ci: pin all GitHub Actions to full commit SHAs

[jd]

The org now enforces SHA pinning for Actions (policy enabled
2026-09-09), so every job on main and every open PR has been failing
before it even runs: "The actions actions/checkout@v7.0.1 and
astral-sh/setup-uv@v10.1.0 are not allowed in Mergifyio/alembic-git-revisions
because all actions must be pinned to a full-length commit SHA."

Pin actions/checkout, astral-sh/setup-uv and (in release.yaml)
pypa/gh-action-pypi-publish to their current commit SHAs, each with a
trailing comment naming the tag or branch so Dependabot keeps updating
them. This also carries the pending setup-uv 10.0.1 -> 10.1.0 bump
(supersedes #52, whose branch has the same failure).

astral-sh/setup-uv@v10.1.0 -> bec219d24cd3e171d82865faccec33120bb574f4
actions/checkout@v7.0.1 -> 3d3c42e5aac5ba805825da76410c181273ba90b1
pypa/gh-action-pypi-publish@release/v1 -> dc37677b2e1c63e2034f94d8a5b11f265b73ba33

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

[mergify]

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=all-greens

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by>=1
  • author = dependabot[bot]
  • author = mergify-ci-bot

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Pins GitHub Actions to full commit SHAs to satisfy repository policy.

Changes:

• Pinned checkout and setup-uv in CI and release workflows.
• Pinned the PyPI publishing action.
• Retained version comments for Dependabot updates.

File	Description
.github/​workflows/​ci.yaml	Pins CI actions to full commit SHAs.
.github/​workflows/​release.yaml	Pins release and publishing actions to full commit SHAs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jd]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-23 10:40 UTC · Rule: default · triggered by @jd with the @mergifyio queue command
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-09-23 10:40 UTC · at 4f32762665ae6d1cd9bb593f03c7fd702642169f · squash

This pull request spent 12 seconds in the queue, including 1 second running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub repository ruleset rule Require pull request for default branch]
  • ci: pin all GitHub Actions to full commit SHAs #53
• github-review-approved [🛡 GitHub repository ruleset rule main]
  • ci: pin all GitHub Actions to full commit SHAs #53
• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:
    • ci: pin all GitHub Actions to full commit SHAs #53
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by>=1
      • ci: pin all GitHub Actions to full commit SHAs #53
    • author = dependabot[bot]
      • ci: pin all GitHub Actions to full commit SHAs #53
    • author = mergify-ci-bot
      • ci: pin all GitHub Actions to full commit SHAs #53
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • ci: pin all GitHub Actions to full commit SHAs #53
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • ci: pin all GitHub Actions to full commit SHAs #53
  • #review-requested = 0
    • ci: pin all GitHub Actions to full commit SHAs #53
  • #review-threads-unresolved = 0
    • ci: pin all GitHub Actions to full commit SHAs #53
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success=all-greens