Activate linter for GitHub actions

.github/actions/python-environment/action.yml

@@ -34,7 +34,7 @@ runs:
 
 
     - name: Set up Python (${{ inputs.python-version}})
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -69,7 +69,7 @@ runs:
     - name: Cache Poetry environment
       if: inputs.use-cache == 'true'
       id: cache-poetry-env
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ steps.setup-cache-variables.outputs.POETRY_ENV_PATH }}
         key: poetry-env-${{ steps.setup-cache-variables.outputs.POETRY_SHA }}-${{ steps.setup-cache-variables.outputs.IMAGE_OS }}-${{ steps.setup-cache-variables.outputs.IMAGE_VERSION }}-${{ runner.arch }}-${{ inputs.poetry-version }}-${{ inputs.python-version }}-${{ inputs.extras }}

.github/actions/security-issues/action.yml

@@ -32,7 +32,7 @@ runs:
   steps:
 
     - name: Setup Python (${{ inputs.python-version}})
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: 3.11
 

.github/dependabot.yml

@@ -8,11 +8,15 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 4
+    cooldown:
+      default-days: 7
 
   # Maintain dependencies for poetry
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
-    open-pull-requests-limit: 4
+    open-pull-requests-limit: 4
+    cooldown:
+      default-days: 7

.github/workflows/fast-tests-extension.yml

@@ -12,7 +12,9 @@ jobs:
     steps:
       - name: Check out Repository
         id: check-out-repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python & Poetry Environment
         id: set-up-python-and-poetry-environment

.github/workflows/slow-checks.yml

@@ -25,7 +25,9 @@ jobs:
     steps:
       - name: Check out Repository
         id: check-out-repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python & Poetry Environment
         id: set-up-python-and-poetry-environment
@@ -40,7 +42,7 @@ jobs:
 
       - name: Upload Artifacts
         id: upload-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: coverage-python${{ matrix.python-version }}-slow
           path: .coverage

.github/workflows/test-python-environment.yml

@@ -12,7 +12,7 @@ jobs:
     outputs:
       should_run: ${{ steps.diff.outputs.should_run }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -67,7 +67,7 @@ jobs:
     steps:
       - name: Check out Repository
         id: check-out-repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/zizmor.yml

@@ -0,0 +1,14 @@
+rules:
+  github-env:
+    disable: true
+  secrets-inherit:
+    disable: true
+  template-injection:
+    disable: true
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin
+        exasol/python-toolbox/.github/actions/python-environment: ref-pin
+  use-trusted-publishing:
+    disable: true

.workflow-patcher.yml

@@ -8,7 +8,7 @@ workflows:
           # The PTB has unit tests which require the fetch-depth to be 0.
           - name: Check out Repository
             id: check-out-repository
-            uses: actions/checkout@v6
+            uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             with:
               persist-credentials: false
               fetch-depth: 0

doc/github_actions/python_environment.rst

@@ -49,7 +49,7 @@ Example Usage
 
         steps:
           - name: SCM Checkout
-            uses: actions/checkout@v6
+            uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
           - name: Setup Python & Poetry Environment
             uses: exasol/python-toolbox/.github/actions/python-environment@v4

doc/github_actions/security_issues.rst

@@ -26,7 +26,7 @@ Example Usage
 
         steps:
           - name: SCM Checkout
-            uses: actions/checkout@v6
+            uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
           - name: Report Security Issues
             uses: exasol/python-toolbox/.github/actions/security-issues@v1

doc/user_guide/features/github_workflows/workflow_patcher.rst

@@ -30,7 +30,7 @@ Model
            content:
              - name: Check out Repository
                id: check-out-repository
-               uses: actions/checkout@v6
+               uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
                with:
                  fetch-depth: 0