ci: pin all GitHub Actions to SHA hashes and update versions (#1681)

Update action versions and pin to full SHA commit hashes.
Windows build parallelization is disabled to avoid hung CI.

.github/workflows/ci.yml

@@ -19,9 +19,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-env:
-  UV_VERSION: 0.9.16
-
 jobs:
   lint:
     name: Perform Lint Checks
@@ -32,7 +29,7 @@ jobs:
     steps:
       - name: Checkout Source Files
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Environment
         id: setup-environment
@@ -40,7 +37,6 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache-pre-commit: true
-          uv-version: ${{ env.UV_VERSION }}
           uv-install-options: --all-extras
 
       - name: Run pre-commit Checks
@@ -66,24 +62,27 @@ jobs:
     steps:
       - name: Checkout Source Files
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Environment
         id: setup-environment
         uses: ./.github/actions/setup
         with:
           python-version: ${{ matrix.python-version }}
-          uv-version: ${{ env.UV_VERSION }}
           uv-install-options: ${{ matrix.extras == true && '--all-extras' || '' }}
 
       - name: Run PyTests with Code Coverage
         id: run-pytests-with-code-coverage
         shell: bash
         run: |
-          uv run pytest -n auto --cov kasa --cov-report xml
+          if [[ "${{ runner.os }}" == "Windows" ]]; then
+            uv run pytest -n0 --cov kasa --cov-report xml
+          else
+            uv run pytest -n auto --cov kasa --cov-report xml
+          fi
 
       - name: Upload Code Coverage to Codecov
         id: upload-code-coverage-to-codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -24,6 +24,8 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    env:
+      CODEQL_ACTION_FILE_COVERAGE_ON_PRS: true
     permissions:
       actions: read
       contents: read
@@ -37,14 +39,14 @@ jobs:
     steps:
     - name: Checkout Source Files
       id: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Initialize CodeQL
       id: init-codeql
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
       with:
         languages: ${{ matrix.language }}
 
     - name: Perform CodeQL Analysis
       id: perform-codeql-analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4

.github/workflows/publish.yml

@@ -6,7 +6,6 @@ on:
     types: [published]
 
 env:
-  UV_VERSION: 0.9.16
   PYTHON_VERSION: 3.13
 
 jobs:
@@ -18,16 +17,13 @@ jobs:
     steps:
     - name: Checkout Source Files
       id: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Setup uv
       id: setup-uv
-      uses: astral-sh/setup-uv@v7
-
-    - name: Setup Python
-      id: setup-python
-      uses: actions/setup-python@v6
+      uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
       with:
+        version-file: uv.lock
         python-version: ${{ env.PYTHON_VERSION }}
 
     - name: Build Packages
@@ -37,4 +33,4 @@ jobs:
 
     - name: Publish Release on PyPI
       id: publish-release-on-pypi
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1

.github/workflows/stale.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Stale Issues and PRs Policy
         id: stale-issues-and-prs-policy
-        uses: actions/stale@v10
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
         with:
           repo-token: ${{ github.token }}
           days-before-stale: 90
@@ -46,7 +46,7 @@ jobs:
 
       - name: needs-more-information and waiting-for-reporter Stale Issues Policy
         id: specific-stale-issues-policy
-        uses: actions/stale@v10
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
         with:
           repo-token: ${{ github.token }}
           only-labels: "needs-more-information,waiting-for-reporter"