Pin all workflow actions to commit SHA1 hashes

[Copilot]

Replace mutable version tags with immutable commit SHA1 pins across all GitHub Actions workflows, mitigating supply chain attacks where a tag could be silently redirected to malicious code. Version tags are preserved as inline comments for readability.

Changes by file

• .github/workflows/test-package.yml — pinned actions/checkout, actions/setup-python, codecov/codecov-action
• .github/workflows/pre-commit-autoupdate.yml — pinned actions/checkout, actions/setup-python, browniebroke/pre-commit-autoupdate-action, peter-evans/create-pull-request
• .github/workflows/create-release.yml — pinned actions/checkout, actions/setup-python, ffurrer2/extract-release-notes, ncipollo/release-action, pypa/gh-action-pypi-publish
• .github/workflows/scorecard.yml — pinned actions/checkout, ossf/scorecard-action, github/codeql-action/upload-sarif

Example of the pin format used:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

Note: browniebroke/pre-commit-autoupdate-action has no floating v1 tag in its repo — the SHA maps to v1.0.1, the latest v1.x release.

Related issue
?

Checklist before requesting a review

• I have performed a self-review of my code.
• I have added tests for the proposed changes.
• I have run the tests and there are not errors.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/ncipollo/release-action/git/refs/tags/v1
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.65%. Comparing base (8d8743d) to head (6467ef2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #558   +/-   ##
=======================================
  Coverage   97.65%   97.65%           
=======================================
  Files          63       63           
  Lines        2298     2298           
=======================================
  Hits         2244     2244           
  Misses         54       54           

Flag	Coverage Δ
unittests	97.65% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions supply chain by replacing mutable action version tags with immutable commit SHA pins (while retaining the original versions as inline comments) across the existing workflows.

Changes:

• Pinned commonly used marketplace actions (checkout/setup-python/codecov/etc.) to full commit SHA1s in all workflows under .github/workflows/.
• Preserved prior version tags as inline comments for readability/auditability.
• Updated release, scorecard, test, and pre-commit auto-update workflows consistently.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/test-package.yml	Pin action references for checkout/setup-python/codecov in the test workflow.
.github/workflows/pre-commit-autoupdate.yml	Pin action references for checkout/setup-python/pre-commit autoupdate/create-pull-request.
.github/workflows/create-release.yml	Pin action references used for release creation and PyPI publishing.
.github/workflows/scorecard.yml	Pin action references for checkout/scorecard/upload-sarif.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.