Upgrade actions versions

Author: medmunds

.github/workflows/integration-test.yml

@@ -60,11 +60,11 @@ jobs:
 
     steps:
       - name: Get code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Setup Python ${{ matrix.config.python }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.config.python }}
           cache: "pip"

.github/workflows/release.yml

@@ -30,12 +30,12 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Get code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.14"
 
@@ -68,7 +68,7 @@ jobs:
           python -m twine check dist/*
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -85,13 +85,12 @@ jobs:
       id-token: write
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        # Official PyPA publishing action, and we want any security/dependency updates.
-        uses: pypa/gh-action-pypi-publish@release/v1 # zizmor: ignore[unpinned-uses]
+        uses: pypa/gh-action-pypi-publish@release/v1
 
   release:
     needs: [build, publish]
@@ -101,7 +100,7 @@ jobs:
       contents: write
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/

.github/workflows/test.yml

@@ -22,13 +22,13 @@ jobs:
       envlist: ${{ steps.generate-envlist.outputs.envlist }}
     steps:
       - name: Get code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Setup default Python
         # Change default Python version to something consistent
         # for installing/running tox
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.14"
       - name: Install tox-gh-matrix
@@ -55,19 +55,19 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Get code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Setup Python ${{ matrix.tox.python.version }}
         # Ensure matrix Python version is installed and available for tox
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.tox.python.spec }}
           cache: "pip"
       - name: Setup default Python
         # Change default Python version back to something consistent
         # for installing/running tox
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.14"
       - name: Install tox

.github/zizmor.yml

@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        pypa/gh-action-pypi-publish: ref-pin