[pull] main from WeblateOrg:main

.github/CODEOWNERS

@@ -2,7 +2,8 @@
 #
 # SPDX-License-Identifier: CC0-1.0
 
-*.rst @orangesunny @comradekingu @AliceVisek
+*.rst @AliceVisek
 /client/ @meel-hd
 *.js @meel-hd
 *.css @meel-hd
+*.py @nijel

.github/renovate.json

@@ -1,9 +1,14 @@
 {
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard",
+    "helpers:pinGitHubActionDigests"
+  ],
   "labels": [
     "dependencies"
   ],
   "rangeStrategy": "widen",
-  "dependencyDashboard": true,
   "automerge": true,
   "automergeType": "pr",
   "automergeStrategy": "rebase",
@@ -144,9 +149,9 @@
         "^Dockerfile$"
       ],
       "matchStrings": [
-        "#\\s*renovate:\\s*?(release=(?<release>.*?))?\\s*depName=(?<depName>.*?)?\\sENV .*?_VERSION=\"(?<currentValue>.*)\""
+        "#\\s*renovate:\\s*?(repo=(?<repo>.*?))?\\s*?(release=(?<release>.*?))?\\s*depName=(?<depName>.*?)?\\sENV .*?_VERSION=\"(?<currentValue>.*)\""
       ],
-      "registryUrlTemplate": "https://deb.debian.org/debian?{{#if release }}release={{release}}{{else}}suite=stable{{/if}}&components=main,contrib,non-free&binaryArch=amd64",
+      "registryUrlTemplate": "{{#if repo }}{{repo}}{{else}}https://deb.debian.org/debian{{/if}}?{{#if release }}release={{release}}{{else}}suite=stable{{/if}}&components=main&binaryArch=amd64",
       "datasourceTemplate": "deb"
     }
   ]

.github/workflows/api.yml

@@ -30,8 +30,8 @@ jobs:
       PYTHONWARNINGS: default,ignore:unclosed:ResourceWarning
       PYTHONUNBUFFERED: 1
     steps:
-    - uses: actions/checkout@v4
-    - uses: astral-sh/setup-uv@v5
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
       with:
         enable-cache: true
         cache-dependency-glob: ''
@@ -41,7 +41,7 @@ jobs:
     - name: Install apt dependencies
       run: sudo ./ci/apt-install "$CI_DATABASE"
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.13'
     - name: Used versions

.github/workflows/closing.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Add closed question comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: |
         github.actor != 'renovate[bot]' &&
         github.event.issue.state_reason == 'completed' &&
@@ -42,7 +42,7 @@ jobs:
           * In case you see a similar problem, please open a separate issue.
           * If you are happy with the outcome, don’t hesitate to support Weblate by making a [donation](https://weblate.org/donate/).
     - name: Add closed issue comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: |
         github.actor != 'renovate[bot]' &&
         github.event.issue.state_reason == 'completed' &&

.github/workflows/docs.yml

@@ -22,10 +22,10 @@ jobs:
     outputs:
       languages: ${{ steps.list.outputs.languages }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: astral-sh/setup-uv@v5
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.13'
     - run: uv run --no-project scripts/list-documentation-languages.py >>"$GITHUB_OUTPUT"
@@ -44,10 +44,10 @@ jobs:
       READTHEDOCS_LANGUAGE: ${{ matrix.language }}
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: astral-sh/setup-uv@v5
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.13'
     - name: Install apt dependencies
@@ -62,7 +62,7 @@ jobs:
         echo "::add-matcher::.github/matchers/sphinx.json"
         ./ci/run-docs
         echo "::remove-matcher owner=sphinx::"
-    - uses: actions/[email protected].0
+    - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
       with:
         name: Documentation ${{ matrix.language }}
         path: docs/_build/html

.github/workflows/fossa.yml

@@ -18,15 +18,15 @@ jobs:
     if: ${{ github.repository == 'WeblateOrg/weblate' }}
     steps:
     - name: Checkout Code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Run FOSSA Scan
-      uses: fossas/[email protected]
+      uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
       with:
         api-key: ${{secrets.fossaApiKey}}
 
     - name: Run FOSSA Test
-      uses: fossas/[email protected]
+      uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
       with:
         api-key: ${{secrets.fossaApiKey}}
         run-tests: true

.github/workflows/labels.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Add backlog comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: ${{ github.event.label.name == 'backlog' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -33,7 +33,7 @@ jobs:
           In case you need this feature soon, please consider helping
           or push it by [funding the development](https://weblate.org/support/).
     - name: Add undecided comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: ${{ github.event.label.name == 'undecided' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -46,7 +46,7 @@ jobs:
 
           Please try to clarify the use case or consider proposing something more generic to make it useful to more users.
     - name: Add question comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: ${{ github.event.label.name == 'question' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -63,7 +63,7 @@ jobs:
 
           In case your question is already answered, [making a donation](https://weblate.org/donate/) is the right way to say thank you!
     - name: Add translate-toolkit comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: ${{ github.event.label.name == 'translate-toolkit' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -72,7 +72,7 @@ jobs:
           The issue you've reported needs to be addressed in the [translate-toolkit](https://github.com/translate/translate/).
           Please file the issue there, and include links to any relevant specifications about the formats (if applicable).
     - name: Add good first issue comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: ${{ github.event.label.name == 'good first issue' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/licenses-update.yml

@@ -22,28 +22,28 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         submodules: true
         token: ${{ secrets.WEBLATE_CI_TOKEN }}
-    - uses: actions/cache@v4
+    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
       with:
         path: ~/.cache/pre-commit
         key: ${{ runner.os }}-pre-commit-${{ hashFiles('pyproject.toml') }}-${{ hashFiles('.pre-commit-config.yaml') }}
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.13'
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
     - run: ./scripts/generate-license-data
     - name: Update renovate branch
       if: github.ref != 'refs/heads/main'
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0
       with:
         commit_message: 'utils: Update SPDX license data'
     - name: Create Pull Request
       if: github.ref == 'refs/heads/main'
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
       with:
         branch: create-pull-request/licenses-update
         title: 'utils: Update SPDX license data'

.github/workflows/linkcheck.yml

@@ -25,12 +25,12 @@ jobs:
     name: Linkcheck
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.13'
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
     - name: Install apt dependencies
       run: |
         sudo apt update
@@ -49,7 +49,7 @@ jobs:
         sed 's@^@docs/@' docs/_build/linkcheck/output.txt
         echo "::remove-matcher owner=sphinx::"
         echo "::remove-matcher owner=sphinx-warn::"
-    - uses: actions/[email protected].0
+    - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
       if: always()
       with:
         name: Linkcheck report