Pin dependencies (#2816)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/cache](https://redirect.github.com/actions/cache) | action |
pinDigest | → `27d5ce7` |
| [actions/checkout](https://redirect.github.com/actions/checkout) |
action | pinDigest | → `9c091bb` |
|
[actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token)
| action | pinDigest | → `bcd2ba4` |
|
[actions/github-script](https://redirect.github.com/actions/github-script)
| action | pinDigest | → `3a2844b` |
| [actions/setup-node](https://redirect.github.com/actions/setup-node) |
action | pinDigest | → `48b55a0` |
|
[actions/setup-python](https://redirect.github.com/actions/setup-python)
| action | pinDigest | → `ece7cb0` |
|
[calibreapp/image-actions](https://redirect.github.com/calibreapp/image-actions)
| action | pinDigest | → `3d5873a` |
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | pinDigest | → `8aad20d` |
|
[lycheeverse/lychee-action](https://redirect.github.com/lycheeverse/lychee-action)
| action | pinDigest | → `8646ba3` |
|
[peter-evans/create-issue-from-file](https://redirect.github.com/peter-evans/create-issue-from-file)
| action | pinDigest | → `fca9117` |
|
[peter-evans/create-pull-request](https://redirect.github.com/peter-evans/create-pull-request)
| action | pinDigest | → `5f6978f` |
|
[thollander/actions-comment-pull-request](https://redirect.github.com/thollander/actions-comment-pull-request)
| action | pinDigest | → `24bffb9` |
|
[tj-actions/changed-files](https://redirect.github.com/tj-actions/changed-files)
| action | pinDigest | → `9426d40` |

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE1MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: wandb-renovate[bot] <285832833+wandb-renovate[bot]@users.noreply.github.com>

Author: wandb-renovate[bot]

.github/workflows/build-css.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Create GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
@@ -31,7 +31,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Checkout PR branch
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # App token rather than the default GITHUB_TOKEN so the rebuild
           # commit triggers downstream workflows (for example Validate MDX).
@@ -40,7 +40,7 @@ jobs:
           ref: ${{ github.head_ref }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '20'
           cache: npm

.github/workflows/calibreapp-image-actions.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Create GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
@@ -29,13 +29,13 @@ jobs:
           permission-pull-requests: write
 
       - name: Checkout Repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           token: ${{ steps.app-token.outputs.token }}
           ref: ${{ github.head_ref }}
 
       - name: Compress Images
-        uses: calibreapp/image-actions@main
+        uses: calibreapp/image-actions@3d5873ac3e7bf1a38b24d9778d8dc639d5706d8b # main
         with:
           jpegQuality: '85'
           jpegProgressive: false

.github/workflows/codeql.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -70,4 +70,4 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4

.github/workflows/docengine-build.yml

@@ -55,14 +55,14 @@ jobs:
       - name: Generate token for wandb-docs-pr-writer
         id: app_token
         if: github.actor != 'dependabot[bot]'
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # App token persists as the push credential for the commit-back below.
           # Falls back to DOCENGINE_TOKEN for dependabot[bot] runs.
@@ -82,7 +82,7 @@ jobs:
         run: git submodule update --init --depth 1 docengine
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.12'
 
@@ -146,7 +146,7 @@ jobs:
       - name: Upsert orphan-report PR comment
         # Only when there is something to report; a clean build is silent.
         if: ${{ success() && github.actor != 'dependabot[bot]' && github.ref_name != 'main' && steps.findpr.outputs.number != '' && steps.orphanfile.outputs.present == 'true' }}
-        uses: thollander/actions-comment-pull-request@v3
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3
         with:
           pr-number: ${{ steps.findpr.outputs.number }}
           comment-tag: docengine-orphans
@@ -157,7 +157,7 @@ jobs:
         # A previous build may have posted orphans that are now resolved — delete that
         # comment so the PR does not carry a stale warning. No-ops when none exists.
         if: ${{ success() && github.actor != 'dependabot[bot]' && github.ref_name != 'main' && steps.findpr.outputs.number != '' && steps.orphanfile.outputs.present == 'false' }}
-        uses: thollander/actions-comment-pull-request@v3
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3
         with:
           pr-number: ${{ steps.findpr.outputs.number }}
           comment-tag: docengine-orphans

.github/workflows/docengine-import.yml

@@ -49,14 +49,14 @@ jobs:
 
       - name: Generate token for wandb-docs-pr-writer
         id: app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # App token persists as the push credential; peter-evans uses it explicitly
           # for the PR. No `submodules:` here — `recursive` would also try the
@@ -73,7 +73,7 @@ jobs:
         run: git submodule update --init --depth 1 docengine
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.12'
 
@@ -87,7 +87,7 @@ jobs:
         run: docengine import --all
 
       - name: Open PR with YAML updates
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ steps.app_token.outputs.token }}
           branch: docengine/data-import

.github/workflows/docengine-overlay.yml

@@ -57,14 +57,14 @@ jobs:
 
       - name: Generate token for wandb-docs-pr-writer
         id: app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           token: ${{ steps.app_token.outputs.token }}
 
@@ -78,7 +78,7 @@ jobs:
         run: git submodule update --init --depth 1 docengine
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.12'
 
@@ -145,14 +145,14 @@ jobs:
 
       - name: Generate token for wandb-docs-pr-writer
         id: app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           token: ${{ steps.app_token.outputs.token }}
 
@@ -166,7 +166,7 @@ jobs:
         run: git submodule update --init --depth 1 docengine
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.12'
 
@@ -182,7 +182,7 @@ jobs:
         run: docengine overlay apply --api "$API" --output-dir "$GITHUB_WORKSPACE"
 
       - name: Open PR with curated OpenAPI spec
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ steps.app_token.outputs.token }}
           branch: docengine/${{ matrix.api }}-api-specs

.github/workflows/generate-query-panel-reference.yml

@@ -12,17 +12,17 @@ jobs:
 
     steps:
       - name: Checkout docs repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "20"
 
@@ -33,7 +33,7 @@ jobs:
 
       - name: Create weave-internal read token
         id: weave-internal-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_SOURCE_READER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_SOURCE_READER_PRIVATE_KEY }}
@@ -69,7 +69,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.check_changes.outputs.changes == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: ${{ github.event.repository.default_branch }}

.github/workflows/generate-weave-reference-docs.yml

@@ -18,21 +18,21 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       # Shallow clone - no git history needed for doc generation
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
       with:
         python-version: '3.11'
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
         node-version: '18'
 
     - name: Cache Python dependencies
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: ~/.cache/pip
         key: ${{ runner.os }}-pip-${{ hashFiles('scripts/reference-generation/weave/requirements.txt') }}
@@ -132,7 +132,7 @@ jobs:
         
     - name: Create Pull Request
       id: create-pr
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         base: main

.github/workflows/knowledgebase-nav.yml

@@ -91,14 +91,14 @@ jobs:
 
       - name: Generate token for wandb-docs-pr-writer
         id: app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           client-id: ${{ vars.DOCS_PR_WRITER_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_PR_WRITER_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # On a PR, check out the head branch so the commit-back pushes to it.
           ref: ${{ github.event_name == 'pull_request' && github.head_ref || github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
@@ -127,7 +127,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
 

.github/workflows/linkcheck-pr.yml

@@ -37,15 +37,15 @@ jobs:
        github.event.pull_request.head.repo.fork == true)
     
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # Needed to diff base..head for the associated PR
           fetch-depth: 0
 
       - name: Early exit if no docs changed (fork PRs only)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
         id: fork-docs-check
-        uses: tj-actions/changed-files@v47.0.6
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           files: |
             **/*.mdx
@@ -62,7 +62,7 @@ jobs:
       - name: Resolve PR and deployment URL
         id: pr-context
         if: github.event_name == 'deployment_status'
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const { owner, repo } = context.repo;
@@ -118,7 +118,7 @@ jobs:
           (github.event_name == 'deployment_status' && 
            steps.pr-context.outputs.pr_number != '') ||
           github.event_name == 'workflow_dispatch'
-        uses: tj-actions/changed-files@v47.0.6
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           base_sha: ${{ steps.pr-context.outputs.base_sha || github.event.pull_request.base.sha }}
           sha: ${{ steps.pr-context.outputs.head_sha || github.event.pull_request.head.sha }}
@@ -127,7 +127,7 @@ jobs:
 
       - name: Get PR number
         id: get-pr
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             // For pull_request events, get PR number directly
@@ -258,7 +258,7 @@ jobs:
            (github.event_name == 'deployment_status' && 
             steps.changed-files.outputs.any_changed == 'true') ||
            github.event_name == 'workflow_dispatch')
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
         with:
           fail: false
           # Don't fail if no files to check
@@ -298,7 +298,7 @@ jobs:
            steps.lychee.conclusion == 'failure') &&
           (github.event_name != 'pull_request' || 
            github.event.pull_request.head.repo.fork != true)
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const fs = require('fs');