chore(deps): pin dependencies

.github/workflows/changelog.yml

@@ -36,7 +36,7 @@ jobs:
           fi
           gh pr checkout $PR_NUMBER
 
-      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 
@@ -65,7 +65,7 @@ jobs:
           echo "File changed: ${{ env.changed }}"
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           cache: "pip"

.github/workflows/create-lint-wf.yml

@@ -47,7 +47,7 @@ jobs:
 
       # Set up nf-core/tools
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           cache: pip

.github/workflows/create-test-lint-wf-template.yml

@@ -66,7 +66,7 @@ jobs:
         name: Check out source-code repository
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 

.github/workflows/create-test-wf.yml

@@ -45,7 +45,7 @@ jobs:
         name: Check out source-code repository
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 

.github/workflows/deploy-pypi.yml

@@ -17,7 +17,7 @@ jobs:
         name: Check out source-code repository
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 

.github/workflows/fix-linting.yml

@@ -32,7 +32,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.nf_core_bot_auth_token }}
 
       # Install and run pre-commit
-      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 

.github/workflows/lint-code.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           cache: "pip"

.github/workflows/pytest.yml

@@ -86,7 +86,7 @@ jobs:
         name: Check out source-code repository
 
       - name: Set up Python ${{ needs.setup.outputs.python-version }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ needs.setup.outputs.python-version }}
           cache: "pip"
@@ -170,7 +170,7 @@ jobs:
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         env:
           AGENT_TOOLSDIRECTORY: /opt/actions-runner/_work/tools/tools/
         with:
@@ -187,14 +187,14 @@ jobs:
           mv .github/.coveragerc .
 
       - name: Download all artifacts
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       - name: Run coverage
         run: |
           coverage combine --keep coverage*/.coverage*
           coverage report
           coverage xml
 
-      - uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5
+      - uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5
         with:
           files: coverage.xml
         env:

.github/workflows/sync.yml

@@ -73,7 +73,7 @@ jobs:
           fetch-depth: "0"
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 

.github/workflows/test_offline_configs.yml

@@ -67,28 +67,28 @@ jobs:
           fetch-depth: "0"
       - name: Check the correct default config base of the nf-core configs
         id: check_default_config
-        uses: GuillaumeFalourd/assert-command-line-output@v2
+        uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
         with:
           command_line: nextflow config -value params.custom_config_base .
           contains: https://raw.githubusercontent.com/nf-core/configs/master
           expected_result: PASSED
       - name: Check the correct inclusion of an existing institutional profile
         id: check_profile_inclusion
-        uses: GuillaumeFalourd/assert-command-line-output@v2
+        uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
         with:
           command_line: nextflow config -profile google -o flat .
           contains: "The nf-core framework" # Part of CITATION.cff, should always be printed if profile is included
           expected_result: PASSED
       - name: Check the failed inclusion of a non-existing institutional profile
         id: check_nonexistent_profile
-        uses: GuillaumeFalourd/assert-command-line-output@v2
+        uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
         with:
           command_line: nextflow config -profile GLaDOS -o flat .
           contains: "Unknown configuration profile: 'GLaDOS'"
           expected_result: PASSED
       - name: Check that offline prevents inclusion of nf-core configs
         id: check_offline_mode
-        uses: GuillaumeFalourd/assert-command-line-output@v2
+        uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
         env:
           NXF_OFFLINE: true
         with:

.github/workflows/update-textual-snapshots.yml

@@ -33,7 +33,7 @@ jobs:
 
       # Install dependencies and run pytest
       - name: Set up Python
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           cache: "pip"

nf_core/pipeline-template/.github/actions/nf-test/action.yml

@@ -25,9 +25,9 @@ runs:
         version: "{% raw %}${{ env.NXF_VERSION }}"
 
     - name: Set up Python
-      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       with:
-        python-version: "3.11"
+        python-version: "3.13"
 
     - name: Install nf-test
       uses: nf-core/setup-nf-test@v1

nf_core/pipeline-template/.github/workflows/download_pipeline.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Disk space cleanup
         uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
 
-      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           architecture: "x64"

nf_core/pipeline-template/.github/workflows/fix-linting.yml

@@ -32,7 +32,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.nf_core_bot_auth_token }}
 
       # Install and run pre-commit
-      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 

nf_core/pipeline-template/.github/workflows/linting.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
 
@@ -33,7 +33,7 @@ jobs:
       - name: Install Nextflow
         uses: nf-core/setup-nextflow@v2
 
-      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           architecture: "x64"