Set explicit workflow permissions and pin down actions #494

	name: Python CI

	on:
	workflow_dispatch:
	pull_request:
	push:
	branches:
	- main

	jobs:
	lint-and-mypy:
	name: Lint & mypy
	runs-on: ubuntu-24.04
	permissions:
	contents: read
	timeout-minutes: 5
	steps:
	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false # do not keep the token around

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: 3.9

	- name: Install
	run: \|
	pip install -e .[lint]

	- name: Validate
	run: \|
	isort --check-only src/ tests/
	black --check --line-length 100 src/ tests/
	mypy

	build-and-test:
	name: Test & build (py${{ matrix.python-version }} on ${{ matrix.os }})
	runs-on: ${{ matrix.os }}
	timeout-minutes: 10
	strategy:
	matrix:
	os: [ubuntu-latest, windows-latest, macos-latest]
	python-version:
	- "3.14"
	- "3.13"
	- "3.12"
	- "3.11"
	- "3.10"
	- "3.9"

	steps:
	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	submodules: recursive
	persist-credentials: false # do not keep the token around

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install
	run: \|
	pip install -e .[test]
	pip install -e .[build]

	- name: Test
	run: py.test -vvs --ignore=spec/

	- name: Build
	run: python setup.py build sdist bdist_wheel

Provide feedback