Bump and pin all GitHub Actions to their SHAs

.github/actions/base-setup/action.yml

@@ -17,7 +17,7 @@ runs:
         set -eux
         PYTHON_VERSION="${{ inputs.python_version || matrix.python-version }}"
         NODE_VERSION=${{ inputs.node_version || matrix.node-version || '24.x' }}
-        DEPENDENCY_TYPE=${{ inputs.dependency_type }}
+        DEPENDENCY_TYPE=${INPUTS_DEPENDENCY_TYPE}
 
         # Handle default python value based on dependency type.
         if [ $DEPENDENCY_TYPE == "pre" ]; then
@@ -36,11 +36,13 @@ runs:
 
         echo "PYTHON_VERSION=$PYTHON_VERSION" >> $GITHUB_ENV
         echo "NODE_VERSION=$NODE_VERSION" >> $GITHUB_ENV
-        echo "CACHE_PREFIX=${{ runner.os }}-${{ github.workflow}}-${{ github.job }}" >> $GITHUB_ENV
+        echo "CACHE_PREFIX=${{ runner.os }}-${GITHUB_WORKFLOW}-${{ github.job }}" >> $GITHUB_ENV
         echo "DEPENDENCY_TYPE=$DEPENDENCY_TYPE" >> $GITHUB_ENV
+      env:
+        INPUTS_DEPENDENCY_TYPE: ${{ inputs.dependency_type }}
 
     - name: Install Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         allow-prereleases: true
@@ -54,15 +56,15 @@ runs:
       run: |
         echo "dir=$(pip cache dir)" >> $GITHUB_OUTPUT
     - name: Cache pip
-      uses: actions/cache@v4
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ${{ steps.pip-cache.outputs.dir }}
         key: ${{ env.CACHE_PREFIX }}-pip-${{ env.PYTHON_VERSION }}-${{ hashFiles('setup.cfg', 'setup.py', '**/requirements.txt', '**/pyproject.toml') }}
         restore-keys: |
           ${{ env.CACHE_PREFIX }}-pip-${{ env.PYTHON_VERSION }}
 
     - name: Install node
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -82,7 +84,7 @@ runs:
         [[ "$CACHE_DIR" == "undefined" ]] && CACHE_DIR=$(yarn cache dir)
         echo "dir=$CACHE_DIR" >> $GITHUB_OUTPUT
     - name: Cache yarn
-      uses: actions/cache@v4
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
       with:
         path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -92,15 +94,15 @@ runs:
 
     - name: Cache checked links
       if: ${{ matrix.group == 'link_check' }}
-      uses: actions/cache@v4
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cache/pytest-link-check
         key: ${{ env.CACHE_PREFIX }}-linkcheck-${{ hashFiles('**/*.md', '**/*.rst') }}-links
         restore-keys: |
           ${{ env.CACHE_PREFIX }}-linkcheck-
 
     - name: Cache conda
-      uses: actions/cache@v4
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/conda_pkgs_dir
         key: ${{ env.CACHE_PREFIX  }}-conda-${{ env.CACHE_NUMBER }}-${{

.github/actions/binder-link/action.yml

@@ -11,7 +11,7 @@ runs:
   using: "composite"
   steps:
     - name: add binder link
-      uses: actions/github-script@v7
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       with:
         github-token: ${{ inputs.github_token }}
         script: |

.github/actions/check-links/action.yml

@@ -18,7 +18,11 @@ runs:
       shell: bash
       run: |
         pip install pytest-check-links[cache]
-        export IGNORE_GLOB="${{inputs.ignore_glob}}"
-        export IGNORE_LINKS="${{inputs.ignore_links}}"
-        export LINKS_EXPIRE=${{inputs.links_expire}}
+        export IGNORE_GLOB="${INPUTS_IGNORE_GLOB}"
+        export IGNORE_LINKS="${INPUTS_IGNORE_LINKS}"
+        export LINKS_EXPIRE=${INPUTS_LINKS_EXPIRE}
         python ${{ github.action_path }}/check_links.py
+      env:
+        INPUTS_IGNORE_GLOB: ${{inputs.ignore_glob}}
+        INPUTS_IGNORE_LINKS: ${{inputs.ignore_links}}
+        INPUTS_LINKS_EXPIRE: ${{inputs.links_expire}}

.github/actions/downstream-test/action.yml

@@ -6,7 +6,7 @@ inputs:
     required: true
   package_spec:
     description: "The package spec to install"
-    default: '."[test]"'
+    default: ".[test]"
     required: true
   package_download_extra_args:
     description: "The arguments used to download the package"
@@ -30,12 +30,12 @@ runs:
         unset PIP_CONSTRAINT
 
         echo "::group::Set up env values"
-        package_name=${{inputs.package_name}}
-        package_spec="${{inputs.package_spec}}"
-        test_command="${{inputs.test_command}}"
-        package_download_extra_args="${{inputs.package_download_extra_args}}"
+        package_name=${INPUTS_PACKAGE_NAME}
+        package_spec="${INPUTS_PACKAGE_SPEC}"
+        test_command="${INPUTS_TEST_COMMAND}"
+        package_download_extra_args="${INPUTS_PACKAGE_DOWNLOAD_EXTRA_ARGS}"
         root=$(pwd)
-        eval "${{inputs.env_values}}"
+        eval "${INPUTS_ENV_VALUES}"
         echo "::endgroup::"
 
         echo "::group::Set up venv"
@@ -62,10 +62,17 @@ runs:
 
         echo "::group::Test the downstream package"
         eval ${test_command}
-        eval "${{inputs.extra_test}}"
+        eval "${INPUTS_EXTRA_TEST}"
         echo "::endgroup::"
 
         echo "::group::Cleanup"
         cd $HOME
         rm -rf ./test_venv
         echo "::endgroup::"
+      env:
+        INPUTS_PACKAGE_NAME: ${{inputs.package_name}}
+        INPUTS_PACKAGE_SPEC: ${{inputs.package_spec}}
+        INPUTS_TEST_COMMAND: ${{inputs.test_command}}
+        INPUTS_PACKAGE_DOWNLOAD_EXTRA_ARGS: ${{inputs.package_download_extra_args}}
+        INPUTS_ENV_VALUES: ${{inputs.env_values}}
+        INPUTS_EXTRA_TEST: ${{inputs.extra_test}}

.github/actions/enforce-label/action.yml

@@ -8,7 +8,7 @@ runs:
       if: ${{ github.event.action == 'opened' }}
       run: sleep 60
     - name: enforce-triage-label
-      uses: actions/github-script@v7
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       with:
         script: |
           const required = ['bug', 'enhancement', 'feature', 'maintenance', 'documentation'];

.github/actions/make-sdist/action.yml

@@ -7,7 +7,7 @@ runs:
       run: |
         pip install build
         python -m build --sdist
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: "sdist"
         path: dist/*.tar.gz

.github/actions/pre-commit/action.yml

@@ -5,7 +5,7 @@ runs:
   using: "composite"
   steps:
     - name: Run pre-commit
-      uses: pre-commit/action@v3.0.0
+      uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
       with:
         extra_args: --all-files --hook-stage=manual
     - name: Help message if pre-commit fail

.github/actions/report-coverage/action.yml

@@ -12,7 +12,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         # Use latest Python, so it understands all syntax.
         python-version: "3.13"
@@ -22,7 +22,7 @@ runs:
       shell: bash
 
     - name: Merge Artifacts
-      uses: actions/upload-artifact/merge@v4
+      uses: actions/upload-artifact/merge@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: coverage-data
         pattern: ${{ inputs.artifact_pattern }}
@@ -40,10 +40,12 @@ runs:
         python -Iim coverage report | sed 's/^/    /' >> $GITHUB_STEP_SUMMARY
 
         # Report again and fail if under threshold
-        python -Iim coverage report --fail-under=${{inputs.fail_under}}
+        python -Iim coverage report --fail-under=${INPUTS_FAIL_UNDER}
+      env:
+        INPUTS_FAIL_UNDER: ${{inputs.fail_under}}
 
     - name: Upload HTML report if check failed.
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: html-report
         path: htmlcov

.github/actions/test-sdist/action.yml

@@ -3,7 +3,7 @@ description: "Test a built sdist"
 inputs:
   package_spec:
     description: "The package spec to install"
-    default: '--editable ."[test]"'
+    default: "--editable .[test]"
     required: true
   test_command:
     description: "The test command"
@@ -17,7 +17,7 @@ runs:
   using: "composite"
   steps:
     - name: Download sdist
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
     - name: Install From SDist
       shell: bash
       run: |
@@ -27,15 +27,21 @@ runs:
         mkdir test
         tar --strip-components=1 -zxvf *.tar.gz -C ./test
         cd test
-        python -m pip install ${{inputs.package_spec}}
+        python -m pip install ${INPUTS_PACKAGE_SPEC}
         echo "::endgroup::"
+      env:
+        INPUTS_PACKAGE_SPEC: ${{inputs.package_spec}}
     - name: Run Test
       shell: bash
       run: |
         echo "::group::Run test"
         set -ex
         cd sdist/test
-        eval "${{inputs.env_values}}"
-        eval "${{inputs.test_command}}"
-        eval "${{inputs.extra_test}}"
+        eval "${INPUTS_ENV_VALUES}"
+        eval "${INPUTS_TEST_COMMAND}"
+        eval "${INPUTS_EXTRA_TEST}"
         echo "::endgroup::"
+      env:
+        INPUTS_ENV_VALUES: ${{inputs.env_values}}
+        INPUTS_TEST_COMMAND: ${{inputs.test_command}}
+        INPUTS_EXTRA_TEST: ${{inputs.extra_test}}

.github/actions/update-snapshots-checkout/action.yml

@@ -43,9 +43,10 @@ runs:
         GH_TOKEN: ${{ inputs.github_token }}
 
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         token: ${{ inputs.github_token }}
+        persist-credentials: false
 
     - name: Configure git to use https
       shell: bash -l {0}

.github/actions/update-snapshots/action.yml

@@ -67,20 +67,25 @@ runs:
       if: ${{ inputs.start_server_script != 'null' }}
       working-directory: ${{ inputs.test_folder }}
       shell: bash -l {0}
-      run: (${{ inputs.npm_client }} run ${{ inputs.start_server_script }} 1>/tmp/snapshots-update-server.log 2>&1) &
+      run: (${INPUTS_NPM_CLIENT} run ${INPUTS_START_SERVER_SCRIPT} 1>/tmp/snapshots-update-server.log 2>&1) &
+      env:
+        INPUTS_NPM_CLIENT: ${{ inputs.npm_client }}
+        INPUTS_START_SERVER_SCRIPT: ${{ inputs.start_server_script }}
 
     - name: Setup integration tests
       shell: bash -l {0}
       working-directory: ${{ inputs.test_folder }}
       run: |
-        ${{ inputs.npm_client }} install
+        ${INPUTS_NPM_CLIENT} install
         # Force installing the dependencies
         npx playwright install-deps || true
         npx playwright install ${{ inputs.browser || 'chromium' }}
+      env:
+        INPUTS_NPM_CLIENT: ${{ inputs.npm_client }}
 
     - name: Wait for the server
       if: ${{ inputs.start_server_script != 'null' }}
-      uses: ifaxity/wait-on-action@v1
+      uses: ifaxity/wait-on-action@a7d13170ec542bdca4ef8ac4b15e9c6aa00a6866 # v1.2.1
       with:
         resource: ${{ inputs.server_url }}
         timeout: 360000
@@ -92,15 +97,22 @@ runs:
       continue-on-error: ${{ inputs.continue_on_error == 'yes' }}
       shell: bash -l {0}
       working-directory: ${{ inputs.test_folder }}
-      run: ${{ inputs.npm_client }} run ${{ inputs.update_script }}
+      run: ${INPUTS_NPM_CLIENT} run ${INPUTS_UPDATE_SCRIPT}
+      env:
+        INPUTS_NPM_CLIENT: ${{ inputs.npm_client }}
+        INPUTS_UPDATE_SCRIPT: ${{ inputs.update_script }}
 
     - name: Generate new snapshots (with browser)
       if: ${{ inputs.browser != '' }}
       # Get as much update as possible
       continue-on-error: ${{ inputs.continue_on_error == 'yes' }}
       shell: bash -l {0}
       working-directory: ${{ inputs.test_folder }}
-      run: ${{ inputs.npm_client }} run ${{ inputs.update_script }} --browser ${{ inputs.browser }}
+      run: ${INPUTS_NPM_CLIENT} run ${INPUTS_UPDATE_SCRIPT} --browser ${INPUTS_BROWSER}
+      env:
+        INPUTS_NPM_CLIENT: ${{ inputs.npm_client }}
+        INPUTS_UPDATE_SCRIPT: ${{ inputs.update_script }}
+        INPUTS_BROWSER: ${{ inputs.browser }}
 
     - name: Compress snapshots
       if: ${{ runner.os == 'Linux' }}
@@ -115,13 +127,13 @@ runs:
         echo "::endgroup::"
 
     - name: Upload snapshots as artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: ${{ inputs.artifact_name }}-${{ inputs.browser }}
         path: ${{ inputs.test_folder }}/**/*-snapshots/*.*
 
     - name: Upload report as artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: ${{ inputs.report_name }}
         path: ${{ inputs.test_folder }}/playwright-report
@@ -130,14 +142,16 @@ runs:
       shell: bash -l {0}
       working-directory: ${{ inputs.test_folder }}
       run: |
-        git config user.name '${{ inputs.git_username }}'
-        git config user.email '${{ inputs.git_email }}'
+        git config user.name '${INPUTS_GIT_USERNAME}'
+        git config user.email '${INPUTS_GIT_EMAIL}'
 
         git pull --no-tags
         git add ./*-snapshots/*.*
         git commit -m "Update Playwright Snapshots"
       env:
         GITHUB_TOKEN: ${{ inputs.github_token }}
+        INPUTS_GIT_USERNAME: ${{ inputs.git_username }}
+        INPUTS_GIT_EMAIL: ${{ inputs.git_email }}
 
     - name: Push new snapshots
       if: ${{ inputs.dry_run != 'yes' }}

.github/actions/upload-coverage/action.yml

@@ -21,13 +21,15 @@ runs:
       id: artifact-name
       shell: bash
       run: |
-        export ARTIFACT_NAME=${{ inputs.artifact_name }}
+        export ARTIFACT_NAME=${INPUTS_ARTIFACT_NAME}
         if [ -z "$ARTIFACT_NAME" ]; then
           export ARTIFACT_NAME="coverage-$RANDOM"
         fi
         echo "artifact_name=$ARTIFACT_NAME" >> "$GITHUB_OUTPUT"
+      env:
+        INPUTS_ARTIFACT_NAME: ${{ inputs.artifact_name }}
     - name: Upload coverage data
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: ${{ steps.artifact-name.outputs.artifact_name }}
         path: ".coverage.*"

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
       actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
@@ -16,3 +18,5 @@ updates:
       actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7

.github/workflows/check-release.yml

@@ -10,11 +10,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Base Setup
         uses: ./.github/actions/base-setup
       - name: Check Release
-        uses: jupyter-server/jupyter_releaser/.github/actions/check-release@v2
+        uses: jupyter-server/jupyter_releaser/.github/actions/check-release@3e74486d1011d24cd5e9977202fd349dece0db9c # v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version_spec: 100.100.100