ci: harden dependency supply chain

Author: julienld

.github/actions/codex-fetch-pr-context/action.yml

@@ -14,7 +14,7 @@ runs:
   steps:
     - name: Gather pull request context
       id: fetch
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       env:
         WRITE_SUMMARY: ${{ inputs.write-summary }}
       with:

.github/actions/codex-run/action.yml

@@ -209,7 +209,7 @@ JSON
 
     - id: run_comment
       if: ${{ inputs.mode == 'comment' && env.GH_TOKEN_CODEX_COMMENT != '' }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       env:
         COMMENT_TOKEN: ${{ env.GH_TOKEN_CODEX_COMMENT }}
       with:

.github/actions/codex-update-auth/action.yml

@@ -47,11 +47,10 @@ runs:
         fi
 
         echo "::notice::Codex auth.json changed; refreshing CODEX_AUTH secret via GitHub REST API."
-        python -m pip install --quiet pynacl
         read_key_output="$(gh api repos/${GITHUB_REPOSITORY}/actions/secrets/public-key --jq '[.key_id, .key] | @tsv')"
         IFS=$'\t' read -r key_id public_key <<<"$read_key_output"
 
-        encrypted_value=$(PUBLIC_KEY="$public_key" AUTH_PATH="$CODEX_AUTH_PATH" python - <<'PY'
+        encrypted_value=$(PUBLIC_KEY="$public_key" AUTH_PATH="$CODEX_AUTH_PATH" uv run --frozen python - <<'PY'
 import base64
 import os
 from pathlib import Path

.github/dependabot.yml

@@ -10,6 +10,8 @@ updates:
       interval: "weekly"
       day: "monday"
       time: "09:00"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     labels:
       - "dependencies"
@@ -29,6 +31,8 @@ updates:
       interval: "weekly"
       day: "monday"
       time: "09:00"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     labels:
       - "dependencies"

.github/integration-mirror-workflows/release-on-tag.yml

@@ -36,7 +36,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # A shallow, ref-only checkout of a tag-push event is not
           # guaranteed to bring down the full annotated tag object (only

.github/workflows/_build-and-release.yml

@@ -41,12 +41,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
 
@@ -57,8 +57,7 @@ jobs:
 
       - name: Create virtual environment and install dependencies
         run: |
-          uv venv .venv
-          uv pip install -e . pyinstaller
+          uv sync --frozen --group dev
         shell: bash
 
       - name: Activate venv (Unix)
@@ -71,7 +70,7 @@ jobs:
         shell: pwsh
 
       - name: Build binary
-        run: pyinstaller packaging/binary/ha-mcp.spec
+        run: uv run --frozen pyinstaller packaging/binary/ha-mcp.spec
 
       - name: Test binary (Linux/macOS)
         if: runner.os != 'Windows'
@@ -95,7 +94,7 @@ jobs:
           mv dist/ha-mcp${{ matrix.binary_ext }} dist/${{ matrix.artifact_name }}${{ matrix.binary_ext }}
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ${{ matrix.artifact_name }}
           path: dist/${{ matrix.artifact_name }}${{ matrix.binary_ext }}
@@ -108,21 +107,21 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
 
       - name: Download Windows binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: ha-mcp-windows
           path: mcpb-bundle
 
       - name: Download macOS binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: ha-mcp-macos-arm64
           path: mcpb-bundle
@@ -152,7 +151,7 @@ jobs:
           unzip -l ha-mcp.mcpb
 
       - name: Upload MCPB artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ha-mcp-mcpb
           path: ha-mcp.mcpb
@@ -165,10 +164,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: ha-mcp-*
           path: artifacts

.github/workflows/_update-addon-config.yml

@@ -58,7 +58,7 @@ jobs:
       # Generate GitHub App token with bypass permissions
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
@@ -85,7 +85,7 @@ jobs:
       # workspace, where any later step could read it. The version-bump push
       # below re-authenticates explicitly with the token instead. The public
       # repo checkout reads fine with the default token. (#1762)
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: master
           fetch-depth: 1

.github/workflows/addon-publish-dev.yml

@@ -57,7 +57,7 @@ jobs:
       dev_version: ${{ steps.version.outputs.dev_version }}
       short_sha: ${{ steps.version.outputs.short_sha }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Full history: the dev version number is the commit count.
           fetch-depth: 0
@@ -100,7 +100,7 @@ jobs:
             platform: linux/arm64
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         submodules: true
 

.github/workflows/addon-publish.yml

@@ -39,7 +39,7 @@ jobs:
             platform: linux/arm64
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         submodules: true
         # Check out the release tag so uv sync installs the bumped pyproject.toml.

.github/workflows/build-binary.yml

@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Pull the skills-vendor submodule so PyInstaller's
           # `collect_all('ha_mcp')` packages the bundled skill files into
@@ -57,7 +57,7 @@ jobs:
           submodules: true
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
 
@@ -68,8 +68,7 @@ jobs:
 
       - name: Create virtual environment and install dependencies
         run: |
-          uv venv .venv
-          uv pip install -e . pyinstaller
+          uv sync --frozen --group dev
         shell: bash
 
       - name: Activate venv (Unix)
@@ -82,7 +81,7 @@ jobs:
         shell: pwsh
 
       - name: Build binary
-        run: pyinstaller packaging/binary/ha-mcp.spec
+        run: uv run --frozen pyinstaller packaging/binary/ha-mcp.spec
 
       - name: Run smoke test (Unix)
         if: runner.os != 'Windows'
@@ -108,7 +107,7 @@ jobs:
           mv dist/ha-mcp${{ matrix.binary_ext }} dist/${{ matrix.artifact_name }}${{ matrix.binary_ext }}
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ${{ matrix.artifact_name }}
           path: dist/${{ matrix.artifact_name }}${{ matrix.binary_ext }}
@@ -122,21 +121,21 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
 
       - name: Download Windows binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: ha-mcp-windows
           path: mcpb-bundle
 
       - name: Download macOS binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: ha-mcp-macos-arm64
           path: mcpb-bundle
@@ -190,7 +189,7 @@ jobs:
           unzip -l ha-mcp.mcpb
 
       - name: Upload mcpb artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ha-mcp-mcpb
           path: ha-mcp.mcpb