Add dependency scanning with pip-audit, and pin third-party actions to commit hashes

.github/workflows/build.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       # Install dependencies, with caching
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -44,13 +44,13 @@ jobs:
           uv sync --all-extras --group test-server
 
       # Start integration test databases
-      - uses: supercharge/mongodb-github-action@1.12.1
+      - uses: supercharge/mongodb-github-action@315db7fe45ac2880b7758f1933e6e5d59afd5e94 # 1.12.1
         with:
           mongodb-version: '5.0'
       - uses: supercharge/redis-github-action@v2
         with:
           redis-version: '6'
-      - uses: rrainn/dynamodb-action@v4.0.0
+      - uses: rrainn/dynamodb-action@36eaff1005b37a22258716d4280f9e0377b834aa # v4.0.0
       - name: Run custom test server
         run: |
           cd test && uv run gunicorn -D -c server/gunicorn-cfg.py server:app
@@ -64,7 +64,7 @@ jobs:
       # Latest python version: send coverage report to codecov
       - name: 'Upload coverage report to Codecov'
         if: ${{ matrix.python-version == env.LATEST_PY_VERSION }}
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
 
   # Run code analysis checks
   analyze:
@@ -74,5 +74,9 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LATEST_PY_VERSION }}
-      - name: Run style checks and linting via pre-commit hooks
-        uses: pre-commit/action@v3.0.0
+      - name: Run style checks & linting
+        uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
+      - name: Scan dependencies for known vulnerabilities
+        uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
+        with:
+          vulnerability-service: osv

.github/workflows/deploy.yml

@@ -22,7 +22,7 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 
       - name: Set pre-release version
         if: ${{ !startsWith(github.ref, 'refs/tags/v') }}

.pre-commit-config.yaml

@@ -8,13 +8,13 @@ repos:
       - id: mixed-line-ending
       - id: trailing-whitespace
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.8
+    rev: v0.15.13
     hooks:
       - id: ruff
         args: [--fix]
       - id: ruff-format
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.20.0
+    rev: v2.1.0
     hooks:
       - id: mypy
         files: aiohttp_client_cache
@@ -24,6 +24,6 @@ repos:
     hooks:
       - id: prettier
   - repo: https://github.com/crate-ci/typos
-    rev: v1.45.0
+    rev: v1.46.1
     hooks:
       - id: typos