chore: pin GitHub Actions to commit SHAs

[slawomirbabicz]

Pin GitHub Actions to commit SHAs

GitHub Actions referenced by tag (e.g. actions/checkout@v4) use a mutable pointer — the tag owner can move it to a different commit at any time, including a malicious one. This is the attack vector used in the tj-actions/changed-files incident (CVE-2025-30066).

Pinning to a full 40-character commit SHA makes the reference immutable. The # tag comment preserves human readability so reviewers can tell which version is pinned.

Important: a SHA can also originate from a forked repository. A malicious actor can fork an action, push a compromised commit to the fork, and the SHA will resolve — but it won't exist in the upstream canonical repo. Each SHA in this PR was verified against the action's canonical repository (not a fork).

Changes

• actions/checkout@master -> actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master

  • Version: master | Latest: v6.0.2 | Release age: 88d
  • Commit: actions/checkout@61b9e37

• actions/setup-python@v1 -> actions/setup-python@0f07f7f756721ebd886c2462646a35f78a8bc4de # v1.2.4

  • Version: v1.2.4 | Latest: v6.2.0 | Release age: 76d
  • Commit: actions/setup-python@0f07f7f

• pypa/gh-action-pypi-publish@release/v1 -> pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

  • Version: release/v1 | Latest: v1.14.0 | Release age: 216d
  • Commit: pypa/gh-action-pypi-publish@cef2210
  • Warnings: Latest release v1.14.0 is only 1 day(s) old (< 7 days). Using previous safe release., 1 security advisory(ies) found, Action has 1 known advisory(ies)

• actions/checkout@v2 -> actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0

  • Version: v2.7.0 | Latest: v6.0.2 | Release age: 88d
  • Commit: actions/checkout@ee0669b

• actions/setup-python@v2 -> actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4

  • Version: v2.3.4 | Latest: v6.2.0 | Release age: 76d
  • Commit: actions/setup-python@e9aba2c

Files modified

• .github/workflows/main.yml
• .github/workflows/test.yml

Security warnings

• Latest release v1.14.0 is only 1 day(s) old (< 7 days). Using previous safe release.
• 1 security advisory(ies) found
• Action has 1 known advisory(ies)