ci: harden GitHub Actions workflows against Scorecard and CodeQL alerts

.gitattributes

@@ -4,4 +4,7 @@
 * text eol=lf
 
 # Binary files should not be processed as text
-*.png binary
+*.png binary
+
+# Hash-locked CI requirements, compiled by uv. GitHub collapses them in diffs.
+.github/requirements/*.txt linguist-generated=true

.github/dependabot.yml

@@ -12,4 +12,11 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "weekly"
+  - package-ecosystem: "uv"
+    directory: "/.github/requirements"
+    schedule:
+      interval: "weekly"
+    groups:
+      workflow-tools:
+        patterns: ["*"]

.github/requirements/bump-version.in

@@ -0,0 +1,2 @@
+qbraid-core>=0.1.17
+pyyaml

.github/requirements/lab-env-tools.in

@@ -0,0 +1,3 @@
+# qbraid-core does the upload path rewriting and the publish calls.
+qbraid-cli[envs]==0.16.10
+qbraid-core[environments]==0.6.27

.github/requirements/tox.in

@@ -0,0 +1 @@
+tox>=4.2.0

.github/workflows/bump-version.yml

@@ -13,6 +13,8 @@ on:
           - patch
         default: 'patch'
 
+permissions: {}
+
 jobs:
   bump-version:
     runs-on: ubuntu-latest
@@ -21,22 +23,21 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: 'main'
 
       - name: Create feature branch
         run: git checkout -b qbraid-bot/${{ github.run_id }}
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.11'
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install "qbraid-core>=0.1.17" pyyaml
+          python -m pip install --require-hashes -r .github/requirements/bump-version.txt
 
       - name: Setup Git config
         run: |

.github/workflows/docs.yml

@@ -6,21 +6,23 @@ on:
     types: [opened, reopened, ready_for_review, synchronize]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: '3.11'
         cache: pip
     - name: Install dependencies
       run: |
-        python3 -m pip install --upgrade pip
         python3 -m pip install -e '.[docs]'
     - name: Build docs
       run: |

.github/workflows/format.yml

@@ -6,21 +6,23 @@ on:
       types: [opened, reopened, ready_for_review, synchronize]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.11'
       - name: Install dependencies
         run: |
-          python3 -m pip install --upgrade pip
-          python3 -m pip install tox>=4.2.0
+          python3 -m pip install --require-hashes -r .github/requirements/tox.txt
       - name: Check isort, black, mypy, pylint, headers
         run: |
           tox -e format-check

.github/workflows/gh-pages.yml

@@ -22,32 +22,31 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.x'
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install tox>=4.2.0
+          python -m pip install --require-hashes -r .github/requirements/tox.txt
 
       - name: Build Sphinx documentation
         run: tox -e docs
 
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: 'docs/build/html'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
 

.github/workflows/main.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 # Reference: https://github.com/scikit-learn/scikit-learn/blob/main/.github/workflows
 jobs:
   # Wheels published to PyPI are built by release.yml / pre-release.yml, which
@@ -74,10 +77,10 @@ jobs:
 
     steps:
       - name: Checkout PyQASM
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           # cibuildwheel is designed to build wheels for multiple Python versions. 
           # It does this by downloading and using the appropriate Python versions internally, 
@@ -103,7 +106,7 @@ jobs:
       # Used for code coverage later
       - name: Upload built package
         if: ${{ matrix.os == 'macos-14' && matrix.python == 311 }}
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: package-wheel-cp${{ matrix.python }}-${{ matrix.os }}
           path: dist/*.whl
@@ -115,10 +118,10 @@ jobs:
 
     steps:
       - name: Checkout Pyqasm
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
 
@@ -143,28 +146,27 @@ jobs:
             python: 311
             platform_id: macosx_arm64
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: 3.11
           cache: pip
 
       - name: Download built package
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: package-wheel-cp${{ matrix.python }}-${{ matrix.os }}
           path: dist
 
       - name: Install and Test wheel with extras
         run: |
-          pip install setuptools
           bash bin/install_wheel_extras.sh dist --type wheel --extra test --extra cli --extra pulse
           python -m pytest --cov=pyqasm tests/ --cov-report=html --cov-report=xml --cov-report=term
 
       - name: Upload coverage to Codecov
         if: ${{ matrix.python == 311 }}
-        uses: codecov/codecov-action@v7.1.1
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false