From 8d0407f2587a1f7da591ef02d7de9f4fa8547102 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 21:40:27 +0000
Subject: [PATCH] Update GitHub Actions

---
 .github/workflows/codspeed.yml                               | 2 +-
 .github/workflows/deploy-pypi.yml                            | 2 +-
 .github/workflows/nextflow-source-test.yml                   | 2 +-
 nf_core/pipeline-template/.github/actions/nf-test/action.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index 0667bcd659..637e51f588 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -60,7 +60,7 @@ jobs:
       # import/start-up cost, which CodSpeed's instruction-counting
       # "simulation" instrument can't see. Use "walltime" mode instead.
       - name: Run start-up benchmarks
-        uses: CodSpeedHQ/action@88472375d0a4572cf70a9f1fe3a4e0ab8da1b924 # v5.0.1
+        uses: CodSpeedHQ/action@0ca9cbbf4623b599a6c3ed4fc8a922942705d9f1 # v5.0.2
         with:
           mode: walltime
           run: uv run pytest benchmarks/test_startup_benchmarks.py --codspeed
diff --git a/.github/workflows/deploy-pypi.yml b/.github/workflows/deploy-pypi.yml
index 8786b5a084..573802ca01 100644
--- a/.github/workflows/deploy-pypi.yml
+++ b/.github/workflows/deploy-pypi.yml
@@ -34,6 +34,6 @@ jobs:
 
       - name: Publish dist to PyPI
         if: github.repository == 'nf-core/tools'
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
         with:
           password: ${{ secrets.pypi_password }}
diff --git a/.github/workflows/nextflow-source-test.yml b/.github/workflows/nextflow-source-test.yml
index 649fdc42dc..bd9beae3bb 100644
--- a/.github/workflows/nextflow-source-test.yml
+++ b/.github/workflows/nextflow-source-test.yml
@@ -20,7 +20,7 @@ jobs:
           path: nextflow
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: "temurin"
           architecture: x64
diff --git a/nf_core/pipeline-template/.github/actions/nf-test/action.yml b/nf_core/pipeline-template/.github/actions/nf-test/action.yml
index ec38048a6e..960418271f 100644
--- a/nf_core/pipeline-template/.github/actions/nf-test/action.yml
+++ b/nf_core/pipeline-template/.github/actions/nf-test/action.yml
@@ -37,7 +37,7 @@ runs:
 
     - name: Setup apptainer
       if: contains(inputs.profile, 'singularity')
-      uses: eWaterCycle/setup-apptainer@3f706d898c9db585b1d741b4692e66755f3a1b40 # v2.0.0
+      uses: eWaterCycle/setup-apptainer@4bb22c52d4f63406c49e94c804632975787312b3 # v2.0.0
 
     - name: Set up Singularity
       if: contains(inputs.profile, 'singularity')