Ensure SHA Pinned Actions

.github/workflows/build_docs_gallery.yml

@@ -7,8 +7,8 @@ jobs:
   Test-MSS-docs:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: prefix-dev/[email protected]
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: prefix-dev/setup-pixi@5044b250243a57e8c78f7c38acd73f6d7954a3cf # v0.8.7
       with:
         pixi-version: latest
         cache: true

.github/workflows/enforce-sha.yaml

@@ -0,0 +1,22 @@
+on:
+  push:
+    branches:
+    - develop
+    - stable
+    - 'GSOC**'
+  pull_request:
+
+name: Security
+
+jobs:
+  ensure-pinned-actions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - name: Ensure SHA pinned actions
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@4830be28ce81da52ec70d65c552a7403821d98d4 # v3
+        with:
+          allowlist: |
+            Open-MSS/
+          dry_run: 'false'

.github/workflows/frizbee.yaml

@@ -0,0 +1,24 @@
+name: Frizbee Pinned Actions Check
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Run every day at midnight
+  workflow_dispatch:
+
+jobs:
+  frizbee_check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          ref: ${{ matrix.base_branch }}
+      - name: Update hashes
+        uses: stacklok/frizbee-action@a0f3391cbe93a54e2a68cfaca2283f8cf3fd72ea # v0.0.2
+        with:
+          token: ${{ secrets.PAT }}
+          branch: automation/frizbee-sha
+          delete-branch: true
+          actions: .github/workflows
+          open_pr: true
+          fail_on_unpinned: true

.github/workflows/lint.yml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
-    - uses: prefix-dev/[email protected]
+    - uses: prefix-dev/setup-pixi@5044b250243a57e8c78f7c38acd73f6d7954a3cf # v0.8.7
       with:
         pixi-version: latest
         cache: true
@@ -30,8 +30,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
-    - uses: prefix-dev/[email protected]
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: prefix-dev/setup-pixi@5044b250243a57e8c78f7c38acd73f6d7954a3cf # v0.8.7
       with:
         pixi-version: latest
         cache: true
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Check for CRLF in the repository
       run: |
         files_with_crlf="$(git ls-files --eol | awk '$1 ~ "crlf"')"
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Check for whitespace issues in the repository
       # The two example.txt files need to be excluded because whitespace at EOL is part
       # of their format and they fail to parse otherwise.

.github/workflows/testing-all-oses.yml

@@ -20,8 +20,8 @@ jobs:
       matrix:
         os: ["macos-13", "macos-14", "ubuntu-latest"]
     steps:
-    - uses: actions/checkout@v4
-    - uses: prefix-dev/[email protected]
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: prefix-dev/setup-pixi@5044b250243a57e8c78f7c38acd73f6d7954a3cf # v0.8.7
       with:
         pixi-version: latest
         cache: true

.github/workflows/update-pixi-lockfile.yml

@@ -15,11 +15,11 @@ jobs:
       matrix:
         base_branch: ["develop", "stable"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ matrix.base_branch }}
       - name: Generate new lockfile
-        uses: prefix-dev/[email protected]
+        uses: prefix-dev/setup-pixi@5044b250243a57e8c78f7c38acd73f6d7954a3cf # v0.8.7
         with:
           pixi-version: latest
           run-install: false
@@ -28,7 +28,7 @@ jobs:
           set -o pipefail
           pixi update --json | pixi exec pixi-diff-to-markdown >> diff.md
       - name: Create or update pull request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
         with:
           token: ${{ secrets.PAT }}
           branch: automation/update-pixi-lockfile