use tags

Author: anthony-nhs

.github/workflows/combine-dependabot-prs.yml

@@ -45,15 +45,15 @@ jobs:
         runs-on: ubuntu-22.04
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v5
+              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
               with:
                   repository: NHSDigital/eps-workflow-dependabot
                   sparse-checkout-cone-mode: false
                   sparse-checkout: |
                       combine-prs.js
 
             - name: Create Combined PR
-              uses: actions/github-script@v8
+              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
               id: create-combined-pr
               env:
                   branchPrefix: ${{ inputs.branchPrefix }}

.github/workflows/dependabot-auto-approve-and-merge.yml

@@ -19,14 +19,14 @@ jobs:
         steps:
             - name: Get token from Github App
               id: get_app_token
-              uses: actions/create-github-app-token@v2
+              uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42
               with:
                   app-id: ${{ secrets.AUTOMERGE_APP_ID }}
                   private-key: ${{ secrets.AUTOMERGE_PEM }}
 
             - name: Dependabot metadata
               id: dependabot-metadata
-              uses: dependabot/fetch-metadata@v2
+              uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b
               with:
                   github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/pull_request.yml

@@ -10,7 +10,7 @@ env:
 jobs:
   dependabot-auto-approve-and-merge:
     needs: quality_checks
-    uses: NHSDigital/eps-workflow-dependabot/.github/workflows/dependabot-auto-approve-and-merge.yml@4b56ed8edd7c5357fd0123a2bd84b3429d3a6b20
+    uses: ./.github/workflows/dependabot-auto-approve-and-merge.yml
     secrets:
       AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
       AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}