ci: pin all GitHub Actions to SHA hashes and update versions (#1681)

Update action versions and pin to full SHA commit hashes.
Windows build parallelization is disabled to avoid hung CI.

.github/workflows/publish.yml

@@ -6,7 +6,6 @@ on:
     types: [published]
 
 env:
-  UV_VERSION: 0.9.16
   PYTHON_VERSION: 3.13
 
 jobs:
@@ -18,16 +17,13 @@ jobs:
     steps:
     - name: Checkout Source Files
       id: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Setup uv
       id: setup-uv
-      uses: astral-sh/setup-uv@v7
-
-    - name: Setup Python
-      id: setup-python
-      uses: actions/setup-python@v6
+      uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
       with:
+        version-file: uv.lock
         python-version: ${{ env.PYTHON_VERSION }}
 
     - name: Build Packages
@@ -37,4 +33,4 @@ jobs:
 
     - name: Publish Release on PyPI
       id: publish-release-on-pypi
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1