chore: update GitHub Actions to latest versions

[mshriver]

Summary by Sourcery

Update GitHub workflow actions to their latest stable versions for linting, testing, and publishing pipelines.

CI:

• Bump actions/checkout to v7 and actions/setup-python to v6 across lint, test, and publish workflows.
• Update Ruff GitHub Action to v4.1.0 in lint workflow.
• Upgrade PyPI publish action to v1.14.0 and GitHub release action to v3 in the publishing workflow.
• Increase Codecov upload action to v7 in tests workflow.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates the versions of GitHub Actions used in the lint, test, and publish workflows to their latest major/minor releases while keeping the overall workflow structure and behavior the same.

File-Level Changes

Change	Details	Files
Update core GitHub Actions versions for checkout and Python setup across all workflows.	Bump actions/checkout from v4 to v7 in lint, tests, and python-publish workflows. Bump actions/setup-python from v5 to v6 in lint, tests, and python-publish workflows.	.github/workflows/lint.yml .github/workflows/tests.yml .github/workflows/python-publish.yml
Update linting-related actions to newer versions in the lint workflow.	Bump astral-sh/ruff-action from v3 to v4.1.0 for both Ruff check and format steps.	.github/workflows/lint.yml
Update publishing-related actions to newer versions in the release workflow.	Bump pypa/gh-action-pypi-publish from v1.13.0 to v1.14.0. Bump softprops/action-gh-release from v2 to v3.	.github/workflows/python-publish.yml
Update Codecov upload action to a newer major version in the test workflow.	Bump codecov/codecov-action from v5 to v7 for coverage uploads on Python 3.12 matrix runs.	.github/workflows/tests.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.57%. Comparing base (307add9) to head (bb7aec7).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #52   +/-   ##
=======================================
  Coverage   84.57%   84.57%           
=======================================
  Files          58       58           
  Lines        4783     4783           
  Branches      496      496           
=======================================
  Hits         4045     4045           
  Misses        496      496           
  Partials      242      242           

Flag	Coverage Δ
unittests	84.57% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 307add9...bb7aec7. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/lint.yml" line_range="13-14" />
<code_context>
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v7
+    - uses: actions/setup-python@v6
       with:
         python-version: "3.12"
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Consider pinning Actions to a specific commit SHA for stronger supply-chain security.

Using floating tags (e.g., `@v7`, `@v6`) means upstream changes can silently alter your CI behavior over time, impacting reproducibility and supply-chain security. Pinning each Action to a specific commit SHA (and optionally noting the human-readable version in a comment) keeps builds deterministic and easier to audit.

Suggested implementation:

```
    steps:
    - uses: actions/checkout@<COMMIT_SHA_CHECKOUT> # actions/checkout@v7
    - uses: actions/setup-python@<COMMIT_SHA_SETUP_PYTHON> # actions/setup-python@v6
      with:
        python-version: "3.12"

```

```
    steps:
    - uses: actions/checkout@<COMMIT_SHA_CHECKOUT> # actions/checkout@v7
    - name: Install and run Ruff
      uses: astral-sh/ruff-action@<COMMIT_SHA_RUFF_ACTION> # astral-sh/ruff-action@v4.1.0
      with:

```

Replace `<COMMIT_SHA_CHECKOUT>`, `<COMMIT_SHA_SETUP_PYTHON>`, and `<COMMIT_SHA_RUFF_ACTION>` with the exact commit SHAs corresponding to the versions you intend to use (e.g., the commits pointed to by the `v7`, `v6`, and `v4.1.0` tags at the time you pin them).  
If there are other jobs in this workflow (or other workflows) using GitHub Actions with floating tags, apply the same pattern there to keep your CI fully reproducible.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}