chore(deps) Pin dependencies

.github/workflows/ci.yml

@@ -70,10 +70,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -128,8 +128,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -149,7 +149,7 @@ jobs:
         # Only one leg uploads the artifact to avoid duplicates.
         if: always() && matrix.python-version == '3.13'
         # v4+: v3 was retired 2025-01-30 and now fails outright.
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         # Never fail the build on this. The coverage GATE is enforced inside
         # the test step by pytest-cov's --cov-fail-under, so by the time we
         # get here the number has already passed or failed; this upload only
@@ -168,10 +168,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -196,10 +196,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -274,10 +274,10 @@ jobs:
     timeout-minutes: 15
     needs: test
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -372,7 +372,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # gitleaks needs full history to scan past commits, not just HEAD.
           fetch-depth: 0
@@ -405,7 +405,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: TruffleHog (verified/unknown findings only)
@@ -422,7 +422,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install codespell
         # Into a venv: the runner image's system Python is externally
         # managed (PEP 668) and rejects a bare `pip install`.
@@ -451,10 +451,10 @@ jobs:
     timeout-minutes: 10
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -481,7 +481,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: markdownlint
         # Pinned to the same version .pre-commit-config.yaml uses, so
         # local and CI agree. Newer versions add rules (e.g. MD060) that
@@ -495,7 +495,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install lychee
         run: |
           case "$(uname -m)" in
@@ -516,7 +516,7 @@ jobs:
     timeout-minutes: 10
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install lychee
         run: |
           case "$(uname -m)" in
@@ -535,10 +535,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -586,10 +586,10 @@ jobs:
     timeout-minutes: 15
     needs: test  # don't bother if unit tests are broken
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.
@@ -621,14 +621,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # No token in the environment: this job runs no privileged step and
           # a checkout that leaves credentials behind is a needless one.
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           # Caches the pip download/wheel cache keyed on pyproject.toml. The
           # runtime has zero dependencies, but the dev extra pulls ruff, mypy,
           # pytest and their graph, and 19 jobs were each fetching it fresh.

.github/workflows/codeql.yml

@@ -63,7 +63,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/dependency-review.yml

@@ -40,7 +40,7 @@ jobs:
       # burying the result in the job log.
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - # @v5, not @v4: this action publishes no `v4` floating major tag,
         # only v4.x.y specifics and v5.0.0, so `@v4` fails to resolve.
         uses: actions/dependency-review-action@v5

.github/workflows/release.yml

@@ -65,7 +65,7 @@ jobs:
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: "3.13"
+          python-version: "3.14.6"
           cache: pip
           cache-dependency-path: pyproject.toml