dependencies: (deps): bump & HARDEN the actions group across 2 directories with 5 updates (pyOpenSci#128)

dependabot[bot] · lwasser · web-flow · commit 82d79e726a97 · 2025-10-31T16:57:20.000-06:00
* dependencies: (deps): bump the actions group across 2 directories with 5 updates Bumps the actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-python](https://github.com/actions/setup-python). Bumps the actions group with 5 updates in the /template/{% if use_git and dev_platform == 'GitHub' %}.github{% endif %}/workflows directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `5` | | [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` | | [pypa/hatch](https://github.com/pypa/hatch) | `a3c83ab3d481fbc2dc91dd0088628817488dd1d5` | `257e27e51a6a5616ed08a39a408a21c35c9931bc` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `5` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `6` | Updates `actions/checkout` from 4 to 5 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) Updates `actions/setup-python` from 5 to 6 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) Updates `actions/checkout` from 4 to 5 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) Updates `actions/setup-python` from 5 to 6 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) Updates `pypa/hatch` from a3c83ab3d481fbc2dc91dd0088628817488dd1d5 to 257e27e51a6a5616ed08a39a408a21c35c9931bc - [Release notes](https://github.com/pypa/hatch/releases) - [Commits](pypa/hatch@a3c83ab...257e27e) Updates `actions/upload-artifact` from 4 to 5 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v5) Updates `actions/download-artifact` from 4 to 6 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: pypa/hatch dependency-version: 257e27e51a6a5616ed08a39a408a21c35c9931bc dependency-type: direct:production dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> * Apply suggestion from @lwasser * Apply suggestion from @lwasser * Apply suggestion from @lwasser * Apply suggestion from @lwasser * Apply suggestion from @lwasser * Apply suggestion from @lwasser * Fix checkout and setup-python action references --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Leah Wasser <leah@pyopensci.org>
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -18,10 +18,10 @@ jobs:
         python-version: ["3.10", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v5
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/template/{% if use_git and dev_platform == 'GitHub' %}.github{% endif %}/workflows/release.yml b/template/{% if use_git and dev_platform == 'GitHub' %}.github{% endif %}/workflows/release.yml
@@ -15,22 +15,22 @@ jobs:
     # Environment is encouraged for increased security
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           # This fetch element is only important if you are use SCM based
           # versioning (that looks at git tags to gather the version).
           # setuptools-scm needs tags to form a valid version number
           fetch-tags: true
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v5
         with:
           # You can modify what version of Python you want to use for your release
           python-version: "3.11"
 
       # Security recommends we should pin deps. Should we pin the workflow version?
       - name: Install hatch
-        uses: pypa/hatch@a3c83ab3d481fbc2dc91dd0088628817488dd1d5
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
 
       - name: Build package using Hatch
         run: |
@@ -41,7 +41,7 @@ jobs:
 
       # Store an artifact of the build to use in the publish step below
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4
         with:
           name: python-package-distributions
           path: dist/
@@ -63,7 +63,7 @@ jobs:
       id-token: write  # this permission is mandatory for PyPI publishing
     steps:
       - name: Download dists
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v4
         with:
           name: python-package-distributions
           path: dist/
