Backport PR pandas-dev#64396: CI: CI/CD hardening

Author: scottshambaugh

.github/actions/run-tests/action.yml

@@ -7,14 +7,14 @@ runs:
       shell: bash -el {0}
 
     - name: Publish test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
       with:
         name: Test results
         path: test-data.xml
       if: failure()
 
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
       with:
         flags: unittests
         name: codecov-pandas

.github/actions/setup-conda/action.yml

@@ -7,7 +7,7 @@ runs:
   using: composite
   steps:
     - name: Install ${{ inputs.environment-file }}
-      uses: mamba-org/setup-micromamba@v2
+      uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462 # v2
       with:
         environment-file: ${{ inputs.environment-file }}
         environment-name: test

.github/workflows/cache-cleanup-daily.yml

@@ -4,6 +4,8 @@ on:
     # 4:10 UTC daily
     - cron: "10 4 * * *"
 
+permissions: {}
+
 jobs:
   cleanup:
     runs-on: ubuntu-24.04

.github/workflows/cache-cleanup.yml

@@ -4,9 +4,13 @@ on:
     types:
       - closed
 
+permissions: {}
+
 jobs:
   cleanup:
     runs-on: ubuntu-24.04
+    permissions:
+      actions: write
     if: github.repository_owner == 'pandas-dev'
     steps:
       - name: Clean Cache

.github/workflows/code-checks.yml

@@ -14,14 +14,15 @@ env:
   ENV_FILE: environment.yml
   PANDAS_CI: 1
 
-permissions:
-  contents: read
+permissions: {}
 
 # pre-commit run by https://pre-commit.ci/
 jobs:
   docstring_typing_manual_hooks:
     name: Docstring validation, typing, and other manual pre-commit hooks
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash -el {0}
@@ -33,7 +34,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 0
 
@@ -91,7 +92,7 @@ jobs:
       if: ${{ steps.build.outcome == 'success' && always() }}
 
     - name: Typing
-      uses: pre-commit/action@v3.0.1
+      uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
       with:
         extra_args: --verbose --hook-stage manual --all-files
       if: ${{ steps.build.outcome == 'success' && always() }}
@@ -103,6 +104,8 @@ jobs:
   asv-benchmarks:
     name: ASV Benchmarks
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash -el {0}
@@ -114,7 +117,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 0
 
@@ -134,6 +137,8 @@ jobs:
   requirements-dev-text-installable:
     name: Test install requirements-dev.txt
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     concurrency:
       # https://github.community/t/concurrecy-not-work-for-push/183068/7
@@ -142,13 +147,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Setup Python
         id: setup_python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.11'
           cache: 'pip'

.github/workflows/codeql.yml

@@ -8,8 +8,7 @@ concurrency:
   group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   analyze:
@@ -27,9 +26,9 @@ jobs:
           - python
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: github/codeql-action/init@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@v4
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 # v4
+      - uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4

.github/workflows/comment-commands.yml

@@ -3,19 +3,20 @@ on:
   issue_comment:
     types: created
 
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   preview_docs:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     if: github.event.issue.pull_request && github.event.comment.body == '/preview'
     concurrency:
       group: ${{ github.actor }}-preview-docs
     steps:
-      - uses: pandas-dev/github-doc-previewer@v0.3.2
+      - uses: pandas-dev/github-doc-previewer@7a1ea7e96d1a24578ec35eedd4256a7d80c3fef8 # v0.3.2
         with:
           previewer-server: "https://pandas.pydata.org/preview"
           artifact-job: "Doc Build and Upload"

.github/workflows/deprecation-tracking-bot.yml

@@ -10,18 +10,18 @@ on:
       - main
 
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   deprecation_update:
     permissions:
+      contents: read
       issues: write
     runs-on: ubuntu-24.04
     env:
       DEPRECATION_TRACKER_ISSUE: 56596
     steps:
-    - uses: actions/github-script@v8
+    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
       id: update-deprecation-issue
       with:
         script: |

.github/workflows/docbuild-and-upload.yml

@@ -25,15 +25,15 @@ on:
 env:
   ENV_FILE: environment.yml
   PANDAS_CI: 1
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   web_and_docs:
     name: Doc Build and Upload
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     concurrency:
       # https://github.community/t/concurrecy-not-work-for-push/183068/7
@@ -46,23 +46,27 @@ jobs:
 
     steps:
     - name: Set pandas version
+      env:
+        INPUT_VERSION: ${{ github.event.inputs.version }}
+        EVENT_NAME: ${{ github.event_name }}
+        INPUT_PUBLISH_PROD: ${{ github.event.inputs.publish_prod }}
       run: |
         # tags include a `v` prefix.
         tag_version_pat="^v[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$"
         version_pat="^[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$"
 
-        if [[ -n "${{ github.event.inputs.version }}" ]]; then
-          PANDAS_VERSION="${{ github.event.inputs.version }}"
-        elif [[ "${{ github.event_name }}" == "push" && "$GITHUB_REF_NAME" =~ $tag_version_pat ]]; then
+        if [[ -n "$INPUT_VERSION" ]]; then
+          PANDAS_VERSION="$INPUT_VERSION"
+        elif [[ "$EVENT_NAME" == "push" && "$GITHUB_REF_NAME" =~ $tag_version_pat ]]; then
           PANDAS_VERSION="${GITHUB_REF_NAME:1}"
         else
           PANDAS_VERSION=""
         fi
         echo "PANDAS_VERSION=$PANDAS_VERSION" >> "$GITHUB_ENV"
 
-        if [[ "${{ github.event_name }}" == "push" && -n "$PANDAS_VERSION" ]]; then
+        if [[ "$EVENT_NAME" == "push" && -n "$PANDAS_VERSION" ]]; then
           PUBLISH_PROD="true"
-        elif [[ "${{ github.event.inputs.publish_prod }}" == "true" ]]; then
+        elif [[ "$INPUT_PUBLISH_PROD" == "true" ]]; then
           PUBLISH_PROD="true"
         else
           PUBLISH_PROD="false"
@@ -77,7 +81,7 @@ jobs:
         fi
 
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 0
 
@@ -96,6 +100,8 @@ jobs:
 
     - name: Build website
       run: python web/pandas_web.py web/pandas --target-path=web/build
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build documentation
       run: doc/make.py --warnings-are-errors
@@ -134,7 +140,7 @@ jobs:
       run: mv doc/build/html web/build/docs
 
     - name: Save website as an artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
       with:
         name: website
         path: web/build

.github/workflows/package-checks.yml

@@ -11,8 +11,7 @@ on:
       - 3.0.x
     types: [ labeled, opened, synchronize, reopened ]
 
-permissions:
-  contents: read
+permissions: {}
 
 defaults:
   run:
@@ -22,6 +21,8 @@ jobs:
   pip:
     if: ${{ github.event.label.name == 'Build' || contains(github.event.pull_request.labels.*.name, 'Build') || github.event_name == 'push'}}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     strategy:
       matrix:
         extra: ["test", "pyarrow", "performance", "computation", "fss", "aws", "gcp", "excel", "parquet", "feather", "hdf5", "spss", "postgresql", "mysql", "sql-other", "html", "xml", "plot", "output-formatting", "clipboard", "compression", "all"]
@@ -34,13 +35,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Setup Python
         id: setup_python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.11'
 
@@ -51,19 +52,21 @@ jobs:
   conda_forge_recipe:
     if: ${{ github.event.label.name == 'Build' || contains(github.event.pull_request.labels.*.name, 'Build') || github.event_name == 'push'}}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     name: Test Conda Forge Recipe
     concurrency:
       # https://github.community/t/concurrecy-not-work-for-push/183068/7
       group: ${{ github.event_name == 'push' && github.run_number || github.ref }}-conda-forge-recipe
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: mamba-org/setup-micromamba@v2
+        uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462 # v2
         with:
           environment-name: recipe-test
           create-args: >-