From 90d03fa94b07becb545eb94b9b30dc9855f98935 Mon Sep 17 00:00:00 2001
From: Tim Paine <3105306+timkpaine@users.noreply.github.com>
Date: Wed, 20 May 2026 17:38:45 -0400
Subject: [PATCH] Pin actions

---
 .github/dependabot.yaml                                |  8 ++++++++
 .github/workflows/build.yaml                           |  2 +-
 cpp/.github/workflows/build.yaml.jinja                 | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 cppjswasm/.github/workflows/build.yaml.jinja           | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 js/.github/workflows/build.yaml.jinja                  | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 jupyter/.github/workflows/build.yaml.jinja             | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 python/.github/workflows/build.yaml.jinja              | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 rust/.github/workflows/build.yaml.jinja                | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 rustjswasm/.github/workflows/build.yaml.jinja          | 10 +++++-----
 .../{% if add_docs %}docs.yaml{% endif %}.jinja        |  6 +++---
 .../{% if add_wiki %}wiki.yaml{% endif %}.jinja        |  4 ++--
 23 files changed, 79 insertions(+), 71 deletions(-)
 create mode 100644 .github/dependabot.yaml

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
new file mode 100644
index 0000000..3389bde
--- /dev/null
+++ b/.github/dependabot.yaml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "part: github_actions"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d142076..b899dd4 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -36,7 +36,7 @@ jobs:
           - macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Prework
       run: |
diff --git a/cpp/.github/workflows/build.yaml.jinja b/cpp/.github/workflows/build.yaml.jinja
index 6547946..c1e6dda 100644
--- a/cpp/.github/workflows/build.yaml.jinja
+++ b/cpp/.github/workflows/build.yaml.jinja
@@ -59,7 +59,7 @@ jobs:
             cibuildwheel: "cp312"
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -88,20 +88,20 @@ jobs:
       run: make coverage
 
     - name: Upload test results (Python)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}{% endraw %}
         path: junit.xml
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -149,7 +149,7 @@ jobs:
         module: {{module}}
       if: matrix.os == 'ubuntu-latest'
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}-${{matrix.python-version}}{% endraw %}
         path: dist
diff --git a/cpp/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/cpp/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index 922747a..4892db5 100644
--- a/cpp/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/cpp/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest-{{python_version_primary}}
           merge-multiple: true
@@ -44,7 +44,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/cpp/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/cpp/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/cpp/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/cpp/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki
diff --git a/cppjswasm/.github/workflows/build.yaml.jinja b/cppjswasm/.github/workflows/build.yaml.jinja
index cae2465..6ade8c0 100644
--- a/cppjswasm/.github/workflows/build.yaml.jinja
+++ b/cppjswasm/.github/workflows/build.yaml.jinja
@@ -35,7 +35,7 @@ jobs:
         node-version: [20.x]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -70,20 +70,20 @@ jobs:
       run: make coverage
 
     - name: Upload test results (Python)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}{% endraw %}
         path: junit.xml
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -131,7 +131,7 @@ jobs:
         module: {{module}}
       if: matrix.os == 'ubuntu-latest'
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}-${{matrix.python-version}}{% endraw %}
         path: dist
diff --git a/cppjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/cppjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index 0b128d3..ec5dd3f 100644
--- a/cppjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/cppjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest-{{python_version_primary}}
           merge-multiple: true
@@ -45,7 +45,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/cppjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/cppjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/cppjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/cppjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki
diff --git a/js/.github/workflows/build.yaml.jinja b/js/.github/workflows/build.yaml.jinja
index 0642dd5..ed5be96 100644
--- a/js/.github/workflows/build.yaml.jinja
+++ b/js/.github/workflows/build.yaml.jinja
@@ -34,7 +34,7 @@ jobs:
         node-version: [20.x]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -63,20 +63,20 @@ jobs:
       if: matrix.os == 'ubuntu-latest'
 
     - name: Upload test results
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.node-version }}{% endraw %}
         path: '**/junit.xml'
       if: {% raw %}${{ always() }}{% endraw %}
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -94,7 +94,7 @@ jobs:
         module: {{module}}
       if: matrix.os == 'ubuntu-latest'
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}{% endraw %}
         path: dist
diff --git a/js/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/js/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index 82ece6e..b0f63ef 100644
--- a/js/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/js/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest*
           merge-multiple: true
@@ -44,7 +44,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/js/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/js/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/js/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/js/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki
diff --git a/jupyter/.github/workflows/build.yaml.jinja b/jupyter/.github/workflows/build.yaml.jinja
index 7dbb700..cd2291e 100644
--- a/jupyter/.github/workflows/build.yaml.jinja
+++ b/jupyter/.github/workflows/build.yaml.jinja
@@ -34,7 +34,7 @@ jobs:
         node-version: [20.x]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -63,20 +63,20 @@ jobs:
       if: matrix.os == 'ubuntu-latest'
 
     - name: Upload test results (Python)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.node-version }}{% endraw %}
         path: '**/junit.xml'
       if: {% raw %}${{ always() }}{% endraw %}
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -94,7 +94,7 @@ jobs:
         module: {{module}}
       if: matrix.os == 'ubuntu-latest'
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}{% endraw %}
         path: dist
diff --git a/jupyter/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/jupyter/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index 82ece6e..b0f63ef 100644
--- a/jupyter/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/jupyter/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest*
           merge-multiple: true
@@ -44,7 +44,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/jupyter/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/jupyter/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/jupyter/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/jupyter/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki
diff --git a/python/.github/workflows/build.yaml.jinja b/python/.github/workflows/build.yaml.jinja
index 067290a..bca5fa8 100644
--- a/python/.github/workflows/build.yaml.jinja
+++ b/python/.github/workflows/build.yaml.jinja
@@ -33,7 +33,7 @@ jobs:
         python-version: ["{{ python_version_primary }}"]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -55,19 +55,19 @@ jobs:
       run: make coverage
 
     - name: Upload test results (Python)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}{% endraw %}
         path: junit.xml
       if: {% raw %}${{ always() }}{% endraw %}
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -82,7 +82,7 @@ jobs:
       with:
         module: {{module}}
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}{% endraw %}
         path: dist
diff --git a/python/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/python/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index 82ece6e..b0f63ef 100644
--- a/python/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/python/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest*
           merge-multiple: true
@@ -44,7 +44,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/python/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/python/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/python/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/python/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki
diff --git a/rust/.github/workflows/build.yaml.jinja b/rust/.github/workflows/build.yaml.jinja
index 377918d..04c5ae9 100644
--- a/rust/.github/workflows/build.yaml.jinja
+++ b/rust/.github/workflows/build.yaml.jinja
@@ -33,7 +33,7 @@ jobs:
         python-version: ["{{ python_version_primary }}"]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -58,20 +58,20 @@ jobs:
       run: make coverage
 
     - name: Upload test results (Python)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}{% endraw %}
         path: '**/junit.xml'
       if: {% raw %}${{ always() }}{% endraw %}
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -111,7 +111,7 @@ jobs:
         module: {{module}}
       if: matrix.os == 'ubuntu-latest'
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}{% endraw %}
         path: dist
diff --git a/rust/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/rust/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index 82ece6e..b0f63ef 100644
--- a/rust/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/rust/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest*
           merge-multiple: true
@@ -44,7 +44,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/rust/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/rust/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/rust/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/rust/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki
diff --git a/rustjswasm/.github/workflows/build.yaml.jinja b/rustjswasm/.github/workflows/build.yaml.jinja
index 9a130da..4b9a4e2 100644
--- a/rustjswasm/.github/workflows/build.yaml.jinja
+++ b/rustjswasm/.github/workflows/build.yaml.jinja
@@ -35,7 +35,7 @@ jobs:
         node-version: [20.x]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: actions-ext/python/setup@main
       with:
@@ -65,20 +65,20 @@ jobs:
       run: make coverage
 
     - name: Upload test results (Python)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}test-results-${{ matrix.os }}-${{ matrix.python-version }}{% endraw %}
         path: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest'
 
     - name: Publish Unit Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
       with:
         files: '**/junit.xml'
       if: matrix.os == 'ubuntu-latest'
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 
@@ -120,7 +120,7 @@ jobs:
         module: {{module}}
       if: matrix.os == 'ubuntu-latest'
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: {% raw %}dist-${{matrix.os}}{% endraw %}
         path: dist
diff --git a/rustjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja b/rustjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja
index c668355..596a3aa 100644
--- a/rustjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
+++ b/rustjswasm/.github/workflows/{% if add_docs %}docs.yaml{% endif %}.jinja	
@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     if: {% raw %}${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions-ext/python/setup@main
 
       - name: Download dist from build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: dist-ubuntu-latest*
           merge-multiple: true
@@ -45,7 +45,7 @@ jobs:
 
       - run: yardang build
 
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           publish_branch: gh-pages
           github_token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
diff --git a/rustjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja b/rustjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja
index bf675c2..d0cfce0 100644
--- a/rustjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
+++ b/rustjswasm/.github/workflows/{% if add_wiki %}wiki.yaml{% endif %}.jinja	
@@ -20,8 +20,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: cp README.md docs/wiki/Home.md
-      - uses: Andrew-Chen-Wang/github-wiki-action@v5
+      - uses: Andrew-Chen-Wang/github-wiki-action@64efa0a9436db17670a2259e0ac249d6f08bb352 # v5
         with:
           path: docs/wiki