chore: pin actions with commit

.github/workflows/cifar_benchmark.yaml

@@ -149,37 +149,37 @@ jobs:
           python3 ./benchmarks/convert_cifar.py --model-name "16-bits-trained-v0"
 
       - name: Archive raw predictions
-        uses: actions/[email protected].1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: predictions.csv
           path: inference_results.csv
 
       - name: Archive metrics
-        uses: actions/[email protected].1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: metrics.json
           path: to_upload.json
 
       - name: Archive MLIR
-        uses: actions/[email protected].1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: mlir.txt
           path: cifar10.mlir
 
       - name: Archive Graph
-        uses: actions/[email protected].1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: graph.txt
           path: cifar10.graph
 
       - name: Archive client
-        uses: actions/[email protected].1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: client.zip
           path: client_server/client.zip
 
       - name: Archive server
-        uses: actions/[email protected].1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: server.zip
           path: client_server/server.zip

.github/workflows/continuous-integration.yaml

@@ -498,7 +498,7 @@ jobs:
           && steps.install-deps.outcome == 'success'
           && steps.make-pcc.outcome == 'success' 
           && !cancelled()
-        uses: tj-actions/[email protected]
+        uses: tj-actions/changed-files@d6babd6899969df1a11d14c368283ea4436bca78 # v44.5.2
         with:
           files_yaml: |
             src:
@@ -756,7 +756,7 @@ jobs:
 
       # Upload the list of flaky tests that have been re-run (if the only failed tests were flaky)
       - name: Upload flaky tests list (weekly)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: |
           fromJSON(env.IS_WEEKLY) 
           && steps.pytest.outcome == 'success' 
@@ -1166,7 +1166,7 @@ jobs:
       # Retrieve the list of flaky tests that have been re-run if they were some
       # Enable 'merge-multiple' to download all files in the root directory
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           merge-multiple: true
           pattern: failed_flaky_*

.github/workflows/refresh-one-notebook.yaml

@@ -207,7 +207,7 @@ jobs:
       # If the target branch is another branch, the current branch is automatically merged into it
       - name: Push changes into the current branch
         if: ${{ github.ref_name != 'main' && !(startsWith(github.ref_name , 'release/')) }}
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
         with:
           commit_message: "chore: refresh ${{ github.event.inputs.notebook }} notebook"
           add_options: '-u'

.github/workflows/release.yaml

@@ -257,7 +257,7 @@ jobs:
 
     steps:
       - name: Import GPG
-        uses: crazy-max/[email protected]
+        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
         with:
           gpg_private_key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }}
@@ -339,7 +339,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
 
       - name: Set up Python
         uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d

.github/workflows/run_one_use_cases_example.yaml

@@ -92,7 +92,7 @@ jobs:
           apt-get install -y python3-venv make git git-lfs binutils
 
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           lfs: true
 
@@ -134,7 +134,7 @@ jobs:
     name: Send Slack notification
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
 
       - name: Prepare whole job status
         if: ${{ always() }}

.github/workflows/single_benchmark.yaml

@@ -139,7 +139,7 @@ jobs:
 
       - name: Install dependencies
         id: install-deps
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
         with:
           max_attempts: 5
           timeout_minutes: 20

.github/workflows/update_licenses.yaml

@@ -96,7 +96,7 @@ jobs:
       # Upload the updated license files as artifacts, if they exist
       # It is possible that no files have been generated if licenses have already been done for some
       # configuration(s)
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           if-no-files-found: ignore
           name: licenses_${{ matrix.config.os_name }}
@@ -125,7 +125,7 @@ jobs:
       # Retrieve all updated license files
       # Enable 'merge-multiple' to download all files in the 'deps_licenses' directory
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: deps_licenses/
           merge-multiple: true
@@ -146,7 +146,7 @@ jobs:
       # If the target branch is another branch, the current branch is automatically merged into it
       - name: Push changes into the current branch
         if: ${{ github.ref_name != 'main' && !(startsWith(github.ref_name , 'release/')) }}
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
         with:
           commit_message: "chore: update licenses"
           add_options: '-u'