ci: align security workflow python pin

Assisted-by: Codex (model: GPT-5, autonomous)

Author: PascalThuet

.github/workflows/security.yml

@@ -27,7 +27,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
 
@@ -58,7 +58,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
 

tests/test_security_workflow.py

@@ -182,6 +182,30 @@ def test_actions_are_pinned_to_full_commit_shas(self):
             assert re.search(r"@[0-9a-f]{40}$", uses_ref), uses_ref
             assert re.search(r"@v\d+", uses_ref) is None
 
+    def test_setup_python_pin_matches_repo_standard(self):
+        workflow = _load_security_workflow()
+        security_refs = {
+            step["uses"]
+            for job in workflow["jobs"].values()
+            for step in job["steps"]
+            if step.get("uses", "").startswith("actions/setup-python@")
+        }
+        repo_standard_refs = set()
+        for workflow_path in (
+            REPO_ROOT / ".github" / "workflows" / "test.yml",
+            REPO_ROOT / ".github" / "workflows" / "publish-pypi.yml",
+        ):
+            workflow_data = yaml.safe_load(workflow_path.read_text(encoding="utf-8"))
+            repo_standard_refs.update(
+                step["uses"]
+                for job in workflow_data["jobs"].values()
+                for step in job["steps"]
+                if step.get("uses", "").startswith("actions/setup-python@")
+            )
+
+        assert len(repo_standard_refs) == 1
+        assert security_refs == repo_standard_refs
+
     def test_committed_audit_requirements_are_hashed(self):
         requirements = SECURITY_REQUIREMENTS.read_text(encoding="utf-8")