chore: pin GitHub Actions to specific commit SHAs (#435)

Use pinact to pin all workflow actions to immutable commit SHAs
instead of mutable tags to prevent supply chain attacks.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: julian-risch

.github/workflows/dc_sync.yml

@@ -16,13 +16,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
       - name: Get changed files
         id: files
-        uses: tj-actions/changed-files@v46
+        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
         with:
           json: true
           files: |
@@ -44,9 +44,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 
@@ -65,7 +65,7 @@ jobs:
           python scripts/generate_txt.py --metadata --notebooks ${{ matrix.file }}
 
       - name: Upload tutorial to deepset Cloud
-        uses: silvanocerza/deepset-cloud-file-uploader@v1
+        uses: silvanocerza/deepset-cloud-file-uploader@b2a34976a31f894154a529b7f4b4cc00edb593a4 # v1.1.2
         with:
           api-key: ${{ secrets.DEEPSET_CLOUD_API_KEY }}
           workspace-name: ${{ secrets.DEEPSET_CLOUD_WORKSPACE }}
@@ -93,7 +93,7 @@ jobs:
           echo "file=$FILE" >> "$GITHUB_OUTPUT"
 
       - name: Delete file from deepset Cloud
-        uses: silvanocerza/deepset-cloud-file-deleter@v1
+        uses: silvanocerza/deepset-cloud-file-deleter@16afef2222bc877b42cf346cce043133debe7c3f # v1.0.0
         with:
           api-key: ${{ secrets.DEEPSET_CLOUD_API_KEY }}
           workspace-name: ${{ secrets.DEEPSET_CLOUD_WORKSPACE }}

.github/workflows/full_dc_sync.yml

@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 

.github/workflows/project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add new issues to project for triage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/deepset-ai/projects/5
           github-token: ${{ secrets.GH_PROJECT_PAT }}

.github/workflows/run_tutorials.yml

@@ -14,9 +14,9 @@ jobs:
     outputs:
       matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
 
@@ -33,7 +33,7 @@ jobs:
       - name: Get changed files
         if: github.event_name == 'pull_request'
         id: files
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
         with:
           matrix: true
           files: tutorials/*.ipynb
@@ -80,10 +80,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Python and uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: "3.11"
 
@@ -123,6 +123,6 @@ jobs:
 
       - name: Notify Slack on nightly failure
         if: failure() && github.event_name != 'pull_request'
-        uses: deepset-ai/notify-slack-action@v1
+        uses: deepset-ai/notify-slack-action@3cda73b77a148f16f703274198e7771340cf862b # v1
         with:
           slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS }}

.github/workflows/verify_generation.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Python and uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: "3.11"