Merge pull request #289 from kurtmckee/use-sha-for-github-action-versions-issue-287

Use SHAs, not mutable version tags, to ID GitHub Action versions

Author: tkem

.github/workflows/ci.yml

@@ -14,13 +14,13 @@ jobs:
       matrix:
         python: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "pypy3.9", "pypy3.10"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
         with:
           python-version: ${{ matrix.python }}
           allow-prereleases: true
       - run: python -m pip install coverage tox
       - run: python -m tox
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
         with:
           name: ${{ matrix.python }}