Pin actions to full-length commit SHA

Author: francesco-ballarin

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Mark workspace as safe
         run: |
           git config --global --add safe.directory "${GITHUB_WORKSPACE}"
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           set-safe-directory: false
       - name: Install non-pip dependencies of the image cache tester library
@@ -67,15 +67,15 @@ jobs:
         run: |
           python3 -m nbqa mypy .
       - name: Check for stray outputs, counts and metadata in ipynb files
-        uses: RBniCS/check-jupyter-metadata-action@main
+        uses: RBniCS/check-jupyter-metadata-action@6df653e5d45f7620d888c6a1bd85d07b4f903045  # v1.0.0
         with:
           pattern: "**/*.ipynb"
       - name: Run basic notebooks tests
         run: |
           COVERAGE_FILE=.coverage_notebooks_basic python3 -m coverage run --source=image_cache_tester -m pytest --coverage-run-allow tests/notebooks/basic
       - name: Upload notebooks logs as an artifact in case of failure
         if: failure() || cancelled()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: "notebooks-logs"
           path: |
@@ -114,7 +114,7 @@ jobs:
     if: github.repository == 'viskex/image_cache_tester' && github.ref == 'refs/heads/main' && github.event_name == 'schedule'
     steps:
       - name: Warn if scheduled workflow is about to be disabled
-        uses: fem-on-colab/warn-workflow-about-to-be-disabled-action@main
+        uses: fem-on-colab/warn-workflow-about-to-be-disabled-action@58c6022d9aeb22accfa8df9bf5b58c3d8867208c  # v1.0.0
         with:
           workflow-filename: ci.yml
           days-elapsed: 50

.github/workflows/workflow_call.yml

@@ -59,7 +59,7 @@ jobs:
           echo "branch=${BRANCH}" >> ${GITHUB_OUTPUT}
         shell: bash
       - name: Clone image cache tester library
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: viskex/image_cache_tester
           ref: ${{ steps.image_cache_tester_library_branch.outputs.branch }}
@@ -91,7 +91,7 @@ jobs:
           rm -rf _image_cache_tester_library
         shell: bash
       - name: Clone notebook repository on notebook branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: "${{ inputs.notebook_repository }}"
           ref: "${{ inputs.notebook_branch }}"
@@ -100,7 +100,7 @@ jobs:
         run: |
           git config --global --add safe.directory _notebook_repository/${{ inputs.notebook_directory }}/.image_cache
       - name: Clone notebook repository on image cache branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: "${{ inputs.notebook_repository }}"
           token: "${{ secrets.REPO_ACCESS_TOKEN || github.token }}"
@@ -145,7 +145,7 @@ jobs:
         working-directory: _notebook_repository
       - name: Upload notebooks logs as an artifact in case of failure
         if: failure() || cancelled()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: "image-cache-test-logs-${{ matrix.backend }}"
           path: |