ci: pin third-party actions to full commit SHAs (matching the existing setup-uv pin) #928

	name: CodSpeed

	on:
	push:
	branches:
	- develop
	pull_request:
	# `workflow_dispatch` allows CodSpeed to trigger backtest
	# performance analysis in order to generate initial data.
	workflow_dispatch:

	jobs:
	benchmarks:
	name: Run benchmarks
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: actions/setup-python@v6
	with:
	# 3.12 is the minimum required version for profiling enabled
	python-version: "3.12"

	- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

	- name: Build dists
	run: make build

	- name: Run benchmarks
	uses: CodSpeedHQ/action@76578c2a7ddd928664caa737f0e962e3085d4e7c # v3.8.1
	with:
	token: ${{ secrets.CODSPEED_TOKEN }}
	run: uv run --frozen pytest tests/benchmarks --codspeed

Provide feedback