[dezgit2025]

Phase 0 security hardening for the GitHub Actions workflows.

Changes

Area	Before	After
GITHUB_TOKEN (test.yml)	inherited default	explicit contents: read
GITHUB_TOKEN (publish.yml)	contents: write + id-token: write for every job, including the reused test job	contents: read by default; id-token: write only in publish, contents: write only in github-release
Action pins	tags/branches (checkout@v4/v6, setup-python@v5/v6, pypi-publish@release/v1)	full commit SHAs with version comments: checkout v7.0.1, setup-python v7.0.0, pypi-publish v1.14.2
Checkout credentials	persisted in .git/config	persist-credentials: false everywhere
Release step	${{ github.ref_name }} expanded into the shell	passed via env: TAG
Secret scanning in CI	none	new Secrets / gitleaks job: pinned v8.30.1 binary verified against a checksum stored in the workflow, --redact, PR commits only on pull requests, full history on pushes
Local	—	optional gitleaks pre-commit hook documented in CONTRIBUTING.md

Supersedes Dependabot #26 and #28 (same actions bumped to v7 by tag; this pins by SHA, and Dependabot keeps SHA pins and their comments current).

Verification

• actionlint: clean. zizmor: 0 high/medium/low (one help-level style hint about the self-repository uses: syntax).
• Pins resolved through both the GitHub API and git ls-remote; the annotated pypi-publish tag is dereferenced to its commit.
• gitleaks job command, known-bad test: a scratch repo with a planted fake AWS key exits 1, and the output shows only REDACTED; a clean range exits 0.
• Pre-commit hook: a commit with a planted key is refused; a clean commit passes. This PR's own commit went through the hook.
• Publish path: per-job permissions match PyPI trusted publishing (id-token: write on the job that publishes). Full proof comes with the next tag.