From 281edc39f44c953d0cc4912aef36a60eefeed4bd Mon Sep 17 00:00:00 2001
From: Jens Polspoel <jens@zodi-innovations.be>
Date: Tue, 14 Jul 2026 13:17:41 +0200
Subject: [PATCH 1/2] Security: GitHub Actions pinnen op volledige commit-SHA

Automatische SHA-pinning van GitHub Actions (INBO security-hardening).
---
 .github/workflows/check_on_different_r_os.yml | 10 +++++-----
 .github/workflows/check_package.yaml          |  4 ++--
 .github/workflows/examples.yml                |  4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/check_on_different_r_os.yml b/.github/workflows/check_on_different_r_os.yml
index 2e692b64..d3df397b 100644
--- a/.github/workflows/check_on_different_r_os.yml
+++ b/.github/workflows/check_on_different_r_os.yml
@@ -32,20 +32,20 @@ jobs:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
-      - uses: r-lib/actions/setup-r@v2
+      - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           r-version: ${{ matrix.config.r }}
           extra-repositories: https://inbo.r-universe.dev
 
-      - uses: r-lib/actions/setup-pandoc@v2
+      - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
 
-      - uses: r-lib/actions/setup-r-dependencies@v2
+      - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           extra-packages: any::rcmdcheck
           needs: check
 
-      - uses: r-lib/actions/check-r-package@v2
+      - uses: r-lib/actions/check-r-package@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           error-on: '"error"'
diff --git a/.github/workflows/check_package.yaml b/.github/workflows/check_package.yaml
index 1beaf8ae..0f5bf13b 100644
--- a/.github/workflows/check_package.yaml
+++ b/.github/workflows/check_package.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: "Check package with checklist"
-        uses: inbo/actions/check_pkg@composite
+        uses: inbo/actions/check_pkg@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite
   deploy-pages:
     name: deploy-gh-pages
     runs-on: ubuntu-24.04
@@ -26,4 +26,4 @@ jobs:
       contents: write
     steps:
       - name: "Tag and deploy gh-pages"
-        uses: inbo/actions/check_deploy@composite
+        uses: inbo/actions/check_deploy@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index 7fe04c0d..d02094b6 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -14,9 +14,9 @@ jobs:
     name: "test Rmd"
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: build examples
-        uses: inbo/actions/render_inbomd@devel
+        uses: inbo/actions/render_inbomd@55098124f283c4f9b9402d43ec4a9382ee05c105 # devel
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EXAMPLE_BRANCH: main

From 65a524d2ce6d133186fbcad5f252967579cd451d Mon Sep 17 00:00:00 2001
From: Jens Polspoel <jens@zodi-innovations.be>
Date: Tue, 14 Jul 2026 13:45:07 +0200
Subject: [PATCH 2/2] =?UTF-8?q?Enkel=20externe=20actions=20pinnen=20?=
 =?UTF-8?q?=E2=80=94=20INBO-eigen=20(inbo/*)=20ontpind?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/check_package.yaml | 4 ++--
 .github/workflows/examples.yml       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/check_package.yaml b/.github/workflows/check_package.yaml
index 0f5bf13b..1beaf8ae 100644
--- a/.github/workflows/check_package.yaml
+++ b/.github/workflows/check_package.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: "Check package with checklist"
-        uses: inbo/actions/check_pkg@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite
+        uses: inbo/actions/check_pkg@composite
   deploy-pages:
     name: deploy-gh-pages
     runs-on: ubuntu-24.04
@@ -26,4 +26,4 @@ jobs:
       contents: write
     steps:
       - name: "Tag and deploy gh-pages"
-        uses: inbo/actions/check_deploy@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite
+        uses: inbo/actions/check_deploy@composite
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index d02094b6..b1513157 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -16,7 +16,7 @@ jobs:
       - name: checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: build examples
-        uses: inbo/actions/render_inbomd@55098124f283c4f9b9402d43ec4a9382ee05c105 # devel
+        uses: inbo/actions/render_inbomd@devel
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EXAMPLE_BRANCH: main