fix: improve supply chain protections

Author: Lash-L

.github/workflows/ci.yml

@@ -16,19 +16,29 @@ jobs:
   commitlint:
     name: Lint Commit Messages
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@v6.2.1
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+        with:
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           python-version: "3.11"
-      - uses: pre-commit/action@v3.0.1
+          activate-environment: true
+      - name: Run pre-commit
+        run: uv run --frozen pre-commit run --all-files
 
   test:
     strategy:
@@ -38,33 +48,33 @@ jobs:
           - "3.11"
           - "3.14"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           python-version: ${{ matrix.python-version }}
           activate-environment: true
       - run: uv pip install pip
       - name: Test with Pytest
-        run:  uv run pytest --log-cli-level=DEBUG -vv -s --cov --cov-branch --cov-report=xml
+        run: uv run --frozen pytest --log-cli-level=DEBUG -vv -s --cov --cov-branch --cov-report=xml
         shell: bash
       - name: Upload results to Codecov
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: Python-roborock/python-roborock
 
-
-
   build:
     name: Build Package
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
       - uses: actions/checkout@v6
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           python-version: "3.11"
           activate-environment: true
@@ -76,6 +86,10 @@ jobs:
     name: Test Semantic Release
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v6
         with:

pyproject.toml

@@ -67,6 +67,9 @@ include = ["roborock"]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.uv]
+exclude-newer = "3 days"
+
 [tool.semantic_release]
 branch = "main"
 version_toml = ["pyproject.toml:project.version"]