Pin action to SHAs and add a defensive persist-credentials in workflows

Author: willingc

.github/workflows/lint.yml

@@ -18,15 +18,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Run pre-commit hooks
-        uses: j178/prek-action@v2.0.4
+        uses: j178/prek-action@e98a699c41eb69ab013a45817a0406469a748f8d # v2.0.5
 
       - name: Check spelling
-        uses: j178/prek-action@v2.0.4
+        uses: j178/prek-action@e98a699c41eb69ab013a45817a0406469a748f8d #v2.0.5
         continue-on-error: true
         with:
           extra_args: --all-files --hook-stage manual codespell

.github/workflows/render.yml

@@ -27,12 +27,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
         with:
           fetch-depth: 0  # fetch all history so that last modified date-times are accurate
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -51,7 +52,7 @@ jobs:
       - name: Deploy to GitHub pages
         # This allows CI to build branches for testing
         if: (github.ref == 'refs/heads/main') && (matrix.python-version == '3.x')
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f #v4.8.0
         with:
           folder: build # Synchronise with Makefile -> BUILDDIR
           single-commit: true # Delete existing files

.github/workflows/test.yml

@@ -42,18 +42,18 @@ jobs:
         - "ubuntu-latest"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
 
       - name: Install uv
-        uses: hynek/setup-cached-uv@v2
+        uses: hynek/setup-cached-uv@4300ec2180bc77d705e626a34e381b81a4772c51 # v2.5.0
         with:
           cache-dependency-path: |
             requirements.txt
@@ -63,7 +63,7 @@ jobs:
           uvx --with tox-uv tox -e py -- -v --cov-report term
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: ${{ matrix.os }}
           name: ${{ matrix.os }} Python ${{ matrix.python-version }}