Hash-pin github actions versions

[sirosen]

Applied by gha-update (with failing items with no tags commented out).

Contributor checklist

• Included tests for the changes.
• A change note is created in changelog.d/ (see changelog.d/README.md
  for instructions) or the PR text says "no changelog needed".

Maintainer checklist

• If no changelog is needed, apply the bot:chronographer:skip label.
• Assign the PR to an existing or new milestone for the target version
  (following Semantic Versioning).

[sirosen]

I'm dismissing the code-scanning alerts.

At first, I couldn't understand why these (known!) issues were being marked as part of this PR, but I got a pointer from @ichard26 (thanks again!) to this:
https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning#source-file-locations

So it looks like I'm just editing too close to where the SARIF findings are demarcated.

Obviously I want to fix all of these, but one thing at a time.

[webknjaz]

Is it possible to use two-space indents?

[sirosen]

You mean, invent the list item, starting at the -? I would like to. I'm slowly trying to apply that style to every YAML file I interact with.

But I don't think we want it in this PR.

[webknjaz]

I meant

Suggested change

	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

[webknjaz]

As for the list items, I actually prefer no additional indentation in that place. This is the style I'm using everywhere: https://github.com/cherrypy/cheroot/blob/2ffb0baf8aa480da9da8d522b3fd7eab271f6dba/.yamllint

[sirosen]

Ah, gotcha, two spaces for the comments. Yeah, I'll amend.

As for the indent-sequences: false rule, we should probably add yamllint here. I don't feel very strongly about it, but I'm likely to use the other style if it's not enforced.

[sirosen]

Done in the course of a rebase.

[webknjaz]

As for the indent-sequences: false rule, we should probably add yamllint here.

Yes, and a copy of that config. It just so happened that I kept postponing it, focusing on other stuff. But feel free to sync both yamllint config + pre-commit config from Cheroot in a standalone patch.

[webknjaz]

A few PyPy jobs seem to need another minute to be able to complete: https://github.com/jazzband/pip-tools/actions/runs/24464328233

[sirosen]

I'd like to give them a much more generous margin, if they're running into the limits, since CI runtimes aren't very stable. I'll prep a PR right away -- I've got a few minutes in the middle of my day right now. 😁

[sirosen]

PR for a more generous timeout visible here.

[webknjaz]

Alright.. This got in on the retry. We'll get higher timeouts merged in next thing.