# kind  name                     immutable pin                                                     resolved version  pinned       rationale
action  actions/checkout         3d3c42e5aac5ba805825da76410c181273ba90b1                              v7.0.1            2026-08-14   baseline pin (#59)
action  actions/setup-python     5fda3b95a4ea91299a34e894583c3862153e4b97                              v7.0.0            2026-08-14   baseline pin (#59)
action  actions/upload-artifact  043fb46d1a93c77aae656e7c1c64a875d1fc6a0a                              v7.0.1            2026-08-14   test/package evidence (#64, #65)
action  actions/download-artifact 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c                              v8.0.1            2026-03-11   immutable release-set reuse (#142)
action  actions/attest           1e69f48acb82d1966a394da916b4c1698aa569d6                              v4.2.2            2026-08-04   SLSA provenance and SBOM attestations (#142)
tool    rhysd/actionlint          sha256:8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  v1.7.12           2026-08-14   workflow syntax/policy gate (#65)
tool    astral-sh/uv              pypi:0.12.4                                                        v0.12.4           2026-08-14   locked dependency and SBOM engine (#66)
tool    gitleaks/gitleaks         sha256:551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  v8.30.1           2026-08-14   redacted checkout secret scan (#66)
