DEVOPS-1133: Pin version to hash

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,17 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  call-workflow-dependabot-auto-merge:
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+      checks: read
+    with:
+      dependabot-groups: mirageo-ci-tools,pre-commit-hooks
+      checks-to-skip: 'CodeQL'

.github/workflows/issue_to_jira.yml

@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   call-workflow-create-jira-issue:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
     permissions:
       contents: read
       issues: write

.github/workflows/pr_jira_actions.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   call-workflow-pr_jira_actions:
     if: github.event.action != 'edited' || github.event.changes.title != null
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
     permissions:
       contents: read
       pull-requests: write

.github/workflows/pull_request.yml

@@ -46,12 +46,12 @@ jobs:
 
     steps:
       - name: Checkout target repository source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
       - name: Setup Python env
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 
@@ -61,7 +61,7 @@ jobs:
       # Checkout PR branch.
       # TREAT THIS CODE AS MALICIOUS, DON'T RUN CODE FROM THIS BRANCH.
       - name: checkout pull request source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           path: pr_source
@@ -83,12 +83,12 @@ jobs:
 
     steps:
       - name: Checkout target repository source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
       - name: Setup Python env
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 
@@ -98,7 +98,7 @@ jobs:
       # Checkout PR branch.
       # TREAT THIS CODE AS MALICIOUS, DON'T RUN CODE FROM THIS BRANCH.
       - name: checkout pull request source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           path: 'pr_source'

.github/workflows/python_deploy_dev.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
     permissions:
       contents: write
     with:
@@ -29,7 +29,7 @@ jobs:
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
     permissions:
       contents: write
     with:

.github/workflows/python_deploy_prod.yml

@@ -41,7 +41,7 @@ jobs:
     name: Publish production Conda package on JFrog Artifactory
     needs: validate-release-tag
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
     permissions:
       contents: write
     with:
@@ -54,7 +54,7 @@ jobs:
     name: Publish production PyPI package (JFrog Artifactory, PyPI)
     needs: validate-release-tag
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
     permissions:
       contents: write
     with:

.github/workflows/security_scan.yml

@@ -32,7 +32,7 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
 
   call-workflow-zizmor-advanced-security:
     name: Zizmor analysis (annotate)
@@ -42,4 +42,4 @@ jobs:
       checks: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0

.github/workflows/wip-status.yml

@@ -0,0 +1,12 @@
+name: WIP status
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, edited]
+
+jobs:
+  call-workflow-wip-status:
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-wip-status.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
+    permissions:
+      contents: read
+      statuses: write

.github/workflows/zizmor-security-upstream.yml

@@ -18,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"