[Abhayindia]

Fixes #1139.

All 24 uses: lines across the 7 workflows referred to a tag or a branch. They now refer to the commit that ref points to today, so a moved or retagged ref can no longer change what runs.

Action	Was	Pinned commit
actions/checkout	v6	d23441a48e516b6c34aea4fa41551a30e30af803
actions/setup-python	v6	ece7cb06caefa5fff74198d8649806c4678c61a1
actions/upload-artifact	v4	ea165f8d65b6e75b540449e92b4886f43607fa02
actions/download-artifact	v4	d3f86a106a0bac45b974a628896c90dbdf5c8093
astral-sh/setup-uv	v7	37802adc94f370d6bfd71619e3f0bf239e1f3b78
codecov/codecov-action	v4	b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
marocchino/sticky-pull-request-comment	v3	5770ad5eb8f42dd2c4f34da00c94c5381e49af88
pypa/gh-action-pypi-publish	release/v1	dc37677b2e1c63e2034f94d8a5b11f265b73ba33

Two of these were branches, not tags, so they could move at any time: pypa/gh-action-pypi-publish@release/v1, which is the PyPI publish step and currently matches the release/v1.14 branch, and marocchino/sticky-pull-request-comment@v3, currently the same commit as v3.0.5.

Checked: every workflow file still parses as YAML, every SHA exists in its own repository, and no uses: line is left unpinned. The pull_request workflows run on this PR and exercise the new pins. pythonpublish.yml and type_completeness_comment.yml do not run from a PR, so those two are only exercised the next time they trigger.

I did not add a version comment next to each SHA; say if you want them.

[github-actions]

Pyright Type Completeness

View the full pyright --verifytypes output for this commit

Project (full chainladder package, at this PR's head): 16.1% of exported symbols fully typed (247 / 1532)

	Known	Ambiguous	Unknown	Total
Project (head)	247	106	1179	1532

Other symbols referenced but not exported by chainladder: 13

	Known	Ambiguous	Unknown	Total
Other (head)	3	1	9	13

Symbols without documentation:

• Functions without docstring: 340
• Functions without default param: 0
• Classes without docstring: 8

Patch (exported symbols added or changed by this PR): no exported symbol type-completeness changes detected.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.36%. Comparing base (2ea53be) to head (9243f01).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1497   +/-   ##
=======================================
  Coverage   94.36%   94.36%           
=======================================
  Files          97       97           
  Lines        6198     6198           
  Branches      798      798           
=======================================
  Hits         5849     5849           
  Misses        225      225           
  Partials      124      124           

Flag	Coverage Δ
unittests	94.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[genedan]

Could you do me a favor and add the file .github/dependabot.yml?

  version: 2
  updates:
    - package-ecosystem: "github-actions"
      directory: "/"
      schedule:
        interval: "weekly"

This will tell dependabot to update the workflows regularly.