MNT: Use hash for Action workflow versions and update if needed

.github/workflows/docs.yml

@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # v5.2.0
         with:
           python-version: 3.11
 
@@ -47,7 +47,7 @@ jobs:
       # only store the artifact for 'retention-days'
       - name: Upload docs artifact
         # if: github.event.pull_request.merged == true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874  # v4.4.0
         with:
           name: built_docs
           path: docs/_build/html
@@ -64,11 +64,11 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
       # download the previously uploaded 'built_docs' artifact
       - name: Download docs artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
         id: download
         with:
           name: built_docs

.github/workflows/package.yml

@@ -12,10 +12,10 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # v5.2.0
         with:
           python-version: 3.11
 
@@ -37,7 +37,7 @@ jobs:
           python -m pep517.build --source --binary --out-dir dist/ .
 
       - name: Publish distribution to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@897895f1e160c830e369f9779632ebc134688e1b  # v1.10.2
         with:
           user: __token__
           password: ${{ secrets.pypi_password }}

.github/workflows/tests.yml

@@ -13,10 +13,10 @@ jobs:
 
     steps:
     - name: Check out code 
-      uses: actions/checkout@v4
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # v5.2.0
       with:
         python-version: ${{ matrix.python-version }}
 

.github/workflows/update_stats.yml

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # v5.2.0
         with:
           python-version: 3.11
 
@@ -37,7 +37,7 @@ jobs:
       # cache key syntax: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows#using-contexts-to-create-cache-keys
       - name: Restore cached files
         id: cache-files-restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9  # v4.0.2
         with: 
           path: ./cache
           key: ${{ runner.os }}-${{ hashFiles('~/.cache_key') }}
@@ -51,7 +51,7 @@ jobs:
       # otherwise the cache save will 'fail' (because there's no need to update it - that's fine)
       - name: Update cached files
         id: cache-files-save
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9  # v4.0.2
         with:
           path: ./cache
           key: ${{ runner.os }}-${{ hashFiles('./cache') }}