oe-python-template 0.6.17__tar.gz → 0.6.19__tar.gz

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/.copier-answers.yml

@@ -1,4 +1,4 @@
-_commit: v0.6.16-1-g0e35063
+_commit: v0.6.18-1-g201c4be
 _src_path: .
 author_email: helmuthva@gmail.com
 author_github_username: helmut-hoffer-von-ankershoffen

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/.github/workflows/docker-image-build-publish.yml

@@ -21,18 +21,18 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
 
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
 
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -41,7 +41,7 @@ jobs:
 
 
       - name: Log in to GitHub container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
 
@@ -51,7 +51,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
 
 
@@ -73,7 +73,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: .
           file: ./Dockerfile
@@ -86,10 +86,8 @@ jobs:
 
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
-
-

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/.github/workflows/package-build-publish-release.yml

@@ -15,12 +15,12 @@ jobs:
       packages: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Generate release notes
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@4a4a951bc43fafe41cd2348d181853f52356bee7 # v4.4.2
         id: git-cliff
         with:
           config: pyproject.toml

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/.github/workflows/test-and-report.yml

@@ -17,7 +17,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -30,7 +30,7 @@ jobs:
           sudo apt-get install -y curl jq xsltproc gnupg2 libcairo2
 
       - name: Install uv (python package manager)
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
         with:
           version: "0.5.9"
           enable-cache: true
@@ -58,7 +58,7 @@ jobs:
           echo "Development build - Current version in pyproject.toml: $TOML_VERSION"
 
       - name: Create .env file
-        uses: SpicyPizza/create-envfile@v2.0
+        uses: SpicyPizza/create-envfile@ace6d4f5d7802b600276c23ca417e669f1a06f6f # v2.0.3
         with:
           envkey_ENV_KEY: "ENV_VALUE"
           fail_on_empty: true
@@ -80,7 +80,7 @@ jobs:
           uv run nox
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         if: ${{ always() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
         with:
           name: test-results
@@ -94,7 +94,7 @@ jobs:
           retention-days: 30
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -102,12 +102,12 @@ jobs:
 
       - name: Upload test results to Codecov
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
-        uses: codecov/test-results-action@v1
+        uses: codecov/test-results-action@f2dba722c67b86c6caa034178c6e4d35335f6706 # v1.1.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: SonarQube Scan
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
-        uses: SonarSource/sonarqube-scan-action@v5
+        uses: SonarSource/sonarqube-scan-action@0303d6b62e310685c0e34d0b9cde218036885c4d # v5.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/CHANGELOG.md

@@ -1,6 +1,26 @@
 [🧠 OE Python Template](https://oe-python-template.readthedocs.io/en/latest/)
 
-## [0.6.17](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.16..0.6.17) - 2025-03-18
+## [0.6.19](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.18..0.6.19) - 2025-03-18
+
+### 🚜 Refactor
+
+- *(codeql)* Fix - ([0af319f](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/0af319fcf7a24c06cb3cacdfa3140e6121830e09))
+
+
+## [0.6.18](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.17..v0.6.18) - 2025-03-18
+
+### 📚 Documentation
+
+- *(api)* Pdf - ([ecd7dda](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/ecd7dda9fedc464976b5b2f8afa56cf0a35c645f))
+
+### ⚙️ Miscellaneous Tasks
+
+- *(rtd)* Debug - ([80703d7](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/80703d734a8cd77e35aad6aec14bdefb9d61ed51))
+- Debug rtd - ([bc760ac](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/bc760aca603950b8dd1cf5c77241b2f8ccc091d2))
+- Debug rtd pdf link - ([192df7f](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/192df7f2552180eb721fd21b32f9e074c0f35073))
+
+
+## [0.6.17](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.16..v0.6.17) - 2025-03-18
 
 ### ⛰️  Features
 

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/CONTRIBUTING.md

@@ -20,6 +20,7 @@ fi
 which jq &> /dev/null || brew install jq
 which xmllint &> /dev/null || brew install xmllint
 which act &> /dev/null || brew install act
+which pinact &> /dev/null || brew install pinact
 uv run pre-commit install             # install pre-commit hooks, see https://pre-commit.com/
 ```
 
@@ -130,6 +131,12 @@ docker build -t oe-python-template .
 docker run --env THE_VAR=THE_VALUE oe-python-template --help
 ```
 
+### Pinning github actions
+
+```shell
+pinact run  # See https://dev.to/suzukishunsuke/pin-github-actions-to-a-full-length-commit-sha-for-security-2n7p
+```
+
 ### Copier
 
 Update from template

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oe-python-template
-Version: 0.6.17
+Version: 0.6.19
 Summary: 🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling.
 Project-URL: Homepage, https://oe-python-template.readthedocs.io/en/latest/
 Project-URL: Documentation, https://oe-python-template.readthedocs.io/en/latest/

oe_python_template-0.6.19/RELEASE_NOTES.md

@@ -0,0 +1,8 @@
+## [0.6.19](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.18..v0.6.19) - 2025-03-18
+
+### 🚜 Refactor
+
+- *(codeql)* Fix - ([0af319f](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/0af319fcf7a24c06cb3cacdfa3140e6121830e09))
+
+
+

oe_python_template-0.6.19/VERSION

@@ -0,0 +1 @@
+0.6.19

oe_python_template-0.6.19/docs/source/_static/openapi_v1.yaml

@@ -0,0 +1,204 @@
+components:
+  schemas:
+    EchoRequest:
+      description: Request model for echo endpoint.
+      properties:
+        text:
+          description: The text to echo back
+          examples:
+          - Hello, world!
+          minLength: 1
+          title: Text
+          type: string
+      required:
+      - text
+      title: EchoRequest
+      type: object
+    EchoResponse:
+      description: Response model for echo endpoint.
+      properties:
+        message:
+          description: The message content
+          examples:
+          - Hello, world!
+          minLength: 1
+          title: Message
+          type: string
+      required:
+      - message
+      title: EchoResponse
+      type: object
+    HTTPValidationError:
+      properties:
+        detail:
+          items:
+            $ref: '#/components/schemas/ValidationError'
+          title: Detail
+          type: array
+      title: HTTPValidationError
+      type: object
+    Health:
+      description: Health status model.
+      properties:
+        reason:
+          anyOf:
+          - type: string
+          - type: 'null'
+          title: Reason
+        status:
+          $ref: '#/components/schemas/_HealthStatus'
+      required:
+      - status
+      title: Health
+      type: object
+    HelloWorldResponse:
+      description: Response model for hello-world endpoint.
+      properties:
+        message:
+          description: The hello world message
+          examples:
+          - Hello, world!
+          title: Message
+          type: string
+      required:
+      - message
+      title: HelloWorldResponse
+      type: object
+    ValidationError:
+      properties:
+        loc:
+          items:
+            anyOf:
+            - type: string
+            - type: integer
+          title: Location
+          type: array
+        msg:
+          title: Message
+          type: string
+        type:
+          title: Error Type
+          type: string
+      required:
+      - loc
+      - msg
+      - type
+      title: ValidationError
+      type: object
+    _HealthStatus:
+      description: Health status enumeration.
+      enum:
+      - UP
+      - DOWN
+      title: _HealthStatus
+      type: string
+info:
+  contact:
+    email: helmuthva@gmail.com
+    name: Helmut Hoffer von Ankershoffen
+    url: https://github.com/helmut-hoffer-von-ankershoffen
+  termsOfService: https://oe-python-template.readthedocs.io/en/latest/
+  title: OE Python Template
+  version: 1.0.0
+openapi: 3.1.0
+paths:
+  /echo:
+    post:
+      description: "Echo back the provided text.\n\nArgs:\n    request 
+(EchoRequest):\
+        \ The request containing the text to echo back.\n\nReturns:\n    
+EchoResponse:\
+        \ A response containing the echoed text.\n\nRaises:\n    422 
+Unprocessable\
+        \ Entity: If text is not provided or empty."
+      operationId: echo_echo_post
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/EchoRequest'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EchoResponse'
+          description: Successful Response
+        '422':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      summary: Echo
+      tags:
+      - Basics
+  /health:
+    get:
+      description: "Check the health of the service.\n\nThis endpoint returns 
+the\
+        \ health status of the service.\nThe health status can be either UP or 
+DOWN.\n\
+        If the service is healthy, the status will be UP.\nIf the service is 
+unhealthy,\
+        \ the status will be DOWN and a reason will be provided.\nThe response 
+will\
+        \ have a 200 OK status code if the service is healthy,\nand a 500 
+Internal\
+        \ Server Error status code if the service is unhealthy.\n\nReturns:\n   
+Health:\
+        \ The health status of the service."
+      operationId: health_health_get
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Health'
+          description: Successful Response
+      summary: Health
+      tags:
+      - Observability
+  /healthz:
+    get:
+      description: "Check the health of the service.\n\nThis endpoint returns 
+the\
+        \ health status of the service.\nThe health status can be either UP or 
+DOWN.\n\
+        If the service is healthy, the status will be UP.\nIf the service is 
+unhealthy,\
+        \ the status will be DOWN and a reason will be provided.\nThe response 
+will\
+        \ have a 200 OK status code if the service is healthy,\nand a 500 
+Internal\
+        \ Server Error status code if the service is unhealthy.\n\nReturns:\n   
+Health:\
+        \ The health status of the service."
+      operationId: health_healthz_get
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Health'
+          description: Successful Response
+      summary: Health
+      tags:
+      - Observability
+  /hello-world:
+    get:
+      description: "Return a hello world message.\n\nReturns:\n    
+HelloWorldResponse:\
+        \ A response containing the hello world message."
+      operationId: hello_world_hello_world_get
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/HelloWorldResponse'
+          description: Successful Response
+      summary: Hello World
+      tags:
+      - Basics

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/docs/source/_static/openapi_v2.yaml

@@ -104,9 +104,12 @@ openapi: 3.1.0
 paths:
   /echo:
     post:
-      description: "Echo back the provided utterance.\n\nArgs:\n    request (Utterance):\
-        \ The request containing the utterance to echo back.\n\nReturns:\n    EchoResponse:\
-        \ A response containing the echoed utterance.\n\nRaises:\n    422 Unprocessable\
+      description: "Echo back the provided utterance.\n\nArgs:\n    request 
+(Utterance):\
+        \ The request containing the utterance to echo back.\n\nReturns:\n    
+EchoResponse:\
+        \ A response containing the echoed utterance.\n\nRaises:\n    422 
+Unprocessable\
         \ Entity: If utterance is not provided or empty."
       operationId: echo_v2_echo_post
       requestBody:
@@ -133,12 +136,18 @@ paths:
       - Basics
   /health:
     get:
-      description: "Check the health of the service.\n\nThis endpoint returns the\
-        \ health status of the service.\nThe health status can be either UP or DOWN.\n\
-        If the service is healthy, the status will be UP.\nIf the service is unhealthy,\
-        \ the status will be DOWN and a reason will be provided.\nThe response will\
-        \ have a 200 OK status code if the service is healthy,\nand a 500 Internal\
-        \ Server Error status code if the service is unhealthy.\n\nReturns:\n    Health:\
+      description: "Check the health of the service.\n\nThis endpoint returns 
+the\
+        \ health status of the service.\nThe health status can be either UP or 
+DOWN.\n\
+        If the service is healthy, the status will be UP.\nIf the service is 
+unhealthy,\
+        \ the status will be DOWN and a reason will be provided.\nThe response 
+will\
+        \ have a 200 OK status code if the service is healthy,\nand a 500 
+Internal\
+        \ Server Error status code if the service is unhealthy.\n\nReturns:\n   
+Health:\
         \ The health status of the service."
       operationId: health_health_get
       responses:
@@ -153,12 +162,18 @@ paths:
       - Observability
   /healthz:
     get:
-      description: "Check the health of the service.\n\nThis endpoint returns the\
-        \ health status of the service.\nThe health status can be either UP or DOWN.\n\
-        If the service is healthy, the status will be UP.\nIf the service is unhealthy,\
-        \ the status will be DOWN and a reason will be provided.\nThe response will\
-        \ have a 200 OK status code if the service is healthy,\nand a 500 Internal\
-        \ Server Error status code if the service is unhealthy.\n\nReturns:\n    Health:\
+      description: "Check the health of the service.\n\nThis endpoint returns 
+the\
+        \ health status of the service.\nThe health status can be either UP or 
+DOWN.\n\
+        If the service is healthy, the status will be UP.\nIf the service is 
+unhealthy,\
+        \ the status will be DOWN and a reason will be provided.\nThe response 
+will\
+        \ have a 200 OK status code if the service is healthy,\nand a 500 
+Internal\
+        \ Server Error status code if the service is unhealthy.\n\nReturns:\n   
+Health:\
         \ The health status of the service."
       operationId: health_healthz_get
       responses:
@@ -173,7 +188,8 @@ paths:
       - Observability
   /hello-world:
     get:
-      description: "Return a hello world message.\n\nReturns:\n    HelloWorldResponse:\
+      description: "Return a hello world message.\n\nReturns:\n    
+HelloWorldResponse:\
         \ A response containing the hello world message."
       operationId: hello_world_hello_world_get
       responses:

oe_python_template-0.6.19/docs/source/api_v1.rst

@@ -0,0 +1,9 @@
+API V1
+======
+
+.. only:: html
+
+    .. swagger-plugin:: _static/openapi_v1.yaml
+        :full-page:
+
+Visit the `Interactive API Documentation <https: //oe-python-template.readthedocs.io/en/latest/api_v1.html>`_

oe_python_template-0.6.19/docs/source/api_v2.rst

@@ -0,0 +1,9 @@
+API V2
+======
+
+.. only:: html
+
+   .. swagger-plugin:: _static/openapi_v2.yaml
+      :full-page:
+
+Visit the `Interactive API Documentation <https://oe-python-template.readthedocs.io/en/latest/api_v2.html>`_

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/docs/source/conf.py

@@ -29,7 +29,7 @@ extensions = [
 project = "oe-python-template"
 author = "Helmut Hoffer von Ankershoffen"
 copyright = f" (c) 2025-{datetime.now(UTC).year}, {author}"  # noqa: A001
-version = "0.6.17"
+version = "0.6.19"
 release = version
 github_username = "helmut-hoffer-von-ankershoffen"
 github_repository = "oe-python-template"

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/examples/notebook.py

@@ -10,7 +10,7 @@ def _():
 
     service = Service()
     message = service.get_hello_world()
-    message # type: ignore
+    print(message)
     return Service, message, service
 
 

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "oe-python-template"
-version = "0.6.17"
+version = "0.6.19"
 description = "🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling."
 readme = "README.md"
 authors = [
@@ -242,7 +242,7 @@ source = ["src/"]
 
 
 [tool.bumpversion]
-current_version = "0.6.17"
+current_version = "0.6.19"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 search = "{current_version}"

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/sonar-project.properties

@@ -1,6 +1,6 @@
 sonar.projectKey=helmut-hoffer-von-ankershoffen_oe-python-template
 sonar.organization=helmut-hoffer-von-ankershoffen
-sonar.projectVersion=0.6.17
+sonar.projectVersion=0.6.19
 sonar.projectDescription=🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling.
 sonar.links.homepage=https://oe-python-template.readthedocs.io/en/latest/
 sonar.links.scm=https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/template/.github/workflows/docker-image-build-publish.yml.jinja

@@ -21,18 +21,18 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
 
 {% if docker_io_enabled %}
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
 {% raw %}
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -41,7 +41,7 @@ jobs:
 {% endif %}
 
       - name: Log in to GitHub container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
 {% raw %}
@@ -51,7 +51,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
 {% if docker_io_enabled %}
 {% raw %}
@@ -78,7 +78,7 @@ jobs:
 {% raw %}
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: .
           file: ./Dockerfile
@@ -91,7 +91,7 @@ jobs:
 {% if docker_io_enabled %}
 {% raw %}
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}

{oe_python_template-0.6.17 → oe_python_template-0.6.19}/template/.github/workflows/package-build-publish-release.yml.jinja

@@ -15,12 +15,12 @@ jobs:
       packages: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Generate release notes
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@4a4a951bc43fafe41cd2348d181853f52356bee7 # v4.4.2
         id: git-cliff
         with:
           config: pyproject.toml