Pin dependencies

.github/workflows/add-netlify-link.yml

@@ -12,11 +12,11 @@ jobs:
     steps:
       - name: Check for changed files
         id: changed-files
-        uses: tj-actions/changed-files@c3a1bb2c992d77180ae65be6ae6c166cf40f857c # v45
+        uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v45
 
       - name: Add Netlify link to PR
         if: steps.changed-files.outputs.all_changed_files != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           github-token: ${{ secrets.NF_CORE_BOT_AUTH_TOKEN }}
           script: |

.github/workflows/add-tools-api-docs.yml

@@ -12,16 +12,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Checkout tools code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: 'nf-core/tools'
           ref: ${{ inputs.ref_name }}
           path: 'tools'
 
       - name: setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: '20'
 

.github/workflows/broken-link-checker.yml

@@ -15,7 +15,7 @@ jobs:
           site_name: 'nf-core'
           max_timeout: 600 # 10 Minutes
       - name: Check for broken links
-        uses: JustinBeckwith/linkinator-action@v1
+        uses: JustinBeckwith/linkinator-action@3d5ba091319fa7b0ac14703761eebb7d100e6f6d # v1
         with:
           paths: 'https://deploy-preview-${{github.event.pull_request.number}}--nf-core.netlify.app'
           recurse: true

.github/workflows/remove-canceled-netlify-builds.yml

@@ -7,7 +7,7 @@ jobs:
     if: github.event.comment.user.login == 'netlify[bot]' && contains(github.event.comment.body, 'Deploy Preview for') && contains(github.event.comment.body, 'canceled.')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             github.rest.issues.deleteComment({

.github/workflows/rich-codex.yml

@@ -25,7 +25,7 @@ jobs:
         run: pip install nf-core
 
       - name: Generate terminal images with rich-codex
-        uses: ewels/rich-codex@v1
+        uses: ewels/rich-codex@8ce988cc253c240a3027ba58e33e47640935dd8b # v1
         env:
           COLUMNS: 100
           HIDE_PROGRESS: 'true'