ci: pin action comments to exact releases

.github/workflows/cut-release-branch.yml

@@ -47,7 +47,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: true
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
       - name: Install dependencies

.github/workflows/docs-publish.yml

@@ -72,13 +72,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -152,15 +152,15 @@ jobs:
 
       - name: Upload quality report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docstring-quality-report
           path: /tmp/quality_report.json
           retention-days: 30
 
       - name: Upload built site artifact
         if: success()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docs-site
           path: docs/build/
@@ -207,7 +207,7 @@ jobs:
 
     steps:
       - name: Download site artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: docs-site
           path: docs-site/

.github/workflows/notebooks.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Free disk space
         uses: ./.github/actions/free-disk-space
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: "3.12"
           enable-cache: true

.github/workflows/publish-dev-from-main.yml

@@ -55,7 +55,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
       - name: Install dependencies

.github/workflows/publish-release.yml

@@ -75,7 +75,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
       - name: Install dependencies
@@ -123,7 +123,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
       - name: Install dependencies
@@ -176,11 +176,11 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0
       - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: 'npm'

.github/workflows/pypi.yml

@@ -50,7 +50,7 @@ jobs:
           echo "skip=false" >> "$GITHUB_OUTPUT"
       - name: Install uv and set the python version
         if: steps.gate.outputs.skip != 'true'
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: false

.github/workflows/quality.yml

@@ -57,7 +57,7 @@ jobs:
       - name: Free disk space
         uses: ./.github/actions/free-disk-space
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true

.pre-commit-config.yaml

@@ -19,6 +19,16 @@ repos:
         types_or: [python, shell, ts, tsx, javascript, css]
         exclude: ^docs/
 
+  - repo: local
+    hooks:
+      # A SHA-pinned action's comment must name the exact release (`# v7.0.1`). A moving
+      # tag like `# v7` trips zizmor's ref-version-mismatch on every PR once upstream re-tags it.
+      - id: action-pin-full-version
+        name: Action pin comments name an exact release
+        entry: '@[0-9a-f]{40} +# v[0-9]+(\.[0-9]+)?\s*$'
+        language: pygrep
+        files: ^\.github/.*\.ya?ml$
+
   - repo: local
     hooks:
       # Moving ruff hooks to the local version allows for different behavior locally and in ci/cd pipelines.

AGENTS.md

@@ -137,6 +137,7 @@ Use the tool's common name (e.g., GitHub Copilot, Cursor, etc.).
 | Telemetry import errors | Run `uv sync` to install OpenTelemetry deps |
 | Silent empty strings from async backends | Check for `asyncio.gather(..., return_exceptions=True)` — exceptions become values silently; use `return_exceptions=False` unless callers explicitly handle `BaseException` values |
 | GitHub Actions workflow injection warning | Never use `${{ expression }}` directly inside `run:` shell commands — always route through `env:` (`env: MY_VAR: ${{ expr }}` then `"$MY_VAR"` in the script). This rule applies only to `run:` steps; `${{ }}` in `if:` conditions and `with:` action inputs is fine. |
+| zizmor `ref-version-mismatch` on a workflow your PR didn't touch | A SHA pin's comment names a moving tag (`# v7`) that upstream has re-pointed. Comment with the exact release the SHA is tagged as (`@<sha> # v7.0.1`); the `action-pin-full-version` pre-commit hook enforces this. |
 
 ## 10. Self-Review (before notifying user)
 1. `uv run pytest test/ -m "not qualitative"` passes?