@mashehu how would you feel about pinning all actions in the template to SHAs? Our security team have added CI to force us to do that over all repos to prevent uncontrolled changes leading to security issues. I imagine other orgs might be waking up to the same thing. (CC @Rike Hanssen)

motivated by the various supply chain attacks that are recently making the round for example: https://www.paloaltonetworks.com/blog/cloud-security/github-actions-worm-dependencies/ or here https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html

all outside actions outside of nf-core should already be pinned. the other ones are quite nice for quick bug fixes (looking at you awsfulltest.yml....) but should also be mature enough now.

If I use the latest tools release to init a pipeline, I get unpinned versions of: • nf-core/setup-nf-test • nf-core/setup-nextflow • eWaterCycle/setup-apptainer