Merge pull request #607 from numpy/gha-pin-version-tags

Author: jorenham

.github/workflows/docs.yml

@@ -20,14 +20,14 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.2.2
 
     - name: Configure Git Credentials
       run: |
         git config user.name github-actions[bot]
         git config user.email 41898282+github-actions[bot]@users.noreply.github.com
 
-    - uses: astral-sh/setup-uv@v6
+    - uses: astral-sh/setup-uv@v6.4.3
 
     - name: mkdocs gh-deploy
       run: uv run --only-group=docs mkdocs gh-deploy --force

.github/workflows/publish-pypi.yml

@@ -16,12 +16,12 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.2.2
     - name: setup uv
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@v6.4.3
       with:
         python-version: "3.13"
     - name: uv build
       run: uv build
     - name: publish to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@v1.12.4