rtuszik · rtuszik · Mar 9, 2026 · Mar 9, 2026 · Mar 9, 2026 · Mar 27, 2026
diff --git a/.github/workflows/build-and-push.yml b/.github/workflows/build-and-push.yml
@@ -22,21 +22,22 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   ref: ${{ github.ref }}
+                  persist-credentials: false
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
             - name: Login to DockerHub
-              uses: docker/login-action@v3
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
               with:
                   username: ${{ secrets.DOCKER_USERNAME }}
                   password: ${{ secrets.DOCKER_PASSWORD }}
 
             - name: Login to GitHub Container Registry
-              uses: docker/login-action@v3
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
               with:
                   registry: ghcr.io
                   username: ${{ github.repository_owner }}
@@ -54,26 +55,26 @@ jobs:
                     fi
                     echo "Read photon version from .last_release: $PHOTON_VERSION"
                   else
-                    PHOTON_VERSION="${{ github.event.inputs.photon_version }}"
+                    PHOTON_VERSION="${GITHUB_EVENT_INPUTS_PHOTON_VERSION}"
                     if [[ -z "$PHOTON_VERSION" ]]; then
                       echo "Error: PHOTON_VERSION must be provided when .last_release file is missing"
                       exit 1
                     fi
                   fi
 
                   if [ "${{ github.event_name }}" == "release" ]; then
-                    CONTAINER_VERSION="${{ github.event.release.tag_name }}"
+                    CONTAINER_VERSION="${GITHUB_EVENT_RELEASE_TAG_NAME}"
                     CONTAINER_VERSION="${CONTAINER_VERSION#v}"
                     IS_PRERELEASE="${{ github.event.release.prerelease }}"
-                  elif [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/dev" ]; then
+                  elif [ "${{ github.event_name }}" == "push" ] && [ "${GITHUB_REF}" == "refs/heads/dev" ]; then
                     SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
                     CONTAINER_VERSION="dev-${SHORT_SHA}"
                     IS_PRERELEASE="true"
                   elif [ "${{ github.event_name }}" == "pull_request" ]; then
                     CONTAINER_VERSION="pr-${{ github.event.pull_request.number }}"
                     IS_PRERELEASE="true"
                   else
-                    CONTAINER_VERSION="${{ github.event.inputs.container_version }}"
+                    CONTAINER_VERSION="${GITHUB_EVENT_INPUTS_CONTAINER_VERSION}"
                     CONTAINER_VERSION="${CONTAINER_VERSION#v}"
 
                     if [[ "$CONTAINER_VERSION" == *"-beta"* ]]; then
@@ -90,20 +91,24 @@ jobs:
                   echo "Container Version: $CONTAINER_VERSION"
                   echo "Photon Version: $PHOTON_VERSION"
                   echo "Is Prerelease: $IS_PRERELEASE"
+              env:
+                GITHUB_EVENT_INPUTS_PHOTON_VERSION: ${{ github.event.inputs.photon_version }}
+                GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+                GITHUB_EVENT_INPUTS_CONTAINER_VERSION: ${{ github.event.inputs.container_version }}
 
             - name: Generate Docker tags with semver support
               id: generate_tags
               run: |
-                  CONTAINER_VERSION="${{ env.CONTAINER_VERSION }}"
-                  IS_PRERELEASE="${{ env.IS_PRERELEASE }}"
+                  CONTAINER_VERSION="${CONTAINER_VERSION}"
+                  IS_PRERELEASE="${IS_PRERELEASE}"
 
                   REPO_NAME="${{ github.repository }}"
                   DOCKERHUB_REPO="${REPO_NAME,,}"
                   GHCR_REPO="ghcr.io/${REPO_NAME,,}"
 
                   TAGS="$DOCKERHUB_REPO:$CONTAINER_VERSION,$GHCR_REPO:$CONTAINER_VERSION"
 
-                  if [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/dev" ]; then
+                  if [ "${{ github.event_name }}" == "push" ] && [ "${GITHUB_REF}" == "refs/heads/dev" ]; then
                     TAGS="$TAGS,$DOCKERHUB_REPO:dev,$GHCR_REPO:dev"
                   elif [ "$IS_PRERELEASE" == "true" ]; then
                     TAGS="$TAGS,$DOCKERHUB_REPO:beta,$GHCR_REPO:beta"
@@ -129,7 +134,7 @@ jobs:
                   echo "Generated tags: $TAGS"
 
             - name: Build and push Docker image
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
               with:
                   build-args: |
                       PHOTON_VERSION=${{ env.PHOTON_VERSION }}
@@ -143,7 +148,7 @@ jobs:
               run: |
                   echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
                   echo "- **Event:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Container Version:** ${{ env.CONTAINER_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Photon Version:** ${{ env.PHOTON_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Is Prerelease:** ${{ env.IS_PRERELEASE }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Tags:** ${{ env.DOCKER_TAGS }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Container Version:** ${CONTAINER_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Photon Version:** ${PHOTON_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Is Prerelease:** ${IS_PRERELEASE}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Tags:** ${DOCKER_TAGS}" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/check-releases.yml b/.github/workflows/check-releases.yml
@@ -14,7 +14,9 @@ jobs:
 
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
 
             - name: Check for new Photon release
               id: check_release
@@ -43,30 +45,32 @@ jobs:
             - name: Determine if update is needed
               id: prepare_update
               run: |
-                  if [[ -n "${{ env.latest_release_version }}" && "${{ env.latest_release_version }}" != "${{ env.last_processed_version }}" ]]; then
-                    echo "New version found: ${{ env.latest_release_version }}. (Previous: ${{ env.last_processed_version }})"
+                  if [[ -n "${LATEST_RELEASE_VERSION}" && "${LATEST_RELEASE_VERSION}" != "${LAST_PROCESSED_VERSION}" ]]; then
+                    echo "New version found: ${LATEST_RELEASE_VERSION}. (Previous: ${LAST_PROCESSED_VERSION})"
                     {
                       echo "update_needed=true"
-                      echo "new_version=${{ env.latest_release_version }}"
-                      echo "new_branch_name=update-photon-${{ env.latest_release_version }}"
+                      echo "new_version=${LATEST_RELEASE_VERSION}"
+                      echo "new_branch_name=update-photon-${LATEST_RELEASE_VERSION}"
                     } >> "$GITHUB_OUTPUT"
                   else
-                    echo "No new Photon release detected or version is already up-to-date. Latest fetched: '${{ env.latest_release_version }}', last processed: '${{ env.last_processed_version }}'."
+                    echo "No new Photon release detected or version is already up-to-date. Latest fetched: '${LATEST_RELEASE_VERSION}', last processed: '${LAST_PROCESSED_VERSION}'."
                     {
                       echo "update_needed=false"
-                      echo "new_version=${{ env.last_processed_version }}"
+                      echo "new_version=${LAST_PROCESSED_VERSION}"
                     } >> "$GITHUB_OUTPUT"
                   fi
 
             - name: Update release file(s) locally
               if: steps.prepare_update.outputs.update_needed == 'true'
               run: |
-                  echo "Updating .last_release to ${{ steps.prepare_update.outputs.new_version }}"
-                  echo "${{ steps.prepare_update.outputs.new_version }}" > .last_release
+                  echo "Updating .last_release to ${STEPS_PREPARE_UPDATE_OUTPUTS_NEW_VERSION}"
+                  echo "${STEPS_PREPARE_UPDATE_OUTPUTS_NEW_VERSION}" > .last_release
+              env:
+                STEPS_PREPARE_UPDATE_OUTPUTS_NEW_VERSION: ${{ steps.prepare_update.outputs.new_version }}
 
             - name: Create Pull Request
               if: steps.prepare_update.outputs.update_needed == 'true'
-              uses: peter-evans/create-pull-request@v8
+              uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
               with:
                   token: ${{ secrets.MY_PAT_TOKEN }}
                   commit-message: |

diff --git a/.github/workflows/full-test.yml b/.github/workflows/full-test.yml
@@ -18,10 +18,12 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
             - name: Read Photon version from .last_release
               id: photon_version
@@ -35,7 +37,7 @@ jobs:
                   echo "Photon Version: $PHOTON_VERSION"
 
             - name: Build test image
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
               with:
                   context: .
                   file: ./Dockerfile
@@ -98,5 +100,7 @@ jobs:
               run: |
                   echo "## Container Test Summary" >> $GITHUB_STEP_SUMMARY
                   echo "- **PR Number:** ${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Photon Version:** ${{ env.PHOTON_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Status:** ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Photon Version:** ${PHOTON_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Status:** ${JOB_STATUS}" >> $GITHUB_STEP_SUMMARY
+              env:
+                JOB_STATUS: ${{ job.status }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -11,20 +11,22 @@ jobs:
     setup:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
               with:
                   python-version-file: "pyproject.toml"
             - name: Install uv
-              uses: astral-sh/setup-uv@v7
+              uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8
               with:
                   enable-cache: true
-                  version: 0.8.*
+                  version: 0.11.*
             - name: Install dependencies
               run: uv sync --locked
             - name: Cache dependencies
-              uses: actions/cache/save@v5
+              uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       .venv
@@ -35,18 +37,20 @@ jobs:
         runs-on: ubuntu-latest
         needs: setup
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
               with:
                   python-version-file: "pyproject.toml"
             - name: Install uv
-              uses: astral-sh/setup-uv@v7
+              uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8
               with:
                   enable-cache: true
-                  version: 0.8.*
+                  version: 0.11.*
             - name: Restore dependencies
-              uses: actions/cache/restore@v5
+              uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       .venv
@@ -62,18 +66,20 @@ jobs:
         runs-on: ubuntu-latest
         needs: setup
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
               with:
                   python-version-file: "pyproject.toml"
             - name: Install uv
-              uses: astral-sh/setup-uv@v7
+              uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8
               with:
                   enable-cache: true
-                  version: 0.8.*
+                  version: 0.11.*
             - name: Restore dependencies
-              uses: actions/cache/restore@v5
+              uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       .venv
@@ -86,18 +92,20 @@ jobs:
         runs-on: ubuntu-latest
         needs: setup
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
               with:
                   python-version-file: "pyproject.toml"
             - name: Install uv
-              uses: astral-sh/setup-uv@v7
+              uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8
               with:
                   enable-cache: true
-                  version: 0.8.*
+                  version: 0.11.*
             - name: Restore dependencies
-              uses: actions/cache/restore@v5
+              uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       .venv

diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
@@ -15,15 +15,17 @@ jobs:
     test:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
 
             - name: Set up Python
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
               with:
                   python-version-file: "pyproject.toml"
 
             - name: Install uv
-              uses: astral-sh/setup-uv@v7
+              uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8
               with:
                   enable-cache: true
                   version: 0.*.*
@@ -40,7 +42,7 @@ jobs:
                     | tee pytest-coverage.txt
 
             - name: Pytest coverage comment
-              uses: MishaKav/pytest-coverage-comment@main
+              uses: MishaKav/pytest-coverage-comment@a01708271d42c5703d489b13eb503ba47c01e82a # main
               with:
                   pytest-coverage-path: ./pytest-coverage.txt
                   junitxml-path: ./pytest.xml
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
@@ -15,11 +15,13 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                persist-credentials: false
 
             - name: Run Release Drafter
               id: release-drafter
-              uses: release-drafter/release-drafter@v6
+              uses: release-drafter/release-drafter@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -28,13 +30,14 @@ jobs:
               env:
                   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   DRAFT_BODY: ${{ steps.release-drafter.outputs.body }}
+                  STEPS_RELEASE_DRAFTER_OUTPUTS_ID: ${{ steps.release-drafter.outputs.id }}
               run: |
                   PHOTON_VERSION=$(tr -d '[:space:]' < .last_release)
                   {
                     printf '%s' "$DRAFT_BODY"
-                    printf '\n\n---\n **Upstream Photon release notes (%s):** https://github.com/komoot/photon/releases/tag/%s\n' \
+                    printf '\n\n---\n **[Photon release notes](https://github.com/komoot/photon/releases/tag/%s) (%s):** \n' \
                       "$PHOTON_VERSION" "$PHOTON_VERSION"
                   } > /tmp/new_body.txt
-                  gh api "repos/${{ github.repository }}/releases/${{ steps.release-drafter.outputs.id }}" \
+                  gh api "repos/${{ github.repository }}/releases/${STEPS_RELEASE_DRAFTER_OUTPUTS_ID}" \
                     --method PATCH \
                     --field body=@/tmp/new_body.txt
diff --git a/.pre-commit-config.yml b/.pre-commit-config.yml
@@ -0,0 +1,21 @@
+repos:
+    - repo: https://github.com/pre-commit/pre-commit-hooks
+      rev: v6.0.0
+      hooks:
+          - id: trailing-whitespace
+          - id: check-yaml
+          - id: end-of-file-fixer
+
+    - repo: https://github.com/astral-sh/ruff-pre-commit
+      rev: v0.15.4
+      hooks:
+          - id: ruff-check
+            args: [--fix]
+            files: "\\.py$"
+          - id: ruff-format
+            files: "\\.py$"
+
+    - repo: https://github.com/rhysd/actionlint
+      rev: v1.7.12
+      hooks:
+          - id: actionlint
diff --git a/Dockerfile b/Dockerfile
@@ -1,7 +1,7 @@
 FROM eclipse-temurin:21.0.9_10-jre-noble
 
 # install astral uv
-COPY --from=ghcr.io/astral-sh/uv:0.8 /uv /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.10 /uv /usr/local/bin/
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG PHOTON_VERSION