chore(cicd): pin workflows to commits (SHA)

.github/workflows/main.yml

@@ -5,20 +5,24 @@ on:
   pull_request:
     types: [opened, reopened, review_requested, edited]
 
+permissions: {}
+
 jobs:
   build:
     name: Testing on ${{ matrix.os }} with Python version ${{ matrix.python }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         python: ['3.9', '3.10', '3.11', '3.12', '3.13']
         os: ['ubuntu-latest']
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  #v6.2.0
         with:
           python-version: ${{ matrix.python }}
 
@@ -28,12 +32,6 @@ jobs:
       - name: Run tests with coverage and create report as xml file
         run: make test
 
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v1
-        with:
-            token: ${{secrets.CODECOV_TOKEN}}
-            file: coverage.xml
-
       - name: Run Flake8
         run: flake8
 

.github/workflows/pythonpublish.yml

@@ -1,27 +1,34 @@
 name: Release
 
-# Only run for releases (tagged)
 on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.11'
-    - name: Install build dependencies
-      run: python -m pip install -U setuptools wheel build
-    - name: Build
-      run: python -m build .
-    - name: Publish
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        skip-existing: true
-        user: '__token__'
-        password: ${{ secrets.pypi_password }}
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: '3.13'
+
+      - name: Install build dependencies
+        run: python -m pip install -U setuptools wheel build
+
+      - name: Build
+        run: python -m build .
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
+        with:
+          skip-existing: true
+          user: '__token__'
+          password: ${{ secrets.pypi_password }}