Merge pull request #2173 from jaimergp/pin-gha-actions

Author: beckermr

.github/dependabot.yml

@@ -4,3 +4,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/deploy.yml

@@ -12,9 +12,9 @@ jobs:
     name: deploy
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
 
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3
         with:
           python-version: 3.8
           channels: conda-forge
@@ -35,7 +35,7 @@ jobs:
 
       - name: deploy
         if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_branch: gh-pages
@@ -44,7 +44,7 @@ jobs:
           user_email: [email protected]
 
       - name: Link Checker
-        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # for v1.10.0
+        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # v1.10.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           lycheeVersion: "0.14.3"

.github/workflows/meeting-notes.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   create:
     if: github.event_name != 'pull_request'
-    uses: Quansight-Labs/hackmd-meeting-notes-action/.github/workflows/create-meeting-notes-pr.yml@main
+    uses: Quansight-Labs/hackmd-meeting-notes-action/.github/workflows/create-meeting-notes-pr.yml@caec6b839f3dc5f8a534520e32100622325d752e # @main
     with:
       date: ${{ inputs.date || 'now' }}
       template_path: misc/DEV_MEETING_TEMPLATE.md
@@ -39,7 +39,7 @@ jobs:
       HACKMD_TOKEN: ${{ secrets.HACKMD_TOKEN }}
   sync:
     if: github.event.label.name == 'sync-hackmd-notes'
-    uses: Quansight-Labs/hackmd-meeting-notes-action/.github/workflows/sync-meeting-notes-pr.yml@main
+    uses: Quansight-Labs/hackmd-meeting-notes-action/.github/workflows/sync-meeting-notes-pr.yml@caec6b839f3dc5f8a534520e32100622325d752e # pin@main
     with:
       pr_number: ${{ github.event.number }}
     secrets: