docs: update to pinned versions + use latest

.github/workflows/pinact.yaml

@@ -0,0 +1,37 @@
+name: Update documented actions
+
+on:
+  schedule:
+    - cron: "0 9 * * 1"
+      timezone: America/Los_Angeles
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  pinact:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
+        with:
+          config: .pinact.yaml
+          github_token: ${{ github.token }}
+          skip_push: "true"
+          update: "true"
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ github.token }}
+          add-paths: docs/aws.md
+          branch: automation/pinact-docs
+          delete-branch: true
+          commit-message: "docs: update pinned actions"
+          title: "docs: update pinned actions"
+          body: Automated action updates generated by pinact.

.pinact.yaml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+# pinact - https://github.com/suzuki-shunsuke/pinact
+version: 3
+files:
+  - pattern: docs/aws.md

docs/aws.md

@@ -90,6 +90,10 @@ name: Test Self-Hosted Runner
 on:
   workflow_dispatch:
 
+env:
+  AWS_ROLE_ARN: <your-IAM-Role-ARN>
+  AWS_REGION: <your-region-here, for example us-east-1>
+
 jobs:
   start-aws-runner:
     runs-on: ubuntu-latest
@@ -101,15 +105,16 @@ jobs:
       instances: ${{ steps.aws-start.outputs.instances }}
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
-          role-to-assume: <your-IAM-Role-ARN>
-          aws-region: <your-region-here, for example us-east-1>
+          role-to-assume: ${{ env.AWS_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
       - name: Create cloud runner
         id: aws-start
-        uses: omsf/start-aws-gha-runner@v1.3.0
+        uses: omsf/start-aws-gha-runner@a68aee57f031da4b6a0063d901e02f0b17d95f94 # v1.3.0
         with:
-          aws_image_id: <your-ami-here, for example ami-0d5079d9be06933e5>
+          aws_image_name: <The name of your AMI you want to use>
+          aws_image_id: latest
           aws_instance_type: <your instance type here, for example g4dn.xlarge>
           aws_home_dir: /home/ubuntu
         env:
@@ -119,7 +124,7 @@ jobs:
     needs:
       - start-aws-runner
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Print disk usage
         run: "df -h"
       - name: Print Docker details
@@ -135,12 +140,12 @@ jobs:
     if: ${{ always() }}
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
-          role-to-assume: <your-IAM-Role-ARN>
-          aws-region: <your-region-here, for example us-east-1>
+          role-to-assume: ${{ env.AWS_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
       - name: Stop instances
-        uses: omsf/stop-aws-gha-runner@v1.0.0
+        uses: omsf/stop-aws-gha-runner@a3d2e34cba8571eaf9b40ae00705d6b2b77402f6 # v1.0.0
         with:
           instance_mapping: ${{ needs.start-aws-runner.outputs.mapping }}
         env: