[ev-br]

Follow the supply chain practices and pin exact hashes for GH actions.

cross-ref similar PRs: data-apis/array-api-strict#251, data-apis/array-api-tests#472

[lucascolley]

did you do it by hand or use a tool like pixi exec gha-update?

[ev-br]

did you do it by hand or use a tool like pixi exec gha-update?

old-school manual I'm afraid

[lucascolley]

would be good to also add linting and an auto-update tool for this, but it's an improvement :)

[ev-br]

would be good to also add linting and an auto-update tool for this, but it's an improvement :)

dependabot is set up in this repo, is this what you meant?

One other potential improvement is to fix what zizmor flags, also for a follow-up I think.

[lucascolley]

dependabot is one option among many, I use https://github.com/data-apis/array-api-extra/blob/main/.github/renovate.json over in array-api-extra, you could also roll-your-own bot to make updates like https://github.com/prefix-dev/pixi/blob/main/.github/workflows/upgrade-pixi.yml.

For the linting, I think https://github.com/data-apis/array-api-extra/blob/d4473a7dec2b197ea9973ac547cbc0ae996ebcfd/.lefthook.yml#L54-L55 should catch problems like not pinning to hashes, yeah

[ev-br]

FWIW my default position is "ain't broken don't fix". Dependabot is sure not the only option, and I'm not particularly fixated on it. It is set up already, it seems to work, it is sufficiently quiet, it does not require maintenance or even attention.
And I've been recently informed that changing the tags to hashes once makes it use hashes going forward. If that's the case indeed (will need to keep an eye on it for a while I suppose), that's good enough for me at least.

That said, I'm happy to review PRs with improvements for established best practices.

[lucascolley]

yeah, making dependabot handle it is probably the path of least resistance from the current state

[ev-br]

For this PR specifically, I'm going to merge this as approved (thanks Lucas!) and proceed with gh-478 and then gh-476 which is quite overdue already. Follow-up improvements are most welcome.