# kind  name                     immutable pin                                                     resolved version  pinned       rationale
action  actions/checkout         3d3c42e5aac5ba805825da76410c181273ba90b1                              v7.0.1            2026-08-14   baseline pin (#59)
action  actions/setup-python     5fda3b95a4ea91299a34e894583c3862153e4b97                              v7.0.0            2026-08-14   baseline pin (#59)
action  actions/upload-artifact  043fb46d1a93c77aae656e7c1c64a875d1fc6a0a                              v7.0.1            2026-08-14   test/package evidence (#64, #65)
tool    rhysd/actionlint          sha256:8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  v1.7.12           2026-08-14   workflow syntax/policy gate (#65)
tool    astral-sh/uv              pypi:0.12.4                                                        v0.12.4           2026-08-14   locked dependency and SBOM engine (#66)
tool    gitleaks/gitleaks         sha256:551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  v8.30.1           2026-08-14   redacted checkout secret scan (#66)