eriknw · Nov 9, 2026 · Aug 27, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -4,3 +4,12 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Wait a week after a release before proposing it, so a compromised or
+    # broken release has time to be noticed and yanked.
+    cooldown:
+      default-days: 7
+    # One PR per week for all action bumps instead of one PR per action.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/audit_versions.yml b/.github/workflows/audit_versions.yml
@@ -43,10 +43,10 @@ jobs:
     name: Audit against PyPI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - run: python -m pip install --upgrade pip packaging
@@ -64,10 +64,10 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: conda-incubator/setup-miniconda@be893c923ea9cf1cf7cd510fbdde27c7e18cbdcb # v4.1.0
         with:
           auto-update-conda: true
           python-version: "3.12"

diff --git a/.github/workflows/debug.yml b/.github/workflows/debug.yml
@@ -9,6 +9,9 @@ on:
         required: false
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -26,7 +29,7 @@ jobs:
           # - "conda-forge"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -71,5 +74,5 @@ jobs:
           ( for attr in Matrix Scalar Vector Recorder _agg agg base binary descriptor dtypes exceptions expr ffi formatting infix init io lib mask matrix monoid op operator scalar semiring tests unary vector recorder _ss ss ; do echo python -c \"from graphblas import $attr\" ; if ! python -c "from graphblas import $attr" ; then exit 1 ; fi ; done )
 
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24
         if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.debug_enabled }}
diff --git a/.github/workflows/imports.yml b/.github/workflows/imports.yml
@@ -6,6 +6,14 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+# Cancels a run's identical twin only; see the note in test_and_build.yml.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}-${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   rngs:
     runs-on: ubuntu-latest
@@ -25,7 +33,7 @@ jobs:
       - name: RNG for Python version
         id: pyver
         run: |
-          choices=(3.11 3.12 3.13 3.14)
+          choices=(3.11 3.12 3.13 3.14 3.15)
           selected=${choices[$((RANDOM % ${#choices[@]}))]}
           echo "selected: $selected (from: ${choices[*]})"
           echo "selected=$selected" >> "$GITHUB_OUTPUT"
@@ -35,14 +43,14 @@ jobs:
     # runs-on: ${{ matrix.os }}
     # strategy:
     #   matrix:
-    #     python-version: ["3.11", "3.12", "3.13", "3.14"]
+    #     python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
     #     os: ["ubuntu-latest", "macos-latest", "windows-latest"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ needs.rngs.outputs.pyver }}
           # python-version: ${{ matrix.python-version }}

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -16,11 +16,11 @@ jobs:
     name: pre-commit-hooks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
-      - uses: pre-commit/action@v3.0.1
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
diff --git a/.github/workflows/publish_pypi.yml b/.github/workflows/publish_pypi.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - "20*"
 
+permissions:
+  contents: read
+
 jobs:
   build_and_deploy:
     runs-on: ubuntu-latest
@@ -13,12 +16,12 @@ jobs:
         shell: bash -l {0}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install build dependencies
@@ -27,16 +30,28 @@ jobs:
           python -m pip install build twine
       - name: Build wheel and sdist
         run: python -m build --sdist --wheel
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: releases
           path: dist
           if-no-files-found: error
       - name: Check with twine
         run: python -m twine check --strict dist/*
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.13.0
-        if: startsWith(github.ref, 'refs/tags/') && github.repository == 'python-graphblas/python-graphblas'
+
+  publish:
+    needs: build_and_deploy
+    if: startsWith(github.ref, 'refs/tags/') && github.repository == 'python-graphblas/python-graphblas'
+    runs-on: ubuntu-latest
+    # The trusted publisher registered on PyPI names this environment, which also asks a
+    # maintainer to approve the upload.
+    environment: pypi
+    permissions:
+      # Only this job can mint the OIDC token that PyPI exchanges for upload rights.
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
+          name: releases
+          path: dist
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -0,0 +1,58 @@
+name: Security
+
+# Run the security hooks of .pre-commit-config.yaml, with its versions and arguments, where
+# pre-commit.ci cannot: with network access, and weekly, for advisories published since.
+on:
+  pull_request:
+    paths:
+      - pyproject.toml
+      - .pre-commit-config.yaml
+      - .github/**
+  schedule:
+    # Mondays at 06:41 UTC
+    - cron: "41 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  pysentry:
+    name: pysentry
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+      # Advisories against the floors in pyproject.toml
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        with:
+          extra_args: pysentry --all-files
+
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+      # With a token, zizmor also runs its online audits, such as advisories against the actions
+      # these workflows use (known-vulnerable-actions) and pins to commits outside an action's
+      # repository (impostor-commit).
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        env:
+          GH_TOKEN: ${{ github.token }}
+        with:
+          extra_args: zizmor --all-files