ci: pin Python release actions

Merged
FE
3mo ago
+10-4

Summary

  • pin every external action in the PyPI publish workflow to a full commit SHA
  • retain version comments so Dependabot can update both the SHA and documented release
  • enable weekly Dependabot updates for GitHub Actions
  • leave PyPI Trusted Publishing, version validation, and stable GitHub Release behavior unchanged

Validation

  • actionlint .github/workflows/publish.yml
  • Python 3.11: source compilation and 85 unit tests
  • wheel and sdist build
  • twine check for both distributions

Summary by cubic

Pinned all external actions in the PyPI publish workflow to commit SHAs and enabled weekly Dependabot updates to improve CI supply-chain security. No changes to Trusted Publishing, version checks, or release behavior.

  • Dependencies
    • Pinned actions/checkout, actions/setup-python, actions/upload-artifact, and actions/download-artifact with version comments for Dependabot.
    • Added .github/dependabot.yml to update github-actions weekly.