[lucarlig]

Summary

• Update GitHub Actions workflow dependencies to latest release tags.
• Replace pinned action SHAs with version tags where a release tag exists.
• Update workflow tests to expect the new action refs.
• Keep macos-latest runner labels unchanged by request.

Updated actions

• actions/checkout@v7.0.0
• actions/setup-python@v6.2.0
• actions/upload-artifact@v7.0.1
• actions/download-artifact@v8.0.1
• pypa/gh-action-pypi-publish@v1.14.0
• codecov/codecov-action@v7.0.0

Why

• Brings direct workflow action references up to current releases.
• Codecov v7.0.0 pulls in a Node 24 github-script runtime and removes the coverage job's Node 20 deprecation warning.

Validation

• python3 -m unittest tests/test_plugin_catalog.py
• python3 -m unittest tests/test_install_built_wheel.py
• ruby YAML parse for all .github/workflows/*.yml and *.yaml files
• git diff --check
• commit hooks: detect secrets and whitespace checks

Notes

• macos-latest migration notices remain because the workflows intentionally continue tracking macos-latest.
• pypa/gh-action-pypi-publish@v1.14.0 still embeds actions/setup-python@v5.6.0 internally, so publish jobs may still show a transitive Node 20 warning until PyPA updates that action.

[msureshkumar88]

Security: action refs regress from SHA-pinning to mutable tags

All 6 workflow files replace pinned commit SHAs with floating version tags:

• actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd → actions/checkout@v7.0.0
• actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 → actions/setup-python@v6.2.0
• actions/upload-artifact@b7c566a... → actions/upload-artifact@v7.0.1
• actions/download-artifact@37930b1... → actions/download-artifact@v8.0.1
• pypa/gh-action-pypi-publish@ed0c539... → pypa/gh-action-pypi-publish@v1.14.0
• codecov/codecov-action@75cd116... → codecov/codecov-action@v7.0.0

Why this is a regression, not just a version bump: the previous refs were pinned to immutable commit SHAs. A tag like v7.0.0 is mutable — the upstream maintainer (or an attacker who compromises their account/token) can repoint it to a different commit after this PR merges, and every subsequent CI run silently pulls that new code with no diff/review on this side. This is exactly the supply-chain attack vector that SHA-pinning closes, and it's what OpenSSF Scorecard's "Pinned-Dependencies" check and GitHub's own Actions hardening guide call out as a requirement, not a nice-to-have. tests/test_plugin_catalog.py was also updated to assert the new tag strings directly, so the test suite now encodes the unpinned refs as the expected state rather than catching the regression.

Requested fix: keep the version bump, but pin back to the commit SHA each tag resolves to, with the human-readable tag as a trailing comment (the standard Dependabot/Renovate convention), e.g.:

- uses: actions/checkout@<sha-for-v7.0.0> # v7.0.0
- uses: actions/setup-python@<sha-for-v6.2.0> # v6.2.0

Same treatment for the other 4 actions and codecov/codecov-action.

Minor (non-blocking)

• pypa/gh-action-pypi-publish@v1.14.0 still transitively pulls actions/setup-python@v5.6.0 (Node 20 warning persists) — PR body already flags this; worth a tracking issue upstream.
• Once SHA-pinning is restored, consider adding a regression test (e.g. regex requiring @[0-9a-f]{40} on all third-party uses: lines) so this can't silently drift again.

Local validation (checked out at PR head 5403be5)

• test_plugin_catalog.py: 109 tests, 1 failure — unrelated to this diff (pii_filter directory-location check, pre-existing repo state)
• test_install_built_wheel.py: 14/14 pass
• YAML parse clean on all .github/workflows/*.y*ml
• git diff --check: no whitespace issues

[lucarlig]

Thanks Suresh. Addressed in af33c62.

• Restored SHA pins for all bumped third-party workflow actions, with the readable release tag kept as a trailing comment.
• Added test_workflow_actions_are_pinned_to_commit_shas so third-party uses: refs must stay pinned to 40-char commit SHAs with a tag comment.

Validation:

• python3 -m unittest tests/test_plugin_catalog.py - 110 tests pass, 3 skipped
• python3 -m unittest tests/test_install_built_wheel.py - 14 tests pass
• Ruby YAML parse for all .github/workflows/*.{yml,yaml} files
• git diff --check
• Commit hooks: merge-conflict, YAML, EOF, line endings, trailing whitespace, detect-secrets

The PyPA transitive actions/setup-python@v5.6.0 note remains an upstream/transitive issue; direct workflow action refs in this PR are pinned again.

[msureshkumar88]

Requested fix confirmed: all 6 third-party action refs back to @<sha> # <tag> pinning. Verified each SHA against GitHub API — all 6 resolve to the claimed tag exactly (checkout→v7.0.0, setup-python→v6.2.0, codecov-action→v7.0.0, upload-artifact→v7.0.1, download-artifact→v8.0.1, gh-action-pypi-publish→v1.14.0). New regression test test_workflow_actions_are_pinned_to_commit_shas added, enforcing @[0-9a-f]{40} # <tag> format on all workflow uses: lines going forward — addresses my non-blocking suggestion from the prior review.

Local validation at PR head af33c62:

• python3 -m unittest tests/test_plugin_catalog.py: 110 tests, 1 pre-existing failure (pii_filter test, unrelated to this diff, present before this PR too)
• python3 -m unittest tests/test_install_built_wheel.py: 14/14 pass
• YAML parse clean on all .github/workflows/*.y*ml
• No new issues introduced by the fix commit

Approving.