Update actions, pin SHA, group dependabot

Author: AnHeuermann

.github/dependabot.yml

@@ -6,3 +6,7 @@ updates:
     directory: /
     schedule:
       interval: quarterly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/build-fmus.yml

@@ -33,15 +33,15 @@ jobs:
             arch: aarch64
     runs-on: ${{ matrix.image }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Configure CMake
       run: cmake -B build/cmake -DFMI_ARCHITECTURE=${{ matrix.arch }} reference-FMUs
 
     - name: Build
       run: cmake --build build/cmake --config Release
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ matrix.name }}
         path: build/cmake/fmus
@@ -51,37 +51,37 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: aarch64-windows
         path: dist-aarch64-windows
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: x86_64-windows
         path: dist-x86_64-windows
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: x86_64-linux
         path: dist-x86_64-linux
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: aarch64-linux
         path: dist-aarch64-linux
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: x86_64-darwin
         path: dist-x86_64-darwin
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: aarch64-darwin
         path: dist-aarch64-darwin
 
     - name: Merge platform FMUs
       run: python3 .ci/reference-FMUs/merge_fmus.py
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: FMI-LS-DAE-FMUs
         path: dist-merged/*.fmu
@@ -97,13 +97,13 @@ jobs:
     runs-on: ${{ matrix.image }}
     needs: [merge-fmus]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: '3.x'
 
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: FMI-LS-DAE-FMUs
         path: fmus

.github/workflows/build-ls-dae.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: recursive
 
@@ -32,7 +32,7 @@ jobs:
         mkdir -p build/schema
 
     - name: Build HTML
-      uses: avattathil/asciidoctor-action@v2
+      uses: avattathil/asciidoctor-action@755dc03a42aee715c3705fc31d2ca106b7ee90fd # v2
       with:
         program: "asciidoctor --destination-dir=build --attribute=revnumber=${{ env.REVNUMBER }} --attribute=revdate=$(date +%F) --failure-level=WARN --backend=html5 --verbose docs/index.adoc"
 
@@ -59,7 +59,7 @@ jobs:
         cp -r docs/theme/ build/theme
 
     - name: Archive layered standard DAE
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: FMI-LS-DAE
         path: build/*
@@ -72,7 +72,7 @@ jobs:
 
     - name: Deploy
       if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: build

.github/workflows/pre-commit.yml

@@ -10,8 +10,8 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v6
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: '3.x'
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/validate-xml.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install xmllint
         run: sudo apt-get install -y --no-install-recommends libxml2-utils