Workflow lint reports unpinned actions and persisted checkout credentials #77

Problem

zizmor 1.30.1 (uvx zizmor@1.30.1 --offline --format plain <workflow>) reports these findings on the workflows at #73's head 8f90950:

• ci.yml: 9 unpinned-uses and 3 artipacked. actions/checkout@v7.0.1, astral-sh/setup-uv@v9.0.0, actions/upload-artifact@v7 and actions/download-artifact@v8 are referenced by tag rather than by commit SHA, and the audit, test and sonar checkouts keep the default persist-credentials: true. dev (b923768) has 7 and 3: ci: run lint as its own job and spread pytest over the runner's CPUs #73's new lint job adds two tag references and sets persist-credentials: false on its own checkout.
• docs.yml: 4 unpinned-uses (actions/checkout@v7.0.1, astral-sh/setup-uv@v9.0.0, actions/upload-pages-artifact@v5, actions/deploy-pages@v5) and 1 artipacked.
• release-please.yml: 2 artipacked; 1 template-injection at line 79, where the docker login step expands ${{ github.actor }} inside its run: script; and 1 cache-poisoning at line 56, where astral-sh/setup-uv runs with its default cache in the job that builds and publishes to PyPI.
• pr-title.yml and sync-main-to-dev.yml: 1 artipacked each.

pr-title.yml, release-please.yml, sync-main-to-dev.yml and #71's new scorecard.yml already pin every action to a full commit SHA with a version comment, so ci.yml and docs.yml are the exceptions. The OpenSSF Scorecard workflow that #71 adds scores the same properties in its Pinned-Dependencies and Token-Permissions checks.

Scope

• Pin every action in ci.yml and docs.yml to a full commit SHA with a version comment, as the other workflows do. Dependabot's github-actions updates keep SHA pins current.
• Set persist-credentials: false on every checkout whose job does not push with the checkout token.
• In release-please.yml, pass github.actor to the docker login step through env: and disable the setup-uv cache in the publishing job.

Done when

• uvx zizmor .github/workflows reports no unpinned-uses, artipacked, template-injection or cache-poisoning finding, or each remaining one carries an inline # zizmor: ignore[<rule>] comment that gives the reason.
• actionlint passes over every workflow.

Related

• ci: run lint as its own job and spread pytest over the runner's CPUs #73 (adds the lint job, with persist-credentials: false on its checkout)
• ci: add an OpenSSF Scorecard workflow and README badge #71 and Add OpenSSF Scorecard workflow and README badge #53 (Scorecard workflow)
• ci: shorten PR feedback without reducing verification coverage #61