chore(ci): SHA-pin third-party actions, add uv Dependabot coverage

.github/dependabot.yml

@@ -1,9 +1,44 @@
 version: 2
+
 updates:
+  # Python — uv dependencies in pyproject.toml and uv.lock
+  - package-ecosystem: 'uv'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    labels:
+      - 'dependencies'
+    # No groups: the runtime dependency set is small and the packages are
+    # unrelated to each other (httpx, pydantic, attrs, typing-extensions), so
+    # there is no version-coupled family to keep in lockstep the way the
+    # robosystems backend has to for opentelemetry, dagster and dbt.
+    # Majors on the runtime deps land on consumers of the published package,
+    # so they are left ungrouped for individual triage.
+
   # GitHub Actions — pinned action versions
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'monthly'
     labels:
       - 'dependencies'
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
+    ignore:
+      # Held across the fleet: the robosystems backend pins v8.3.2 and ignores
+      # majors because v9 flipped `prune-cache` to false and would grow its uv
+      # cache. This repo sits on v9.0.0 and stays there — it is pinned by SHA
+      # now, and neither v9's nor v10's breaking change actually bites here
+      # (no workflow triggers on release, pull_request_target or workflow_run,
+      # which is the only surface v10's cache guard touches). Downgrading to
+      # match the backend's exact pin would be churn for no security gain, so
+      # what is shared is the rule, not the version. Drop this entry when the
+      # backend takes a setup-uv major, and move in step with it.
+      - dependency-name: 'astral-sh/setup-uv'
+        update-types:
+          - 'version-update:semver-major'

.github/workflows/claude.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/create-release.yml

@@ -37,7 +37,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Get current version
         id: current-version

.github/workflows/publish.yml

@@ -59,6 +59,6 @@ jobs:
 
       - name: Publish to PyPI
         if: steps.check-pypi.outputs.version_exists == 'false'
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           verbose: true

.github/workflows/tag-release.yml

@@ -326,7 +326,7 @@ jobs:
       - name: Create GitHub Release
         if: steps.check-tag.outputs.tag_exists == 'false'
         id: create-release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           tag_name: v${{ steps.get-version.outputs.version }}
           name: Release v${{ steps.get-version.outputs.version }}

.github/workflows/test.yml

@@ -22,7 +22,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install dependencies
         run: |