CI: match uv docs for release workflow, zizmor fixes

.github/workflows/ci.yml

@@ -7,13 +7,17 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4
       - name: Ruff lint
         run: uv run ruff check .
       - name: Ruff format
@@ -29,6 +33,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4
       - run: uv run pytest

.github/workflows/errors.yml

@@ -1,6 +1,8 @@
 # Test the error messages when the trusted publishing configuration is incorrect
 name: Release wrong name
 
+permissions: {}
+
 on:
   workflow_dispatch:
     inputs:
@@ -15,20 +17,21 @@ jobs:
     name: Get binary
     steps:
       - if: ${{ inputs.ref }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: "astral-sh/uv"
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - if: ${{ inputs.ref }}
-        uses: rui314/setup-mold@v1
+        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # staging
       - if: ${{ inputs.ref }}
         name: Setup musl
         run: |
           sudo apt-get install musl-tools
           rustup target add x86_64-unknown-linux-musl
       - if: ${{ inputs.ref }}
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - if: ${{ inputs.ref }}
         name: Build uv
         run: cargo build --target x86_64-unknown-linux-musl
@@ -38,7 +41,7 @@ jobs:
 
       - if: ${{ inputs.ref }}
         name: Upload uv
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: uv
           path: ./target/x86_64-unknown-linux-musl/debug/uv
@@ -49,7 +52,7 @@ jobs:
           tar xf uv-x86_64-unknown-linux-musl.tar.gz
       - if: ${{ !inputs.ref }}
         name: Upload uv
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: uv
           path: ./uv-x86_64-unknown-linux-musl/uv
@@ -65,9 +68,11 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Download uv
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: uv
       - name: Prepare uv
@@ -96,15 +101,17 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Download uv
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: uv
       - name: Prepare uv
         run: chmod +x ./uv
 
-      - uses: astral-sh/setup-uv@v3
+      - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4
       - run: ./uv build
       # Check that basic features work and we didn't miss to include crucial files
       - name: Smoke test (wheel)
@@ -127,9 +134,11 @@ jobs:
       name: release
     # Here the permission section is skipped
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Download uv
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: uv
       - name: Prepare uv
@@ -156,15 +165,17 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Download uv
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: uv
       - name: Prepare uv
         run: chmod +x ./uv
 
-      - uses: astral-sh/setup-uv@v3
+      - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4
       - run: ./uv build
       # Check that basic features work and we didn't miss to include crucial files
       - name: Smoke test (wheel)

.github/workflows/release.yml

@@ -1,35 +1,58 @@
-name: Release
+name: "Publish release to PyPI"
 
 on:
   push:
     tags:
-      # Publish on any tag starting with a `v`, e.g., v1.2.3
+      # Publish on any tag starting with a `v`, e.g., v0.1.0
       - v*
 
 jobs:
-  pypi:
-    name: Publish to PyPI
+  build:
     runs-on: ubuntu-latest
-    # Environment and permissions trusted publishing.
-    environment:
-      # Create this environment in the GitHub repository under Settings -> Environments
-      name: pypi
     permissions:
-      id-token: write
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install Python 3.13
-        run: uv python install 3.13
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: false
+
       - name: Build
         run: uv build
-      # Check that basic features work and we didn't miss to include crucial files
+
+      # Optional, but recommended: run smoke tests on distributions
       - name: Smoke test (wheel)
         run: uv run --isolated --no-project --with dist/*.whl tests/smoke_test.py
       - name: Smoke test (source distribution)
         run: uv run --isolated --no-project --with dist/*.tar.gz tests/smoke_test.py
+
+      - name: Upload distributions as artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: false
+
+      - name: Download distributions artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
       - name: Publish
-        run: uv publish
+        run: uv publish