Pin actions, and use new GHA syntax to reference own shared workflows and actions

.github/workflows/_shared-docs-build-pr.yml

@@ -228,7 +228,7 @@ jobs:
     steps:
       - name: Variable setup
         id: vars
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           RUNNER_TEMP: ${{ runner.temp }}
           EVENT_ACTION: ${{ github.event.action }}
@@ -282,7 +282,7 @@ jobs:
             }
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python }}
 
@@ -301,15 +301,15 @@ jobs:
           fi
 
       - name: Checkout BASE
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: ${{ steps.vars.outputs.checkout-path }}
           persist-credentials: false
 
       - name: Initialize the build environment (BASE)
         id: init-base
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-init@main
+        uses: $/actions/ansible-docs-build-init
         with:
           collections: ${{ inputs.collection-name }}
           dest-dir: ${{ steps.vars.outputs.init-dir-base }}
@@ -333,15 +333,15 @@ jobs:
 
       - name: Build BASE
         id: build-base
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-html@main
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: ${{ steps.init-base.outputs.build-script }}
           build-html: ${{ steps.init-base.outputs.build-html }}
           copy-build: ${{ github.workspace }}/docsbuild/base
           artifact-upload: 'false'
 
       - name: Checkout HEAD
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           # It would be better to use
           #
@@ -358,7 +358,7 @@ jobs:
 
       - name: Initialize the build environment (HEAD)
         id: init-head
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-init@main
+        uses: $/actions/ansible-docs-build-init
         with:
           collections: ${{ inputs.collection-name }}
           dest-dir: ${{ steps.vars.outputs.init-dir-head }}
@@ -382,7 +382,7 @@ jobs:
 
       - name: Build HEAD
         id: build-head
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-html@main
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: ${{ steps.init-head.outputs.build-script }}
           build-html: ${{ steps.init-head.outputs.build-html }}
@@ -392,7 +392,7 @@ jobs:
       - name: Get a diff of the changes
         if: steps.build-base.outputs.hash != steps.build-head.outputs.hash
         id: diff
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-diff@main
+        uses: $/actions/ansible-docs-build-diff
         with:
           build-html-a: ${{ steps.build-base.outputs.build-html }}
           build-html-b: ${{ steps.build-head.outputs.build-html }}

.github/workflows/_shared-docs-build-publish-gh-pages.yml

@@ -61,7 +61,7 @@ jobs:
     steps:
       - name: Process variables
         id: vars
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const inputs = ${{ toJSON(inputs) }}
@@ -89,7 +89,7 @@ jobs:
           exit 1
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: gh-pages
           path: gh-pages-checkout
@@ -106,7 +106,7 @@ jobs:
       - name: Retrieve rendered docs
         if: inputs.action == 'publish'
         id: download
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: ${{ inputs.artifact-name }}
           path: gh-pages-checkout/${{ steps.vars.outputs.dest }}
@@ -129,19 +129,19 @@ jobs:
 
       - name: Setup GitHub Pages
         if: inputs.publish-gh-pages-branch
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d  # v6.0.0
         with:
           token: ${{ secrets.GH_TOKEN }}
 
       - name: Upload gh-pages branch as artifact
         if: inputs.publish-gh-pages-branch
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
         with:
           path: gh-pages-checkout
 
       - name: Deploy gh-pages branch to GitHub Pages
         if: inputs.publish-gh-pages-branch
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5.0.0
         with:
           token: ${{ secrets.GH_TOKEN }}

.github/workflows/_shared-docs-build-publish-surge.yml

@@ -36,13 +36,13 @@ jobs:
       - name: Retrieve rendered docs
         if: inputs.action == 'publish'
         id: download
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: ${{ inputs.artifact-name }}
           path: html
 
       - name: Install Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: 24
 

.github/workflows/_shared-docs-build-push.yml

@@ -158,7 +158,7 @@ jobs:
     steps:
       - name: Variable setup
         id: vars
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           RUNNER_TEMP: ${{ runner.temp }}
         with:
@@ -197,7 +197,7 @@ jobs:
             core.setOutput('skip-init', skipInit)
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python }}
 
@@ -217,7 +217,7 @@ jobs:
           fi
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: ${{ steps.vars.outputs.checkout-path }}
           ref: ${{ inputs.build-ref }}
@@ -228,7 +228,7 @@ jobs:
 
       - name: Initialize the build environment
         id: init
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-init@main
+        uses: $/actions/ansible-docs-build-init
         with:
           collections: ${{ steps.vars.outputs.col-name }}
           dest-dir: ${{ steps.vars.outputs.init-dir }}
@@ -252,7 +252,7 @@ jobs:
 
       - name: Build
         id: build
-        uses: ansible-community/github-docs-build/actions/ansible-docs-build-html@main
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: ${{ steps.init.outputs.build-script }}
           build-html: ${{ steps.init.outputs.build-html }}

.github/workflows/generate-wiki-docs.yml

@@ -23,19 +23,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - if: fromJSON(env.SHOULD_RUN)
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout wiki
         if: fromJSON(env.SHOULD_RUN)
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: ${{ github.repository }}.wiki
           path: ${{ env.WIKI }}
           persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         if: fromJSON(env.SHOULD_RUN)
         with:
           python-version: '3.13'

.github/workflows/test-action-build-html.yml

@@ -22,20 +22,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Simple 1 invoke - no copy, no artifact
         id: simple1
-        uses: ./actions/ansible-docs-build-html
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: .test/simple-build/build.sh
           build-html: .test/simple-build/build/html
           artifact-upload: false
 
       - name: Simple 1 - Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         id: simple1-artifact
         with:
           path: .artifacts/simple1
@@ -61,15 +61,15 @@ jobs:
 
       - name: Simple 2 invoke - with copy, no artifact
         id: simple2
-        uses: ./actions/ansible-docs-build-html
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: .test/simple-build/build.sh
           build-html: .test/simple-build/build/html
           copy-build: .copies/simple2/html
           artifact-upload: false
 
       - name: Simple 2 - Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         id: simple2-artifact
         with:
           path: .artifacts/simple2
@@ -98,15 +98,15 @@ jobs:
 
       - name: Simple 3 invoke - no copy, with artifact
         id: simple3
-        uses: ./actions/ansible-docs-build-html
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: .test/simple-build/build.sh
           build-html: .test/simple-build/build/html
           artifact-retention-days: 1
           artifact-name: tests-simple3
 
       - name: Simple 3 - Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         id: simple3-artifact
         with:
           name: ${{ steps.simple3.outputs.artifact-name }}
@@ -147,7 +147,7 @@ jobs:
 
       - name: Simple 4 invoke - with copy, with artifact
         id: simple4
-        uses: ./actions/ansible-docs-build-html
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: .test/simple-build/build.sh
           build-html: .test/simple-build/build/html
@@ -156,7 +156,7 @@ jobs:
           artifact-name: tests-simple4
 
       - name: Simple 4 - Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         id: simple4-artifact
         with:
           name: ${{ steps.simple4.outputs.artifact-name }}
@@ -200,7 +200,7 @@ jobs:
 
       - name: Simple 5 invoke - with copy, with artifact, trailing slash in input
         id: simple5
-        uses: ./actions/ansible-docs-build-html
+        uses: $/actions/ansible-docs-build-html
         with:
           build-script: .test/simple-build/build.sh
           build-html: .test/simple-build/build/html/
@@ -209,7 +209,7 @@ jobs:
           artifact-name: tests-simple5
 
       - name: Simple 5 - Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         id: simple5-artifact
         with:
           name: ${{ steps.simple5.outputs.artifact-name }}

.github/workflows/test-action-build-init.yml

@@ -108,12 +108,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Install Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: 3.13
 
@@ -124,7 +124,7 @@ jobs:
       # the id (and we need it in later steps).
       - name: Init
         id: init
-        uses: ./actions/ansible-docs-build-init
+        uses: $/actions/ansible-docs-build-init
         with:
           collections: ${{ matrix.collections }}
           # combining runner.temp and /docsbuild copies the default from the action

actions/ansible-docs-build-comment/action.yml

@@ -45,15 +45,15 @@ runs:
   steps:
     - name: Look for an existing comment
       id: fc
-      uses: peter-evans/find-comment@v4
+      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad  # v4.0.0
       with:
         issue-number: ${{ inputs.pr-number }}
         body-includes: ${{ inputs.body-includes }}
         comment-author: 'github-actions[bot]'
 
     - name: Determine actions
       id: vars
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       with:
         script: |
           const inputs = ${{ toJSON(inputs )}}
@@ -78,7 +78,7 @@ runs:
       if: >-
         steps.vars.outputs.action == 'remove'
         && steps.fc.outputs.comment-id
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       with:
         script: |
           github.rest.issues.deleteComment({
@@ -90,7 +90,7 @@ runs:
     - name: Post or update comment
       id: comment
       if: steps.vars.outputs.action == 'update'
-      uses: peter-evans/create-or-update-comment@v5
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9  # v5.0.0
       with:
         comment-id: ${{ steps.fc.outputs.comment-id }}
         issue-number: ${{ inputs.pr-number }}

actions/ansible-docs-build-diff/action.yml

@@ -94,7 +94,7 @@ runs:
 
     - name: Create diff
       id: diff
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       with:
         script: |
           // attribution: https://stackoverflow.com/a/3561711/3905079

actions/ansible-docs-build-html/action.yml

@@ -68,7 +68,7 @@ runs:
 
     - name: Upload artifact
       if: fromJSON(inputs.artifact-upload)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         path: ${{ steps.build.outputs.build-html }}
         name: ${{ inputs.artifact-name }}