Update and harden actions

.github/workflows/linting.yml

@@ -8,6 +8,8 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions: {}
+
 env:
   DEFAULT_PYTHON: "3.14"
 
@@ -16,12 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Poetry
         run: pipx install poetry
       - name: Set up Python
         id: python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache: "poetry"

.github/workflows/release.yml

@@ -6,6 +6,8 @@ on:
     types:
       - published
 
+permissions: {}
+
 env:
   DEFAULT_PYTHON: "3.14"
 
@@ -14,27 +16,31 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Poetry
         run: pipx install poetry
       - name: Set up Python
         id: python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache: "poetry"
       - name: Install dependencies
         run: poetry install --no-interaction
       - name: Set package version
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
         run: |
-          version="${{ github.event.release.tag_name }}"
+          version="${TAG_NAME}"
           version="${version,,}"
           version="${version#v}"
           poetry version --no-interaction "${version}"
       - name: Build package
         run: poetry build --no-interaction
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: python-package-distributions
           path: dist/
@@ -50,14 +56,14 @@ jobs:
       contents: write
     steps:
       - name: Download the distribution packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: python-package-distributions
           path: dist/
       - name: Publish to PyPi
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
       - name: Sign published artifacts
-        uses: sigstore/gh-action-sigstore-python@v3.0.0
+        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
         with:
           inputs: ./dist/*.tar.gz ./dist/*.whl
           release-signing-artifacts: true

.github/workflows/testing.yml

@@ -8,6 +8,8 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions: {}
+
 env:
   DEFAULT_PYTHON: "3.14"
 
@@ -16,15 +18,17 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python: ["3.12", "3.13", "3.14"]
+        python: [ "3.12", "3.13", "3.14" ]
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Poetry
         run: pipx install poetry
       - name: Set up Python ${{ matrix.python }}
         id: python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python }}
           cache: "poetry"

.github/workflows/typing.yml

@@ -8,6 +8,8 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions: {}
+
 env:
   DEFAULT_PYTHON: "3.14"
 
@@ -16,12 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Poetry
         run: pipx install poetry
       - name: Set up Python
         id: python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache: "poetry"