use commit hash in actions and add dependabot updates

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      ci-dependencies:
+        patterns: ["*"]

.github/workflows/build-docs.yaml

@@ -15,14 +15,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Clone docs repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
           repository: Nixtla/docs
           ref: scripts
           path: docs-scripts
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # ratchet:actions/setup-python@v4
         with:
           cache: "pip"
           python-version: '3.10'
@@ -46,7 +46,7 @@ jobs:
           cp docs-scripts/imgs/* _docs/
       - name: Deploy to Mintlify Docs
         if: github.event_name == 'push'
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # ratchet:peaceiris/actions-gh-pages@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_branch: docs
@@ -55,7 +55,7 @@ jobs:
           user_email: 41898282+github-actions[bot]@users.noreply.github.com
       - name: Trigger mintlify workflow
         if: github.event_name == 'push'
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # ratchet:actions/github-script@v7
         with:
           github-token: ${{ secrets.DOCS_WORKFLOW_TOKEN }}
           script: |
@@ -69,7 +69,7 @@ jobs:
         run: python docs-scripts/configure-redirects.py statsforecast
       - name: Deploy to Github Pages
         if: github.event_name == 'push'
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # ratchet:peaceiris/actions-gh-pages@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_branch: gh-pages

.github/workflows/ci.yaml

@@ -22,10 +22,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # ratchet:actions/checkout@v2
 
       - name: Set up python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # ratchet:actions/setup-python@v4
         with:
           python-version: '3.10'
 
@@ -50,10 +50,10 @@ jobs:
         python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
     steps:
       - name: Clone repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
 
       - name: Set up environment
-        uses: mamba-org/setup-micromamba@v1
+        uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822 # ratchet:mamba-org/setup-micromamba@v1
         with:
           environment-file: dev/local_environment.yml
           create-args: python=${{ matrix.python-version }}
@@ -75,10 +75,10 @@ jobs:
         python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
     steps:
       - name: Clone repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
 
       - name: Set up environment
-        uses: mamba-org/setup-micromamba@v1
+        uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822 # ratchet:mamba-org/setup-micromamba@v1
         with:
           environment-file: dev/environment.yml
           create-args: python=${{ matrix.python-version }}
@@ -87,7 +87,7 @@ jobs:
       - name: Install pip requirements
         run: pip install ./
 
-      - name: Run tests 
+      - name: Run tests
         run: nbdev_test --skip_file_re '(distributed).*.ipynb' --pause 1.0 --do_print --timing
 
       - name: Run integration tests
@@ -101,10 +101,10 @@ jobs:
       fail-fast: false
     steps:
       - name: Clone repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
 
       - name: Set up environment
-        uses: mamba-org/setup-micromamba@v1
+        uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822 # ratchet:mamba-org/setup-micromamba@v1
         with:
           environment-file: dev/environment.yml
           create-args: python=3.10

.github/workflows/lint.yaml

@@ -11,15 +11,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
 
       - name: Set up python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # ratchet:actions/setup-python@v4
         with:
           python-version: '3.10'
 
       - name: Install linters
         run: pip install black nbdev pre-commit
 
       - name: Run pre-commit
-        run: pre-commit run --files statsforecast/*
+        run: pre-commit run --files statsforecast/*

.github/workflows/no-response.yaml

@@ -10,12 +10,12 @@ jobs:
   noResponse:
     runs-on: ubuntu-latest
     steps:
-      - uses: lee-dohm/no-response@v0.5.0
+      - uses: lee-dohm/no-response@9bb0a4b5e6a45046f00353d5de7d90fb8bd773bb # ratchet:lee-dohm/no-response@v0.5.0
         with:
           closeComment: >
-              This issue has been automatically closed because it has been awaiting a response for too long.
-              When you have time to to work with the maintainers to resolve this issue, please post a new comment and it will be re-opened.
-              If the issue has been locked for editing by the time you return to it, please open a new issue and reference this one.
+            This issue has been automatically closed because it has been awaiting a response for too long.
+            When you have time to to work with the maintainers to resolve this issue, please post a new comment and it will be re-opened.
+            If the issue has been locked for editing by the time you return to it, please open a new issue and reference this one.
           daysUntilClose: 30
           responseRequiredLabel: awaiting response
           token: ${{ github.token }}

.github/workflows/python-publish.yml

@@ -12,14 +12,14 @@ jobs:
       id-token: write
 
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python
-      uses: actions/setup-python@v3
-      with:
-        python-version: '3.10'
-    - name: Install dependencies
-      run: python -m pip install build wheel
-    - name: Build package
-      run: python -m build -sw
-    - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - name: Set up Python
+        uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # ratchet:actions/setup-python@v3
+        with:
+          python-version: '3.10'
+      - name: Install dependencies
+        run: python -m pip install build wheel
+      - name: Build package
+        run: python -m build -sw
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # ratchet:pypa/gh-action-pypi-publish@release/v1

.github/workflows/release-drafter.yml

@@ -15,6 +15,6 @@ jobs:
       pull-requests: read
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v5
+      - uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # ratchet:release-drafter/release-drafter@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}