From 889413b4f6ab2eb600b01434a986f46717e5ef1f Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Sat, 1 Aug 2026 13:40:13 +0300
Subject: [PATCH] Hash pin GitHub Actions

---
 .github/workflows/ci.yml   |  8 ++++----
 .github/workflows/lint.yml |  4 ++--
 .github/zizmor.yml         |  6 ------
 .pre-commit-config.yaml    | 12 ++++++------
 4 files changed, 12 insertions(+), 18 deletions(-)
 delete mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c227ace..430b6abd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,19 +17,19 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         id: python-install
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
 
       - name: Install uv
-        uses: hynek/setup-cached-uv@v2
+        uses: hynek/setup-cached-uv@34e35d30f1ebc7421a5cc733bca38dcc62603960 # v2.6.0
         with:
           cache-dependency-path: |
             requirements.txt
@@ -39,7 +39,7 @@ jobs:
         run: |
           uvx --with tox-uv tox -e py
 
-      - uses: codecov/codecov-action@v7
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: always()
         with:
           token: ${{ secrets.CODECOV_ORG_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4cd4b15a..e289794b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: j178/prek-action@v2.0.6
+      - uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2.0.6
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
deleted file mode 100644
index 10002656..00000000
--- a/.github/zizmor.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-# https://docs.zizmor.sh/configuration/
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        "*": ref-pin
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fc439616..8e348c40 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,11 +1,11 @@
 repos:
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 25.12.0
+    rev: 26.5.1
     hooks:
       - id: black
 
   - repo: https://github.com/PyCQA/isort
-    rev: 7.0.0
+    rev: 9.0.0b1
     hooks:
       - id: isort
         files: \.py$
@@ -24,23 +24,23 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.36.0
+    rev: 0.37.4
     hooks:
       - id: check-dependabot
       - id: check-github-workflows
 
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.10
+    rev: v1.7.12
     hooks:
       - id: actionlint
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.19.0
+    rev: v1.28.0
     hooks:
       - id: zizmor
 
   - repo: https://github.com/tox-dev/tox-ini-fmt
-    rev: 1.7.1
+    rev: 1.8.1
     hooks:
       - id: tox-ini-fmt