Pin actions, reduce permissions and third-party actions

.github/workflows/auto-merge.yml

@@ -1,29 +1,22 @@
 name: auto-merge
+on: pull_request
 
-on:
-  pull_request_target:
-    types:
-    - opened
-    - reopened
-    - synchronize
-    branches:
-    - master
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
-
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'pypa/hatch'
     steps:
-    - name: Wait for tests to succeed
-      uses: lewagon/wait-on-check-action@v1.3.4
-      with:
-        ref: ${{ github.ref }}
-        check-name: check
-        wait-interval: 10
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Enable auto-merge for Dependabot PRs
-      run: gh pr merge --auto --squash ${{ github.event.pull_request.html_url }}
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/build-distributions.yml

@@ -27,20 +27,22 @@ jobs:
 
     steps:
     - name: Set up Python ${{ env.DIST_PYTHON_VERSION }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       with:
         python-version: ${{ env.DIST_PYTHON_VERSION }}
 
     - name: Install UV
-      uses: astral-sh/setup-uv@v3
+      uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
 
     - name: Install Hatch
       if: inputs.version
       # Try to install the specific version of Hatch that was just released until successful
       run: |-
         for i in {1..20}; do
-          uv pip install --system hatch==${{ inputs.version }} && break || sleep 5
+          uv pip install --system hatch==${INPUTS_VERSION} && break || sleep 5
         done
+      env:
+        INPUTS_VERSION: ${{ inputs.version }}
 
   linux:
     name: Distribution ${{ matrix.job.target }}
@@ -59,13 +61,14 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         fetch-depth: ${{ inputs.version && 1 || 0 }}
+        persist-credentials: false
 
     - name: Set up QEMU
       if: matrix.job.emulation
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
     - name: Set up Docker container
       run: >-
@@ -93,8 +96,9 @@ jobs:
     - name: Install Hatch
       run: >-
         docker exec builder
-        /home/python/bin/python -m pip install
-        ${{ inputs.version && format('hatch=={0}', inputs.version) || '/home/hatch' }}
+        /home/python/bin/python -m pip install $INPUTS_VERSION_OR_DIR
+      env:
+        INPUTS_VERSION_OR_DIR: ${{ inputs.version && format('hatch=={0}', inputs.version) || '/home/hatch' }}
 
     - name: Make scripts portable
       run: >-
@@ -123,7 +127,7 @@ jobs:
       run: ls -lh hatch-dist-${{ matrix.job.target }}.tar.gz
 
     - name: Upload archive
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: distribution-${{ matrix.job.target }}
         path: hatch-dist-${{ matrix.job.target }}.tar.gz
@@ -145,9 +149,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         fetch-depth: ${{ inputs.version && 1 || 0 }}
+        persist-credentials: false
 
     - name: Download distribution
       run: curl -LO ${{ env.DIST_URL }}/${{ env.DIST_VERSION }}/cpython-${{ env.DIST_PYTHON_VERSION }}+${{ env.DIST_VERSION }}-${{ matrix.job.target }}-install_only.tar.gz
@@ -158,8 +163,9 @@ jobs:
     - name: Install Hatch
       run: >-
         ${{ startsWith(matrix.job.os, 'windows-') && '.\\python\\python.exe' || './python/bin/python' }}
-        -m pip install
-        ${{ inputs.version && format('hatch=={0}', inputs.version) || '.' }}
+        -m pip install $INPUTS_VERSION_OR_DOT
+      env:
+        INPUTS_VERSION_OR_DOT: ${{ inputs.version && format('hatch=={0}', inputs.version) || '.' }}
 
     - name: Make scripts portable
       run: >-
@@ -185,7 +191,7 @@ jobs:
       run: ls -lh hatch-dist-${{ matrix.job.target }}.tar.gz
 
     - name: Upload archive
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: distribution-${{ matrix.job.target }}
         path: hatch-dist-${{ matrix.job.target }}.tar.gz