From f2c602577cfa3c707937560a70160c1d85167366 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 14:56:29 -0400
Subject: [PATCH 01/11] Restrict permissions

---
 .github/workflows/pre-commit-ci.yml                        | 7 ++++++-
 .github/workflows/smoke-test.yml                           | 2 ++
 .github/workflows/testing-and-coverage.yml                 | 2 ++
 .../.github/workflows/pre-commit-ci.yml.jinja              | 7 ++++++-
 .../.github/workflows/publish-to-pypi.yml.jinja            | 2 ++
 .../.github/workflows/smoke-test.yml.jinja                 | 6 ++++++
 .../.github/workflows/testing-and-coverage.yml.jinja       | 7 +++++++
 ...% if include_benchmarks %}asv-main.yml{% endif %}.jinja | 3 +++
 ...f include_benchmarks %}asv-nightly.yml{% endif %}.jinja | 7 ++++++-
 .../{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja | 6 ++++++
 ...benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja | 5 +++++
 ...include_docs %}build-documentation.yml{% endif %}.jinja | 7 ++++++-
 12 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pre-commit-ci.yml b/.github/workflows/pre-commit-ci.yml
index b588686..d40dec9 100644
--- a/.github/workflows/pre-commit-ci.yml
+++ b/.github/workflows/pre-commit-ci.yml
@@ -10,13 +10,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   pre-commit-ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v7
       with:
-        fetch-depth: 0 
+        fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v7
       with:
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index 2bbeb66..628b903 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -14,6 +14,8 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
 
diff --git a/.github/workflows/testing-and-coverage.yml b/.github/workflows/testing-and-coverage.yml
index 1887834..c4b0e85 100644
--- a/.github/workflows/testing-and-coverage.yml
+++ b/.github/workflows/testing-and-coverage.yml
@@ -10,6 +10,8 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   build:
 
diff --git a/python-project-template/.github/workflows/pre-commit-ci.yml.jinja b/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
index 2cf53cc..6deb35f 100644
--- a/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
+++ b/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
@@ -10,13 +10,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   pre-commit-ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v7
       with:
-        fetch-depth: 0 
+        fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v7
       with:
diff --git a/python-project-template/.github/workflows/publish-to-pypi.yml.jinja b/python-project-template/.github/workflows/publish-to-pypi.yml.jinja
index 33182c7..e6e34e9 100644
--- a/python-project-template/.github/workflows/publish-to-pypi.yml.jinja
+++ b/python-project-template/.github/workflows/publish-to-pypi.yml.jinja
@@ -13,6 +13,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 permissions:
   contents: read
 
diff --git a/python-project-template/.github/workflows/smoke-test.yml.jinja b/python-project-template/.github/workflows/smoke-test.yml.jinja
index d68de64..4723f81 100644
--- a/python-project-template/.github/workflows/smoke-test.yml.jinja
+++ b/python-project-template/.github/workflows/smoke-test.yml.jinja
@@ -14,16 +14,22 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: {{ python_versions }}
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
       uses: actions/setup-python@v7
       with:
diff --git a/python-project-template/.github/workflows/testing-and-coverage.yml.jinja b/python-project-template/.github/workflows/testing-and-coverage.yml.jinja
index 9f4e457..88e6c89 100644
--- a/python-project-template/.github/workflows/testing-and-coverage.yml.jinja
+++ b/python-project-template/.github/workflows/testing-and-coverage.yml.jinja
@@ -10,16 +10,22 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: {{ python_versions }}
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
       uses: actions/setup-python@v7
       with:
@@ -35,6 +41,7 @@ jobs:
       run: |
         python -m pytest -o log_cli=true -vv --cov={{package_name}} --cov-report=xml
     - name: Upload coverage report to codecov
+      if: github.event_name == 'push'
       uses: codecov/codecov-action@v7
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja
index 26e5621..cca0db7 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
@@ -8,6 +8,8 @@ on:
   push:
     branches: [ main ]
 
+permissions: {}
+
 env:
 {%- endraw %}
 {%- import 'python-versions.jinja' as py%}
@@ -37,6 +39,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Install dependencies
       run: pip install asv[virtualenv]==${{env.ASV_VERSION}}
     - name: Configure git
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja
index 5bd531b..dbf665f 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
@@ -8,7 +8,9 @@ on:
   schedule:
     - cron: 45 6 * * *
   workflow_dispatch:
-  
+
+permissions: {}
+
 env:
 {%- endraw %}
 {%- import 'python-versions.jinja' as py%}
@@ -21,6 +23,8 @@ env:
 jobs:
   asv-nightly:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ${{env.WORKING_DIR}}
@@ -33,6 +37,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Install dependencies
       run: pip install asv[virtualenv]==${{env.ASV_VERSION}}
     - name: Configure git
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja
index d8d9d62..e7a53e3 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja	
@@ -11,6 +11,8 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: ${{github.workflow}}-${{github.ref}}
   cancel-in-progress: true
@@ -27,6 +29,9 @@ env:
 jobs:
   asv-pr:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     defaults:
       run:
         working-directory: ${{env.WORKING_DIR}}
@@ -39,6 +44,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Display Workflow Run Information
       run: |
         echo "Workflow Run ID: ${{github.run_id}}"
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja
index 26cb298..99665c5 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
@@ -10,9 +10,14 @@ on:
     workflows: ["Run benchmarks for PR"]
     types: [completed]
 
+permissions: {}
+
 jobs:
   upload-pr-comment:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
diff --git a/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja
index ecff501..c1992c8 100644
--- a/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja	
@@ -10,17 +10,22 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 concurrency:
   group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
   cancel-in-progress: true
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {{ py.pref(python_versions) }}
       uses: actions/setup-python@v7
       with:

From ad94fbf2c13dd823e996496daebace00737cd0f6 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:31:16 -0400
Subject: [PATCH 02/11] Copilot suggested fixes

Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
---
 ...% if contains_code %}publish-to-pypi.yml{% endif %}.jinja | 2 --
 ...contains_code %}testing-and-coverage.yml{% endif %}.jinja | 1 -
 ...e_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja | 5 ++---
 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja
index e6e34e9..33182c7 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
@@ -13,8 +13,6 @@ on:
   release:
     types: [published]
 
-permissions: {}
-
 permissions:
   contents: read
 
diff --git a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja
index 88e6c89..cf7c643 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
@@ -41,7 +41,6 @@ jobs:
       run: |
         python -m pytest -o log_cli=true -vv --cov={{package_name}} --cov-report=xml
     - name: Upload coverage report to codecov
-      if: github.event_name == 'push'
       uses: codecov/codecov-action@v7
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja
index 99665c5..6bd5a6a 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
@@ -15,13 +15,12 @@ permissions: {}
 jobs:
   upload-pr-comment:
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
+      contents: read
       issues: write
       pull-requests: write
     steps:

From 1820d0de5b94ffb7136af573b692f5611d12fcc4 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:36:28 -0400
Subject: [PATCH 03/11] Update {% if include_benchmarks
 %}publish-benchmarks-pr.yml{% endif %}.jinja

Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
---
 ...clude_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja | 1 -
 1 file changed, 1 deletion(-)

diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja
index 6bd5a6a..61130bb 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
@@ -20,7 +20,6 @@ jobs:
       github.event.workflow_run.conclusion == 'success'
     permissions:
       actions: read
-      contents: read
       issues: write
       pull-requests: write
     steps:

From 9c668ee22010b6187a5fc382f1b81b2bf39ffb9f Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:38:40 -0400
Subject: [PATCH 04/11] Add permissions for contents read access in workflows

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/smoke-test.yml                               | 3 ++-
 .github/workflows/testing-and-coverage.yml                     | 3 ++-
 ...f contains_code %}testing-and-coverage.yml{% endif %}.jinja | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index 628b903..0dd781e 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -14,7 +14,8 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/testing-and-coverage.yml b/.github/workflows/testing-and-coverage.yml
index c4b0e85..5f4a593 100644
--- a/.github/workflows/testing-and-coverage.yml
+++ b/.github/workflows/testing-and-coverage.yml
@@ -10,7 +10,8 @@ on:
   pull_request:
     branches: [ main ]
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja
index cf7c643..457a2a6 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
@@ -10,7 +10,8 @@ on:
   pull_request:
     branches: [ main ]
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   build:

From f4fdf8a985b2f0456baaa7f72f906d270ea48d29 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:47:37 -0400
Subject: [PATCH 05/11] Copilot suggested fixes

Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
---
 .github/workflows/smoke-test.yml                                | 2 ++
 .github/workflows/testing-and-coverage.yml                      | 1 +
 ...if contains_code %}testing-and-coverage.yml{% endif %}.jinja | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index 628b903..3b63663 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -26,6 +26,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v7
       with:
diff --git a/.github/workflows/testing-and-coverage.yml b/.github/workflows/testing-and-coverage.yml
index c4b0e85..cf7b2c1 100644
--- a/.github/workflows/testing-and-coverage.yml
+++ b/.github/workflows/testing-and-coverage.yml
@@ -24,6 +24,7 @@ jobs:
     - uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v7
       with:
diff --git a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja
index cf7c643..abf6830 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
@@ -49,6 +49,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {{ py.min(python_versions)  }}
       uses: actions/setup-python@v7
       with:

From d7080ff2244682a6ed72a9211090cba5c62517ea Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:53:40 -0400
Subject: [PATCH 06/11] Update add-issue-to-project.yml

Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
---
 .github/workflows/add-issue-to-project.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/add-issue-to-project.yml b/.github/workflows/add-issue-to-project.yml
index b0a7501..bc4e0bb 100644
--- a/.github/workflows/add-issue-to-project.yml
+++ b/.github/workflows/add-issue-to-project.yml
@@ -5,6 +5,8 @@ on:
     types:
       - opened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add issue to project

From c2eb205e3670606d13d41207bf34b95ed3fd3929 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:00:17 -0400
Subject: [PATCH 07/11] Update {% if contains_code %}publish-to-pypi.yml{%
 endif %}.jinja

Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
---
 .../{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja
index 33182c7..55c7845 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
@@ -24,6 +24,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v7
       with:

From 0c0fff3ddcddac0afce018dc3ba6c1ad8f8f64d2 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:13:44 -0400
Subject: [PATCH 08/11] Fix a problem with removing permissions

After `persist-credentials: false` the `git ls-remote` would fail. This switches to using show-ref and using the local repositort

Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
---
 .../{% if include_benchmarks %}asv-main.yml{% endif %}.jinja    | 2 +-
 .../{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja
index cca0db7..f89d027 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
@@ -50,7 +50,7 @@ jobs:
       run: asv machine --machine gh-runner --yes
     - name: Fetch previous results from the "benchmarks" branch
       run: |
-        if git ls-remote --exit-code origin benchmarks > /dev/null 2>&1; then
+        if git show-ref --verify --quiet refs/remotes/origin/benchmarks; then
           git merge origin/benchmarks \
             --allow-unrelated-histories \
             --no-commit
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja
index dbf665f..9a4a8ad 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
@@ -48,7 +48,7 @@ jobs:
       run: asv machine --machine gh-runner --yes
     - name: Fetch previous results from the "benchmarks" branch
       run: |
-        if git ls-remote --exit-code origin benchmarks > /dev/null 2>&1; then
+        if git show-ref --verify --quiet refs/remotes/origin/benchmarks; then
           git merge origin/benchmarks \
             --allow-unrelated-histories \
             --no-commit

From 29ef9c5af01a768a0a6126cf8e51c849755151a1 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Mon, 12 Oct 2026 08:28:38 -0400
Subject: [PATCH 09/11] Switch from versions to full SHA

---
 .github/workflows/add-issue-to-project.yml           |  2 +-
 .github/workflows/pre-commit-ci.yml                  | 10 +++++-----
 .github/workflows/smoke-test.yml                     |  6 +++---
 .github/workflows/testing-and-coverage.yml           |  6 +++---
 .../.github/workflows/pre-commit-ci.yml.jinja        | 10 +++++-----
 ...tains_code %}publish-to-pypi.yml{% endif %}.jinja |  4 ++--
 ...f contains_code %}smoke-test.yml{% endif %}.jinja |  8 ++++----
 ..._code %}testing-and-coverage.yml{% endif %}.jinja | 12 ++++++------
 ...nclude_benchmarks %}asv-main.yml{% endif %}.jinja |  8 ++++----
 ...ude_benchmarks %}asv-nightly.yml{% endif %}.jinja |  8 ++++----
 ... include_benchmarks %}asv-pr.yml{% endif %}.jinja |  8 ++++----
 ...arks %}publish-benchmarks-pr.yml{% endif %}.jinja |  6 +++---
 ...e_docs %}build-documentation.yml{% endif %}.jinja |  6 +++---
 13 files changed, 47 insertions(+), 47 deletions(-)

diff --git a/.github/workflows/add-issue-to-project.yml b/.github/workflows/add-issue-to-project.yml
index bc4e0bb..7e87f13 100644
--- a/.github/workflows/add-issue-to-project.yml
+++ b/.github/workflows/add-issue-to-project.yml
@@ -12,7 +12,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd
         with:
           # You can target a repository in a different organization
           # to the issue
diff --git a/.github/workflows/pre-commit-ci.yml b/.github/workflows/pre-commit-ci.yml
index d40dec9..d9f03ab 100644
--- a/.github/workflows/pre-commit-ci.yml
+++ b/.github/workflows/pre-commit-ci.yml
@@ -18,25 +18,25 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '3.11'
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
         uv pip install --system .[dev]
         if [ -f requirements.txt ]; then uv pip install --system -r requirements.txt; fi
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
       with:
         extra_args: --all-files --verbose
       env:
         SKIP: "check-lincc-frameworks-template-version,no-commit-to-branch,check-added-large-files,validate-pyproject,sphinx-build,pytest-check"
-    - uses: pre-commit-ci/lite-action@v1.2.0
+    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc
       if: failure() && github.event_name == 'pull_request' && github.event.pull_request.draft == false
\ No newline at end of file
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index fee4d64..5974241 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -26,15 +26,15 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
diff --git a/.github/workflows/testing-and-coverage.yml b/.github/workflows/testing-and-coverage.yml
index d4c7e19..97d1684 100644
--- a/.github/workflows/testing-and-coverage.yml
+++ b/.github/workflows/testing-and-coverage.yml
@@ -22,16 +22,16 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
diff --git a/python-project-template/.github/workflows/pre-commit-ci.yml.jinja b/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
index 6deb35f..a6cbfc0 100644
--- a/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
+++ b/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
@@ -18,25 +18,25 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
         uv pip install --system .[dev]
         if [ -f requirements.txt ]; then uv pip install --system -r requirements.txt; fi
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
       with:
         extra_args: --all-files --verbose
       env:
         SKIP: "check-lincc-frameworks-template-version,no-commit-to-branch,check-added-large-files,validate-pyproject,sphinx-build,pytest-check"
-    - uses: pre-commit-ci/lite-action@v1.2.0
+    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc
       if: failure() && github.event_name == 'pull_request' && github.event.pull_request.draft == false
\ No newline at end of file
diff --git a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja
index 55c7845..9113cd2 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
@@ -23,11 +23,11 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install dependencies
diff --git a/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja
index 4723f81..a98d8d1 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja	
@@ -27,15 +27,15 @@ jobs:
         python-version: {{ python_versions }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: {% raw %}${{ matrix.python-version }}{% endraw %}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -50,7 +50,7 @@ jobs:
 {%- if 'email' in failure_notification %}
     - name: Send status to author's email      
       if: {% raw %}${{ failure() }} && github.event_name != 'workflow_dispatch' }}{% endraw %} # Only email if the workflow failed and was not manually started. Customize this as necessary.
-      uses: dawidd6/action-send-mail@v18
+      uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968
       with:
         # Required mail server address if not connection_url:
         server_address: smtp.gmail.com
diff --git a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja
index 8efb13a..69593d7 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
@@ -24,15 +24,15 @@ jobs:
         python-version: {{ python_versions }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: {% raw %}${{ matrix.python-version }}{% endraw %}
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -42,18 +42,18 @@ jobs:
       run: |
         python -m pytest -o log_cli=true -vv --cov={{package_name}} --cov-report=xml
     - name: Upload coverage report to codecov
-      uses: codecov/codecov-action@v7
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 {%- if test_lowest_version != 'none' %}
   test-lowest-versions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {{ py.min(python_versions)  }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.min(python_versions)  }}'
     - name: Install dependencies
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja
index f89d027..9eb94c5 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
@@ -32,11 +32,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout main branch of the repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -59,7 +59,7 @@ jobs:
     - name: Run ASV for the main branch
       run: asv run ALL --skip-existing --verbose || true
     - name: Submit new results to the "benchmarks" branch
-      uses: JamesIves/github-pages-deploy-action@v4
+      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f
       with:
         branch: benchmarks
         folder: ${{env.WORKING_DIR}}/_results
@@ -69,7 +69,7 @@ jobs:
         asv show
         asv publish
     - name: Deploy to Github pages
-      uses: JamesIves/github-pages-deploy-action@v4
+      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f
       with:
         branch: gh-pages
         folder: ${{env.WORKING_DIR}}/_html
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja
index 9a4a8ad..2d264fd 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
@@ -30,11 +30,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout main branch of the repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
         echo "yesterday=$(date -d yesterday +'%Y-%m-%d')" >> $GITHUB_OUTPUT
         echo "today=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
     - name: Use last nightly commit hash from cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: ${{env.WORKING_DIR}}
         key: nightly-results-${{steps.nightly-dates.outputs.yesterday}}
@@ -75,7 +75,7 @@ jobs:
         fi
         echo $CURRENT_HASH > $HASH_FILE
     - name: Update last nightly hash in cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: ${{env.WORKING_DIR}}
         key: nightly-results-${{steps.nightly-dates.outputs.today}}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja
index e7a53e3..411a8d6 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja	
@@ -37,11 +37,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout PR branch of the repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -55,7 +55,7 @@ jobs:
     - name: Save pull request number
       run: echo ${{github.event.pull_request.number}} > ${{env.ARTIFACTS_DIR}}/pr
     - name: Get current job logs URL
-      uses: Tiryoh/gha-jobid-action@v1
+      uses: Tiryoh/gha-jobid-action@be260d8673c9211a84cdcf37794ebd654ba81eef
       id: jobs
       with:
         github_token: ${{secrets.GITHUB_TOKEN}}
@@ -74,7 +74,7 @@ jobs:
       env:
         STEP_URL: ${{steps.jobs.outputs.html_url}}#step:10:1
     - name: Upload artifacts (PR number and benchmarks output)
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
       with:
         name: benchmark-artifacts
         path: ${{env.ARTIFACTS_DIR}}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja
index 61130bb..50b5d3c 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
@@ -31,7 +31,7 @@ jobs:
         echo "Conclusion: ${{ github.event.workflow_run.conclusion }}"
         echo "Event: ${{ github.event.workflow_run.event }}"
     - name: Download artifact
-      uses: dawidd6/action-download-artifact@v27
+      uses: dawidd6/action-download-artifact@eab87c9830c39eff17e5a6eadb20bfb4bc880477
       with:
         name: benchmark-artifacts
         run_id: ${{ github.event.workflow_run.id }}
@@ -42,14 +42,14 @@ jobs:
         printf "Output:\n$(cat output)"
         printf "pr=$(cat pr)" >> $GITHUB_OUTPUT
     - name: Find benchmarks comment
-      uses: peter-evans/find-comment@v4
+      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
       id: find-comment
       with:
         issue-number: ${{ steps.pr-info.outputs.pr }}
         comment-author: 'github-actions[bot]'
         body-includes: view all benchmarks
     - name: Create or update benchmarks comment
-      uses: peter-evans/create-or-update-comment@v5
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
       with:
         comment-id: ${{ steps.find-comment.outputs.comment-id }}
         issue-number: ${{ steps.pr-info.outputs.pr }}
diff --git a/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja
index c1992c8..efdb0e8 100644
--- a/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja	
@@ -23,15 +23,15 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
     - name: Set up Python {{ py.pref(python_versions) }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
     - name: Install dependencies
       run: |
         sudo apt-get update

From 7889ef71404663f1d360a21435e5f8d64de7f7d2 Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Mon, 12 Oct 2026 09:25:43 -0400
Subject: [PATCH 10/11] Update more versions

---
 .../{% if contains_code %}smoke-test.yml{% endif %}.jinja     | 2 +-
 .../{% if include_benchmarks %}asv-main.yml{% endif %}.jinja  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja
index a98d8d1..b58bab2 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja	
@@ -87,7 +87,7 @@ jobs:
     - name: Send status to Slack app
       if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
       id: slack
-      uses: slackapi/slack-github-action@v4
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
       with:
         # For posting a rich message using Block Kit
         webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja
index 9eb94c5..7c2d039 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
@@ -59,7 +59,7 @@ jobs:
     - name: Run ASV for the main branch
       run: asv run ALL --skip-existing --verbose || true
     - name: Submit new results to the "benchmarks" branch
-      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445
       with:
         branch: benchmarks
         folder: ${{env.WORKING_DIR}}/_results
@@ -69,7 +69,7 @@ jobs:
         asv show
         asv publish
     - name: Deploy to Github pages
-      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445
       with:
         branch: gh-pages
         folder: ${{env.WORKING_DIR}}/_html

From 7bcee805510d0e4685035c019b70ce62a9c4029e Mon Sep 17 00:00:00 2001
From: Jeremy Kubica <104161096+jeremykubica@users.noreply.github.com>
Date: Mon, 12 Oct 2026 09:29:20 -0400
Subject: [PATCH 11/11] Update smoke-test.yml

---
 .github/workflows/smoke-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index 5974241..66b67ed 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -50,7 +50,7 @@ jobs:
     - name: Send status to Slack app
       if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
       id: slack
-      uses: slackapi/slack-github-action@v4
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
       with:
         webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
         webhook-type: webhook-trigger