DX: upgrade pre-commit hooks and lock files (#507)

* DX: ignore local agent configuration
* DX: pin reusable workflows by commit hash
* FIX: match K-matrix residue symbols on str(s)
* MAINT: consolidate qrules imports in helicity.decay
* MAINT: migrate noqa codes to Ruff rule names
* MAINT: simplify coefficient multiplicity test
* MAINT: standardize `# ty: ignore` comments

Author: dependabot[bot]

.github/workflows/benchmark.yml

@@ -18,18 +18,18 @@ jobs:
     name: Performance regression
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Run pytest-benchmark
         run: uvx --from poethepoet poe benchmark
       - name: Warn on performance decrease
         if: github.event_name == 'pull_request'
-        uses: benchmark-action/github-action-benchmark@v1
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
         with:
           benchmark-data-dir-path: ""
           comment-on-alert: true
@@ -41,7 +41,7 @@ jobs:
           tool: pytest
       - name: Create local benchmark data repository
         if: github.event_name != 'pull_request'
-        uses: benchmark-action/github-action-benchmark@v1
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
         with:
           benchmark-data-dir-path: ""
           gh-repository: github.com/ComPWA/ampform-benchmark-results

.github/workflows/cd.yml

@@ -9,9 +9,9 @@ on:
 jobs:
   milestone:
     if: startsWith(github.ref, 'refs/tags')
-    uses: ComPWA/actions/.github/workflows/close-milestone.yml@v4
+    uses: ComPWA/actions/.github/workflows/close-milestone.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
   package-name:
-    uses: ComPWA/actions/.github/workflows/get-pypi-name.yml@v4
+    uses: ComPWA/actions/.github/workflows/get-pypi-name.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
   pypi:
     environment:
       name: PyPI
@@ -24,9 +24,9 @@ jobs:
       id-token: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: ComPWA/actions/build-pypi-distribution@v4
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: ComPWA/actions/build-pypi-distribution@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
   push:
     if: startsWith(github.ref, 'refs/tags') && !github.event.release.prerelease
     secrets: inherit
-    uses: ComPWA/actions/.github/workflows/push-to-version-branches.yml@v4
+    uses: ComPWA/actions/.github/workflows/push-to-version-branches.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2

.github/workflows/ci-qrules-v0.9.yml

@@ -22,13 +22,13 @@ jobs:
     name: Run unit tests
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Run pytest with QRules v0.9
         run: |
           uv run \

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ on:
 
 jobs:
   doc:
-    uses: ComPWA/actions/.github/workflows/ci-docs.yml@v4.0
+    uses: ComPWA/actions/.github/workflows/ci-docs.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
     permissions:
       pages: write
       id-token: write
@@ -29,9 +29,9 @@ jobs:
   style:
     secrets:
       token: ${{ secrets.PAT }}
-    uses: ComPWA/actions/.github/workflows/style.yml@v4.0
+    uses: ComPWA/actions/.github/workflows/style.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
   test:
-    uses: ComPWA/actions/.github/workflows/test.yml@v4.0
+    uses: ComPWA/actions/.github/workflows/test.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     with:

.github/workflows/clean-caches.yml

@@ -16,7 +16,7 @@ jobs:
     name: Remove caches
     runs-on: ubuntu-slim
     steps:
-      - uses: ComPWA/actions/clean-caches@v4
+      - uses: ComPWA/actions/clean-caches@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ inputs.ref }}

.github/workflows/lock.yml

@@ -17,6 +17,6 @@ on:
 
 jobs:
   lock:
-    uses: ComPWA/actions/.github/workflows/lock.yml@v4
+    uses: ComPWA/actions/.github/workflows/lock.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2
     secrets:
       token: ${{ secrets.PAT }}

.github/workflows/pr-linting.yml

@@ -11,4 +11,4 @@ on:
 
 jobs:
   lint-pr:
-    uses: ComPWA/actions/.github/workflows/pr-linting.yml@v4
+    uses: ComPWA/actions/.github/workflows/pr-linting.yml@13f1a3b0c831615fb49c008bcc48113da8a76477 # 4.0.2

.github/workflows/redirect-gh-pages.yml

@@ -26,7 +26,7 @@ jobs:
           </body>
           </html>' > build/index.html
       - id: deployment
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: build/
 
@@ -41,4 +41,4 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release-drafter.yml

@@ -11,6 +11,6 @@ jobs:
   update_release_draft:
     runs-on: ubuntu-slim
     steps:
-      - uses: release-drafter/release-drafter@v7
+      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -37,8 +37,13 @@ prof/
 pyvenv*/
 
 # Settings
+/.agents/
+/.claude/
+/.codex/
 .idea/
 **.code-workspace
+AGENTS.md
+CLAUDE.md
 
 # Exceptions
 !.cspell.json