Merge upstream/main into feature/collider-ml-reader-arrow

Integrates the official Arrow/Parquet base (PR acts-project#5410) from upstream/main.
Our branch retains only the ColliderML reader on top:
- ArrowUtil: keep flatColumnUInt*/readFlatParquetFile (used by ColliderML)
- Parquet CMakeLists: keep ColliderMLInputConverter target block
- Python Arrow bindings: keep ColliderMLInputConverter pybind11 declarations
- root_file_hashes.txt: keep ColliderML test hashes + upstream strip_space_points rename

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: benjaminhuth

.github/actions/dependencies/action.yml

@@ -39,12 +39,12 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Python version
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: "3.12"
 
     - name: Install the latest version of uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
 
     - name: Prerequisites
       if: startsWith(runner.os, 'macos')
@@ -54,7 +54,7 @@ runs:
 
     - name: Restore cache
       id: cache-restore
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: spack_cache
         key: spack-r4-${{ inputs.spack_version }}-${{ inputs.spack_repo_version }}-${{ hashFiles('CI/dependencies/setup_spack.sh') }}
@@ -81,7 +81,7 @@ runs:
 
     - name: Save cache
       if: steps.cache-restore.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: |
           spack_cache
@@ -94,15 +94,18 @@ runs:
         SPACK_REPO_VERSION: ${{ inputs.spack_repo_version }}
         DEPENDENCY_TAG: ${{ inputs.DEPENDENCY_TAG }}
         CXXSTD: ${{ inputs.cxx_std }}
+        ENV_FILE: ${{ inputs.env_file }}
+        FULL_INSTALL: ${{ inputs.full_install }}
+        COMPILER: ${{ inputs.compiler }}
       run: |
-        args="-e ${{ inputs.env_file }}"
-        if [ "${{ inputs.full_install }}" == "true" ]; then
+        args="-e $ENV_FILE"
+        if [ "$FULL_INSTALL" == "true" ]; then
           echo "Full install"
           args="${args} -f"
         fi
-        if [ -n "${{ inputs.compiler }}" ]; then
+        if [ -n "$COMPILER" ]; then
           echo "With compiler"
-          args="${args} -c ${{ inputs.compiler }}"
+          args="${args} -c $COMPILER"
         fi
 
         CI/dependencies/setup.sh $args

.github/dependabot.yml

@@ -7,6 +7,8 @@ updates:
       day: "sunday"
       time: "01:23"
       timezone: "Europe/Zurich"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pre-commit"
     directory: "/"
@@ -15,3 +17,5 @@ updates:
       day: "sunday"
       time: "01:23"
       timezone: "Europe/Zurich"
+    cooldown:
+      default-days: 7

.github/workflows/analysis.yml

@@ -26,13 +26,18 @@ env:
 # NOTE this only builds core unittests to reduce the output size. if we
 #      found a way to have Github actions not fail regularly with this job
 #      all unit tests should be reactivated.
+permissions:
+  contents: read
+
 jobs:
   build_debug:
     runs-on: ubuntu-latest
     container: ghcr.io/acts-project/ubuntu2404:85
     steps:
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         uses: ./.github/actions/dependencies
@@ -43,26 +48,31 @@ jobs:
 
       - name: Save PR metadata
         if: github.event_name == 'pull_request'
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          PR_SHA: ${{ github.event.pull_request.head.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          MERGE_SHA: ${{ github.sha }}
         run: |
           # Shallow clone: parent commits aren't available via git,
           # but GitHub provides the SHAs through the event context.
           printf '{"pr_number":"%s","pr_sha":"%s","base_sha":"%s","merge_sha":"%s"}\n' \
-            "${{ github.event.number }}" \
-            "${{ github.event.pull_request.head.sha }}" \
-            "${{ github.event.pull_request.base.sha }}" \
-            "${{ github.sha }}" \
+            "$PR_NUMBER" \
+            "$PR_SHA" \
+            "$BASE_SHA" \
+            "$MERGE_SHA" \
             > PR_metadata.json
           cat PR_metadata.json
 
       - name: Persist PR metadata
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: PR_metadata
           path: PR_metadata.json
 
       - name: Cache build
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.CCACHE_DIR }}
           key: ccache-${{ runner.os  }}-${{ github.job }}-${{ env.CCACHE_KEY_SUFFIX }}-${{ github.sha }}
@@ -90,26 +100,29 @@ jobs:
           && du -sh build
       - name: Coverage
         run: |
-          uv run --no-project CI/test_coverage.py build --filter
+          uv run --no-project --no-build CI/test_coverage.py build --filter
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: coverage-build
           path: |
             build/compile_commands.json
             build/coverage/cov.xml
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         id: artifact-upload-step
         with:
           name: coverage-html
           path: build/coverage/html
 
       - name: Coverage display
+        env:
+          REPOSITORY: ${{ github.repository }}
+          ARTIFACT_ID: ${{ steps.artifact-upload-step.outputs.artifact-id }}
         run: |
-          base_link='https://acts-herald.app.cern.ch/view/${{ github.repository }}/${{ steps.artifact-upload-step.outputs.artifact-id }}'
+          base_link="https://acts-herald.app.cern.ch/view/${REPOSITORY}/${ARTIFACT_ID}"
           link="$base_link/index.html"
           echo "🛡️ Code coverage available at: $link"
           echo "**🛡️ Code coverage available [here]($link)**" >> $GITHUB_STEP_SUMMARY
@@ -119,18 +132,21 @@ jobs:
     container: ghcr.io/acts-project/ubuntu2404_clang22:85
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Mark workspace as safe
         run: git config --global --add safe.directory /__w/acts/acts
 
       - name: Fetch base branch
         if: github.event_name == 'pull_request'
-        run: git fetch origin "${{ github.base_ref }}"
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch origin "$BASE_REF"
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
 
       - name: Install clang-tidy
         run: |
@@ -158,24 +174,26 @@ jobs:
 
       - name: Analyze (PR - changed files only)
         if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: >
-          uv run CI/clang_tidy/run_clang_tidy_pr.py
-          analyze build fixes.yml --base-ref "origin/${{ github.base_ref }}"
+          uv run --no-build CI/clang_tidy/run_clang_tidy_pr.py
+          analyze build fixes.yml --base-ref "origin/$BASE_REF"
 
       - name: Analyze (push - all files)
         if: github.event_name == 'push'
         run: >
-          uv run CI/clang_tidy/run_clang_tidy_pr.py
+          uv run --no-build CI/clang_tidy/run_clang_tidy_pr.py
           analyze build fixes.yml --all
 
       - name: Upload fixes
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: clang-tidy-fixes
           path: fixes.yml
 
       - name: Annotate
         run: >
-          uv run CI/clang_tidy/run_clang_tidy_pr.py
+          uv run --no-build CI/clang_tidy/run_clang_tidy_pr.py
           annotate fixes.yml