From d15f99eb1e1d7d8d92219c16b62bb52b3846e93b Mon Sep 17 00:00:00 2001
From: Jens Polspoel <jens@zodi-innovations.be>
Date: Tue, 14 Jul 2026 13:18:49 +0200
Subject: [PATCH 1/2] Security: GitHub Actions pinnen op volledige commit-SHA

Automatische SHA-pinning van GitHub Actions (INBO security-hardening).
---
 .github/workflows/check_on_branch.yml         |  2 +-
 .github/workflows/check_on_different_r_os.yml | 10 +++++-----
 .github/workflows/check_on_main.yml           |  2 +-
 .github/workflows/release.yml                 |  4 ++--
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/check_on_branch.yml b/.github/workflows/check_on_branch.yml
index bc635a0..7b092ed 100644
--- a/.github/workflows/check_on_branch.yml
+++ b/.github/workflows/check_on_branch.yml
@@ -17,4 +17,4 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: inbo/actions/check_pkg@main
+      - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main
diff --git a/.github/workflows/check_on_different_r_os.yml b/.github/workflows/check_on_different_r_os.yml
index e769b5b..9239c5c 100644
--- a/.github/workflows/check_on_different_r_os.yml
+++ b/.github/workflows/check_on_different_r_os.yml
@@ -32,20 +32,20 @@ jobs:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
-      - uses: r-lib/actions/setup-r@v2
+      - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           r-version: ${{ matrix.config.r }}
           extra-repositories: https://inbo.r-universe.dev https://inla.r-inla-download.org/R/stable
 
-      - uses: r-lib/actions/setup-pandoc@v2
+      - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
 
-      - uses: r-lib/actions/setup-r-dependencies@v2
+      - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           extra-packages: any::rcmdcheck
           needs: check
 
-      - uses: r-lib/actions/check-r-package@v2
+      - uses: r-lib/actions/check-r-package@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           error-on: '"error"'
diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml
index 6e8268d..7ef69d3 100644
--- a/.github/workflows/check_on_main.yml
+++ b/.github/workflows/check_on_main.yml
@@ -16,4 +16,4 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: inbo/actions/check_pkg@main
+      - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9b10b9f..71a2bd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Get tag
         run: |
           git fetch --tags --force
@@ -23,7 +23,7 @@ jobs:
           TAG_BODY=$(git tag --contains $(git rev-parse HEAD) --format='%(contents)')
           echo "tag=$TAG" >> $GITHUB_ENV
           echo "$TAG_BODY" > body.md
-      - uses: ncipollo/release-action@v1
+      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
         with:
           name: Release ${{ env.tag }}
           tag: ${{ env.tag }}

From 6d00f0ff26e52557a1becb32c7ad73e7c9991e37 Mon Sep 17 00:00:00 2001
From: Jens Polspoel <jens@zodi-innovations.be>
Date: Tue, 14 Jul 2026 13:45:52 +0200
Subject: [PATCH 2/2] =?UTF-8?q?Enkel=20externe=20actions=20pinnen=20?=
 =?UTF-8?q?=E2=80=94=20INBO-eigen=20(inbo/*)=20ontpind?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/check_on_branch.yml | 2 +-
 .github/workflows/check_on_main.yml   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check_on_branch.yml b/.github/workflows/check_on_branch.yml
index 7b092ed..bc635a0 100644
--- a/.github/workflows/check_on_branch.yml
+++ b/.github/workflows/check_on_branch.yml
@@ -17,4 +17,4 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main
+      - uses: inbo/actions/check_pkg@main
diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml
index 7ef69d3..6e8268d 100644
--- a/.github/workflows/check_on_main.yml
+++ b/.github/workflows/check_on_main.yml
@@ -16,4 +16,4 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main
+      - uses: inbo/actions/check_pkg@main