Review changes for GitHub actions version to commit hash

[peterdesmet]

• birdradar BMK, oscibio removed
• camtrapdp @peterdesmet
• camtraptor @damianooldoni
• crow @peterdesmet
• esas @PietrH
• etn @PietrH
• etnservice @PietrH
• vespadb @PietrH
• ratatouille @PietrH
• ict-intranet BMK, oscibio removed
• inbo-aws-aloft-terraform @peterdesmet
• inbodb BMK, oscibio removed
• inborutils BMK, oscibio removed
• inbospatial BMK, oscibio removed
• mica-dashboard @damianooldoni
• movepub @peterdesmet
• pywhip @peterdesmet
• tutorials @damianooldoni
• vespaR: FIS, oscibio removed
• forum-wasbeer-2026 @damianooldoni

Please add commit hashes for actions below, so we don't have to check for all.

[damianooldoni]

In table below we can look upthe commit SHA based on some owner/repo/ref triplets for some GitHub Actions. Code and returned table formatted using markdown is provided. To any contributor: just use the code here below and use reprex::reprex(). The docstring package is just needed to have a nice documentation of a function out of a package and it renders better with reprex.

require(gh)
#> Loading required package: gh
require(purrr)
#> Loading required package: purrr
require(docstring)
#> Loading required package: docstring
#> 
#> Attaching package: 'docstring'
#> The following object is masked from 'package:utils':
#> 
#>     ?

get_sha <- function(owner, repo, ref) {
  
  #' Get the SHA of a GitHub reference
  #' 
  #' @param owner The owner of the repository.
  #' @param repo The name of the repository.
  #' @param ref The Git reference (branch or tag).
  #' @return The SHA of the specified Git reference.
  #' @examples
  #' get_sha("ropensci-review-tools", "pkgcheck-action", "heads/main")
   
  gh::gh(
    "/repos/{owner}/{repo}/git/ref/{ref}", 
    owner = owner, 
    repo = repo, 
    ref = ref
  ) |> 
    purrr::pluck("object") |> 
    purrr::pluck("sha")
}

actions <- tibble::tibble(
  owner = c(
    "ropensci-review-tools",
    "actions",
    "actions",
    "actions",
    "actions",
    "actions",
    "r-lib",
    "JamesIves",
    "c-hive",
    "codecov",
    "codecov",
    "appleboy",
    "peaceiris"
  ),
  repo = c(
    "pkgcheck-action",
    "deploy-pages",
    "upload-pages-artifact",
    "configure-pages",
    "checkout",
    "upload-artifact",
    "actions",
    "github-pages-deploy-action",
    "gha-remove-artifacts",
    "codecov-action",
    "codecov-action",
    "ssh-action",
    "actions-hugo"
  ),
  ref = c(
    "heads/main",
    "tags/v5",
    "tags/v5",
    "tags/v6",
    "tags/v6",
    "tags/v7",
    "tags/v2",
    "tags/v4.8.0",
    "tags/v1",
    "tags/v6",
    "tags/v7",
    "heads/master",
    "tags/v2"
  )
)

actions <- actions |>
  dplyr::mutate(
    sha = purrr::pmap_chr(
      list(owner, repo, ref), 
      get_sha
    )
  )

knitr::kable(x = actions, format = "pipe")

owner	repo	ref	sha
ropensci-review-tools	pkgcheck-action	heads/main	fa6dc3e9dec0580397ae44ec6fb9e7953947758c
actions	deploy-pages	tags/v5	cd2ce8fcbc39b97be8ca5fce6e763baed58fa128
actions	upload-pages-artifact	tags/v5	fc324d3547104276b827a68afc52ff2a11cc49c9
actions	configure-pages	tags/v6	45bfe0192ca1faeb007ade9deae92b16b8254a0d
actions	checkout	tags/v6	df4cb1c069e1874edd31b4311f1884172cec0e10
actions	upload-artifact	tags/v7	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
r-lib	actions	tags/v2	d3c5be51b12e724e68f33216ca3c148b66d5f0b6
JamesIves	github-pages-deploy-action	tags/v4.8.0	d92aa235d04922e8f08b40ce78cc5442fcfbfa2f
c-hive	gha-remove-artifacts	tags/v1	44fc7acaf1b3d0987da0e8d4707a989d80e9554b
codecov	codecov-action	tags/v6	f2274c2c340e0c81c8f7dc407b2a477b8935f171
codecov	codecov-action	tags/v7	a99c28d3f0da835de33ff2feb2e15691c7b9641f
appleboy	ssh-action	heads/master	068c0c7a4e59a5ae12fb7cb454b05735d830c82b
peaceiris	actions-hugo	tags/v2	dc99976453b04b1029527154fc04fef80a4a49cf

^{Created on 2026-07-14 with reprex v2.1.1}