # v3.0.2
+      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
       with:
         method: chat.postMessage
         token: ${{ secrets.BENNETTBOT_SLACK_BOT_TOKEN }}