ci: qualify updated setup and artifact action pins

.github/workflows/docs.yml

@@ -37,7 +37,7 @@ jobs:
           filter: blob:none
           sparse-checkout: README.md
           persist-credentials: false
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
       - run: uv python install 3.12

.github/workflows/paper.yml

@@ -38,11 +38,11 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.candidate-sha }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist-${{ inputs.candidate-sha }}
           path: dist/
@@ -264,7 +264,7 @@ jobs:
           scripts/qualification/scan_release_secrets.py
           --evidence-root feed-evidence
           --output feed-evidence/secret-scan.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: ${{ always() && steps.evidence-scan.outcome == 'success' && steps.feed-evidence-scan.outcome == 'success' }}
         with:
           name: paper-${{ inputs.candidate-sha }}-${{ github.run_id }}
@@ -310,7 +310,7 @@ jobs:
       actions: read
       contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: paper-${{ inputs.candidate-sha }}-${{ github.run_id }}
           path: provider-evidence/

.github/workflows/provider-health.yml

@@ -31,7 +31,7 @@ jobs:
             test_path: tests/integration/test_okx_integration.py
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12

.github/workflows/release-recovery.yml

@@ -33,11 +33,11 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.candidate-sha }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
       - run: uv python install 3.12
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           github-token: ${{ github.token }}
           run-id: ${{ inputs.qualification-run-id }}
@@ -72,22 +72,22 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.candidate-sha }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           github-token: ${{ github.token }}
           run-id: ${{ inputs.qualification-run-id }}
           name: dist-${{ inputs.candidate-sha }}
           path: dist/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           github-token: ${{ github.token }}
           run-id: ${{ inputs.qualification-run-id }}
           name: qualification-${{ inputs.candidate-sha }}
           path: qualification-evidence/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           github-token: ${{ github.token }}
           run-id: ${{ inputs.qualification-run-id }}

.github/workflows/release.yml

@@ -30,7 +30,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ inputs.candidate-sha }}
       - run: git fetch --no-tags origin main
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
       - name: Check main identity and public version absence
@@ -79,11 +79,11 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.candidate-sha }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
       - run: uv python install 3.12
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist-${{ inputs.candidate-sha }}
           path: dist/
@@ -116,7 +116,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate-sha }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: docs-${{ inputs.candidate-sha }}
           path: docs-site/
@@ -162,18 +162,18 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.candidate-sha }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist-${{ inputs.candidate-sha }}
           path: dist/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: qualification-${{ inputs.candidate-sha }}
           path: qualification-evidence/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: security-${{ inputs.candidate-sha }}
           path: security-evidence/
@@ -185,7 +185,7 @@ jobs:
         run: |
           uv run --no-project --with packaging             python scripts/qualification/verify_release_identity.py             --artifacts-dir dist             --artifact-report qualification-evidence/artifact-qualification.json             --security-report security-evidence/security-report.json             --sbom security-evidence/sbom.cdx.json             --dependency-snapshot security-evidence/dependency-snapshot.json             --commit "${{ inputs.candidate-sha }}"             --tag "v${{ inputs.version }}"             --paper-wheel-sha256 "$PAPER_WHEEL_SHA256"             --paper-sdist-sha256 "$PAPER_SDIST_SHA256"             --output-manifest release-manifest.json
           echo "sha256=$(sha256sum release-manifest.json | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-manifest-${{ inputs.candidate-sha }}
           path: release-manifest.json
@@ -206,19 +206,19 @@ jobs:
       actions: read
       contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist-${{ inputs.candidate-sha }}
           path: dist/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: qualification-${{ inputs.candidate-sha }}
           path: qualification-evidence/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: security-${{ inputs.candidate-sha }}
           path: security-evidence/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-manifest-${{ inputs.candidate-sha }}
       - name: Create the tag and release from the published candidate
@@ -246,11 +246,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.candidate-sha }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.9"
       - run: uv python install 3.12
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-manifest-${{ inputs.candidate-sha }}
       - name: Verify PyPI metadata and GitHub release digests

.github/workflows/stable-qualification.yml

@@ -44,7 +44,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install ${{ matrix.python-version }}
@@ -66,7 +66,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install ${{ matrix.python-version }}
@@ -84,7 +84,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
@@ -102,7 +102,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
@@ -120,7 +120,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
@@ -129,7 +129,7 @@ jobs:
           uv run python scripts/qualification/run_stable_gate.py
           --group performance
           --evidence-directory "${{ runner.temp }}/ml4t-live-performance"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: performance-${{ env.CANDIDATE_SHA }}
           path: ${{ runner.temp }}/ml4t-live-performance/performance-qualification.json
@@ -147,7 +147,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
@@ -156,7 +156,7 @@ jobs:
           uv run python scripts/qualification/run_stable_gate.py
           --group documentation
           --evidence-directory "${{ runner.temp }}/ml4t-live-documentation"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: docs-${{ env.CANDIDATE_SHA }}
           path: ${{ runner.temp }}/ml4t-live-documentation/site/
@@ -181,7 +181,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
@@ -201,7 +201,7 @@ jobs:
           SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)
           uv build --build-constraints build-constraints.txt
       - run: uv run twine check --strict dist/*
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist-${{ env.CANDIDATE_SHA }}
           path: dist/
@@ -221,12 +221,12 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12 3.13 3.14 3.15
       - run: uv sync --python 3.12 --all-extras --dev --locked
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist-${{ env.CANDIDATE_SHA }}
           path: dist/
@@ -235,7 +235,7 @@ jobs:
           uv run python scripts/qualification/qualify_artifacts.py
           --artifacts-dir dist
           --output artifact-qualification.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: qualification-${{ env.CANDIDATE_SHA }}
           path: artifact-qualification.json
@@ -255,12 +255,12 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ env.CANDIDATE_SHA }}
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
       - run: uv python install 3.12
       - run: uv sync --python 3.12 --all-extras --dev --locked
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist-${{ env.CANDIDATE_SHA }}
           path: dist/
@@ -269,7 +269,7 @@ jobs:
           uv run python scripts/qualification/qualify_security.py
           --artifacts-dir dist
           --output-directory security-evidence
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: security-${{ env.CANDIDATE_SHA }}
           path: security-evidence/