From 5db4dbc67b25eb2439474d883ef098f574e326e3 Mon Sep 17 00:00:00 2001
From: Oscar Gustafsson <oscar.gustafsson@gmail.com>
Date: Thu, 29 May 2025 11:14:15 +0200
Subject: [PATCH] Use hashes for GitHub Action versions

---
 .github/workflows/coverage.yml |  6 +++---
 .github/workflows/docs.yml     |  6 +++---
 .github/workflows/images.yml   |  4 ++--
 .github/workflows/push.yml     | 24 ++++++++++++------------
 docs/ci/script.rst             |  2 +-
 5 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index e2706cdc3..2aa0e0769 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: recursive
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: '3.13'
 
@@ -28,7 +28,7 @@ jobs:
     - name: Report coverage
       run: ./.github/run.sh coverage report -m --skip-covered
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
       with:
         name: VUnit_coverage
         path: htmlcov
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7e2a8ac81..51a7fda77 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: recursive
         fetch-depth: 0
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: '3.13'
 
@@ -32,7 +32,7 @@ jobs:
     - name: Build docs
       run: tox -e py313-docs -- --color
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
       with:
         name: VUnit-site
         path: .tox/py313-docs/tmp/docsbuild/
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index a0091f748..c492410e1 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
 
     - name: 🧰 Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: '🛳️ Build container image'
       run: >-
@@ -52,7 +52,7 @@ jobs:
     steps:
 
     - name: 🧰 Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: '🛳️ Build container image'
       run: |
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 9cd0ad566..07b34727e 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -23,10 +23,10 @@ jobs:
     steps:
 
     - name: '🧰 Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: '🐍 Setup Python'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: '3.13'
 
@@ -55,10 +55,10 @@ jobs:
     steps:
 
     - name: '🧰 Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: '🐍 Setup Python'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: ${{ matrix.py }}
 
@@ -87,7 +87,7 @@ jobs:
     steps:
 
     - name: '🧰 Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: recursive
 
@@ -111,7 +111,7 @@ jobs:
     steps:
 
     - name: '🧰 Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: recursive
 
@@ -142,19 +142,19 @@ jobs:
     steps:
 
     - name: '🟦 Setup MSYS2'
-      uses: msys2/setup-msys2@v2
+      uses: msys2/setup-msys2@61f9e5e925871ba6c9e3e8da24ede83ea27fa91f  # v2.27.0
       with:
         msystem: mingw64
         update: true
-        install: mingw-w64-x86_64-python-pip	
+        install: mingw-w64-x86_64-python-pip
 
     - name: '🧰 Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: recursive
 
     - name: '⚙️ Setup GHDL'
-      uses: ghdl/setup-ghdl@main
+      uses: ghdl/setup-ghdl@09e61b6db92fe2766a0b0a4b82505a47d67570be  # v1.2.1
       with:
         backend: mcode
         runtime: mingw64
@@ -182,12 +182,12 @@ jobs:
     steps:
 
     - name: '🧰 Checkout'
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: recursive
 
     - name: '🐍 Setup Python'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: '3.13'
 
diff --git a/docs/ci/script.rst b/docs/ci/script.rst
index db100838a..2d2b2c237 100644
--- a/docs/ci/script.rst
+++ b/docs/ci/script.rst
@@ -61,7 +61,7 @@ of your repository. The YAML file should contain, at least, the following piece
        runs-on: ubuntu-latest
        steps:
 
-         - uses: actions/checkout@v2
+         - uses: actions/checkout@v4
 
          - uses: VUnit/vunit_action@v0.1.0