fix: pin 6 unpinned action(s),extract 1 unsafe expression(s) to env vars

Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard).

Changes:
 .github/workflows/build.yml            | 2 +-
 .github/workflows/devcontainer_ci.yml  | 2 +-
 .github/workflows/directory_writer.yml | 4 +++-
 .github/workflows/project_euler.yml    | 4 ++--
 .github/workflows/ruff.yml             | 2 +-
 .github/workflows/sphinx.yml           | 2 +-
 6 files changed, 9 insertions(+), 7 deletions(-)

Author: dagecko

.github/workflows/build.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - run: sudo apt-get update && sudo apt-get install -y libhdf5-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock

.github/workflows/devcontainer_ci.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: devcontainers/ci@v0.3
+      - uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 # v0.3
         with:
           push: never
           runCmd: "true"

.github/workflows/directory_writer.yml

@@ -18,7 +18,9 @@ jobs:
           scripts/build_directory_md.py 2>&1 | tee DIRECTORY.md
           git config --global user.name "$GITHUB_ACTOR"
           git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY
+          git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/$GITHUB_REPOSITORY
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Update DIRECTORY.md
         run: |
           git add DIRECTORY.md

.github/workflows/project_euler.yml

@@ -22,7 +22,7 @@ jobs:
           libhdf5-dev
           libopenblas-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - uses: actions/setup-python@v6
         with:
           python-version: 3.14
@@ -40,7 +40,7 @@ jobs:
           libhdf5-dev
           libopenblas-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - uses: actions/setup-python@v6
         with:
           python-version: 3.14

.github/workflows/ruff.yml

@@ -12,5 +12,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - run: uvx ruff check --output-format=github .

.github/workflows/sphinx.yml

@@ -33,7 +33,7 @@ jobs:
           libhdf5-dev
           libopenblas-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - uses: actions/setup-python@v6
         with:
           python-version: 3.14