From e676d048e6fa230813143dd95d0bb3d1a8e2ce96 Mon Sep 17 00:00:00 2001
From: Aarni Koskela <akx@iki.fi>
Date: Wed, 9 Sep 2026 10:07:10 +0300
Subject: [PATCH 1/2] Upgrade and pin CI action versions

---
 .github/workflows/lint_python.yml | 4 ++--
 .github/workflows/test.yml        | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/lint_python.yml b/.github/workflows/lint_python.yml
index 0ca9e8da..27f5cdfc 100644
--- a/.github/workflows/lint_python.yml
+++ b/.github/workflows/lint_python.yml
@@ -4,8 +4,8 @@ jobs:
   lint_python:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
       - run: pip install --upgrade pip wheel setuptools
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a8d13822..71d20daa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -43,9 +43,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 

From bc851f92d7e5abc8e281d03a4ba8aa14bb5d0391 Mon Sep 17 00:00:00 2001
From: Aarni Koskela <akx@iki.fi>
Date: Wed, 9 Sep 2026 10:16:17 +0300
Subject: [PATCH 2/2] Use pipx to run lint tools and pin their versions to
 avoid surprises

Also ignore ruff CPY001
---
 .github/workflows/lint_python.yml | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/lint_python.yml b/.github/workflows/lint_python.yml
index 27f5cdfc..d9d82b27 100644
--- a/.github/workflows/lint_python.yml
+++ b/.github/workflows/lint_python.yml
@@ -7,13 +7,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.13'
-      - run: pip install --upgrade pip wheel setuptools
-      - run: pipx run codespell --ignore-words-list="commend"
-      - run: pip install mypy pytest ruff
-      - run: ruff format --check --config "format.quote-style = 'single'"
-      - run: ruff check --output-format=github --select=ALL --ignore=D203,D212,Q000
-      - run: pip install -r requirements.txt || pip install --editable . || true
-      - run: mkdir --parents --verbose .mypy_cache
-      - run: mypy --ignore-missing-imports --install-types --non-interactive .
-      - run: pytest . || pytest --doctest-modules . || true
+          python-version: '3.14'
+      - run: pipx run codespell==2.4.3 --ignore-words-list="commend"
+      - run: pipx run ruff==0.16.6 format --check --config "format.quote-style = 'single'"
+      - run: pipx run ruff==0.16.6 check --output-format=github --select=ALL --ignore=CPY001,D203,D212,Q000
+      - run: pipx run mypy==2.3.1 --ignore-missing-imports --install-types --non-interactive .
+      # - run: pipx run pytest==9.1.1 --doctest-modules .