chore(deps): pin dependencies

Author: renovate[bot]

.github/actions/toolchain/action.yml

@@ -9,7 +9,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout ATT
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         path: att
     - name: Find NCS SHA
@@ -19,7 +19,7 @@ runs:
         echo "NCS_REV=${NCS_REV}" >> $GITHUB_ENV
         echo "NCS_REV=${NCS_REV}"
     - name: Checkout NCS
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         path: nrf
         repository: nrfconnect/sdk-nrf

.github/workflows/attach_release_assets.yml

@@ -23,16 +23,16 @@ jobs:
     needs: [build]
     steps:
         - name: Checkout
-          uses: actions/checkout@v4
+          uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
         - name: Download artifact
-          uses: actions/download-artifact@v4
+          uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
           with:
            pattern: firmware-*
            merge-multiple: true
 
         - name: Deploy release to github
-          uses: softprops/action-gh-release@v2
+          uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
           with:
             fail_on_unmatched_files: true
             files: |

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
     outputs:
       toolchain-version: ${{ steps.setup.outputs.toolchain-version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: ./.github/actions/toolchain
         id: setup
   build:
@@ -74,7 +74,7 @@ jobs:
       version: ${{ env.VERSION }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           path: thingy91x-oob
 
@@ -161,7 +161,7 @@ jobs:
           sed -i '1d' pmr-nrf91-default-${{ env.VERSION }}.txt
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-upload-oob
         with:
           name: firmware-oob
@@ -199,7 +199,7 @@ jobs:
           cp dfu_application.zip hello.nrfcloud.com-${{ env.VERSION }}-thingy91x-nrf91-trace-dfu.zip
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-upload-oob-trace
         with:
           name: firmware-oob-trace
@@ -250,7 +250,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ inputs.build_debug }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-upload-oob-debug
         with:
           name: firmware-oob-debug
@@ -300,7 +300,7 @@ jobs:
           cp nrf53-bl-*.hex $(pwd)/nrf/applications/connectivity_bridge/build/
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-upload-connectivity-bridge
         with:
           name: firmware-connectivity-bridge
@@ -329,7 +329,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ inputs.build_bl_update }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-upload-bl-update
         with:
           name: firmware-bl-update

.github/workflows/compliance.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - name: Checkout the code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         path: thingy91x-oob
         ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/dfu_check.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       toolchain-version: ${{ steps.setup.outputs.toolchain-version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: ./.github/actions/toolchain
         id: setup
   analyze:
@@ -39,7 +39,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           path: thingy91x-oob
 
@@ -52,7 +52,7 @@ jobs:
           west update -o=--depth=1 -n
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: firmware-*
           merge-multiple: true

.github/workflows/docker_publish.yml

@@ -21,24 +21,24 @@ jobs:
 
     steps:
     - name: Checkout the code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
     - name: Log in to the Container registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ env.REGISTRY }}
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Extract metadata (tags, labels) for Docker
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
     - name: Build and push Docker image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       with:
         context: tests/on_target/
         push: true

.github/workflows/docs-build-and-publish-zooomin.yml

@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install dependencies
         run: |
@@ -73,7 +73,7 @@ jobs:
           ls -lah .
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: doc-build
           if-no-files-found: error

.github/workflows/docs-build-and-publish.yml

@@ -21,7 +21,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install dependencies
         run: |
@@ -39,7 +39,7 @@ jobs:
           sphinx-build -M html . build
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: doc-build
           if-no-files-found: error

.github/workflows/on_target.yml

@@ -53,12 +53,12 @@ jobs:
         - /opt/setup-jlink:/opt/setup-jlink
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           path: thingy91x-oob
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: firmware-*
           merge-multiple: true
@@ -131,7 +131,7 @@ jobs:
 
       - name: Results
         if: always()
-        uses: pmeier/pytest-results-action@v0.7.1
+        uses: pmeier/pytest-results-action@fc6576eced1f411ea48ab10e917d9cfce2960e29 # v0.7.1
         with:
           path: thingy91x-oob/tests/on_target/results/*.xml
           summary: true
@@ -140,7 +140,7 @@ jobs:
 
       - name: Create Report Artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-report
         with:
           name: test-report
@@ -149,7 +149,7 @@ jobs:
 
       - name: Push log files to artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         id: artifact-upload-test-logs
         with:
           name: test-logs

.github/workflows/publish-firmware-bundles-tests.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22