ci: pin GitHub Actions and PyPI build tooling versions

.github/workflows/build-test.yml

@@ -3,6 +3,10 @@
 
 name: Build and Test 
 
+# All action refs (uses:) in this repository must be pinned to full commit
+# SHAs, never mutable tags or branches, so CI and release runs are
+# reproducible.
+
 on:
   push:
     branches: [ "main", "release/*" ]
@@ -28,9 +32,9 @@ jobs:
           - "3.14"
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Set up ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies

.github/workflows/check-codegen.yml

@@ -4,6 +4,10 @@
 
 name: Check Codegen
 
+# All action refs (uses:) in this repository must be pinned to full commit
+# SHAs, never mutable tags or branches, so CI and release runs are
+# reproducible.
+
 on:
   push:
     branches: [ "main" ]
@@ -24,9 +28,9 @@ jobs:
   check-codegen:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Set up Python
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
       with:
         python-version: "3.11"
     - name: Run codegen script

.github/workflows/check-vendor.yml

@@ -4,6 +4,10 @@
 
 name: Check OTLP Proto Common Vendored Code
 
+# All action refs (uses:) in this repository must be pinned to full commit
+# SHAs, never mutable tags or branches, so CI and release runs are
+# reproducible.
+
 on:
   push:
     branches: [ "main" ]
@@ -22,7 +26,7 @@ jobs:
   check-codegen:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Run vendor script
       run: |
         rm -rf src/snowflake/telemetry/_internal/opentelemetry/exporter/

.github/workflows/python-publish.yml

@@ -8,6 +8,10 @@
 
 name: Upload Python Package
 
+# All action refs (uses:) in this repository must be pinned to full commit
+# SHAs, never mutable tags or branches, so CI and release runs are
+# reproducible.
+
 on:
   release:
     types: [published]
@@ -21,19 +25,26 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Python
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
       with:
         python-version: '3.x'
     - name: Install dependencies
+      # Pin the build toolchain so release builds are reproducible.
+      # Bump deliberately.
       run: |
-        python -m pip install --upgrade pip
-        pip install build
+        python -m pip install pip==26.2.1
+        pip install build==1.6.1
     - name: Build package
       run: python -m build
+    - name: Record artifact digests
+      # Bind the built artifacts to SHA-256 digests in the release log, so
+      # the published files can later be compared against what this job
+      # actually produced. Fails the release if the build produced nothing.
+      run: sha256sum dist/*
     - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
       with:
         user: __token__
         password: ${{ secrets.PYPI_API_TOKEN }}