fix: Workflow hash pinning

.github/workflows/citations.yml

@@ -30,10 +30,11 @@ concurrency:
 
 jobs:
   validate-citations:
-    runs-on: ubuntu-24.04
+    runs-on:
+        group: managed
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Install R
       run: |
         sudo apt-get update && sudo apt-get install -y r-base

.github/workflows/codeql.yml

@@ -20,7 +20,8 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    runs-on:
+        group: managed
     permissions:
       # required for all workflows
       security-events: write
@@ -35,11 +36,11 @@ jobs:
           build-mode: none
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -51,6 +52,6 @@ jobs:
         # queries: security-extended,security-and-quality
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/pre-commit.yaml

@@ -20,11 +20,12 @@ on:
 
 jobs:
   pre-commit:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         if: ${{ hashFiles('.pre-commit-config.yaml') != '' }}
         with:
           python-version:  ${{ inputs.python-version }}

.github/workflows/publish.yaml

@@ -7,15 +7,16 @@ on:
 
 jobs:
   build-package:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed
     permissions:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.13
 
@@ -35,33 +36,35 @@ jobs:
     name: Publish to PyPI
     needs:
     - build-package
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed
     environment:
       name: pypi
       url: https://pypi.org/p/transformer-thermal-model
     permissions:
       id-token: write
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: transformer-thermal-model-package
+        name: switchgear-thermal-model-package
         path: dist/
     - name: Publish distribution 📦 to PyPI
       uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b #v1.14.0
   publish-to-github:
     name: Publish to GitHub Releases
     needs:
     - build-package
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed
     permissions:
       contents: write
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Download all the dists
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: transformer-thermal-model-package
         path: dist/

.github/workflows/pytest.yaml

@@ -19,12 +19,13 @@ on:
 
 jobs:
   pytest:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install python${{ inputs.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version:  ${{ inputs.python-version }}
       - name: Install Poetry

.github/workflows/reuse-compliance.yaml

@@ -15,9 +15,10 @@ concurrency:
 
 jobs:
   reuse-compliance-check:
-    runs-on: ubuntu-24.04
+    runs-on:
+        group: managed
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: REUSE Compliance Check
       uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 #v6.0.0

.github/workflows/run-example-notebooks.yaml

@@ -19,12 +19,13 @@ on:
 
 jobs:
   check-notebooks:
-    runs-on: ubuntu-latest
+    runs-on:
+        group: managed
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install python${{ env.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.python-version }}
       - name: Install Poetry