SEC/DEP: upgrade GHA dependencies depending on locked version of certify

Author: neutrinoceros

.github/workflows/publish.yml

@@ -213,7 +213,7 @@ jobs:
           SET_ENV_SCRIPT: IyAvLy8gc2NyaXB0CiMgcmVxdWlyZXMtcHl0aG9uID0gIj49My4xMiwgPDMuMTMiCiMgZGVwZW5kZW5jaWVzID0gWwojICAgICAicHl5YW1sPT02LjAuMiIsCiMgXQojIC8vLwppbXBvcnQganNvbgppbXBvcnQgb3MKaW1wb3J0IHN5cwoKaW1wb3J0IHlhbWwKCkdJVEhVQl9FTlYgPSBvcy5nZXRlbnYoIkdJVEhVQl9FTlYiKQppZiBHSVRIVUJfRU5WIGlzIE5vbmU6CiAgICByYWlzZSBWYWx1ZUVycm9yKCJHSVRIVUJfRU5WIG5vdCBzZXQuIE11c3QgYmUgcnVuIGluc2lkZSBHaXRIdWIgQWN0aW9ucy4iKQoKREVMSU1JVEVSID0gIkVPRiIKCgpkZWYgc2V0X2VudihlbnYpOgoKICAgIGVudiA9IHlhbWwubG9hZChlbnYsIExvYWRlcj15YW1sLkJhc2VMb2FkZXIpCiAgICBwcmludChqc29uLmR1bXBzKGVudiwgaW5kZW50PTIpKQoKICAgIGlmIG5vdCBpc2luc3RhbmNlKGVudiwgZGljdCk6CiAgICAgICAgdGl0bGUgPSAiYGVudmAgbXVzdCBiZSBtYXBwaW5nIgogICAgICAgIG1lc3NhZ2UgPSBmImBlbnZgIG11c3QgYmUgbWFwcGluZyBvZiBlbnYgdmFyaWFibGVzIHRvIHZhbHVlcywgZ290IHR5cGUge3R5cGUoZW52KX0iCiAgICAgICAgcHJpbnQoZiI6OmVycm9yIHRpdGxlPXt0aXRsZX06OnttZXNzYWdlfSIpCiAgICAgICAgc3lzLmV4aXQoMSkKCiAgICBmb3IgaywgdiBpbiBlbnYuaXRlbXMoKToKCiAgICAgICAgaWYgbm90IGlzaW5zdGFuY2Uodiwgc3RyKToKICAgICAgICAgICAgdGl0bGUgPSAiYGVudmAgdmFsdWVzIG11c3QgYmUgc3RyaW5ncyIKICAgICAgICAgICAgbWVzc2FnZSA9IGYiYGVudmAgdmFsdWVzIG11c3QgYmUgc3RyaW5ncywgYnV0IHZhbHVlIG9mIHtrfSBoYXMgdHlwZSB7dHlwZSh2KX0iCiAgICAgICAgICAgIHByaW50KGYiOjplcnJvciB0aXRsZT17dGl0bGV9Ojp7bWVzc2FnZX0iKQogICAgICAgICAgICBzeXMuZXhpdCgxKQoKICAgICAgICB2ID0gdi5zcGxpdCgiXG4iKQoKICAgICAgICB3aXRoIG9wZW4oR0lUSFVCX0VOViwgImEiKSBhcyBmOgogICAgICAgICAgICBpZiBsZW4odikgPT0gMToKICAgICAgICAgICAgICAgIGYud3JpdGUoZiJ7a309e3ZbMF19XG4iKQogICAgICAgICAgICBlbHNlOgogICAgICAgICAgICAgICAgZm9yIGxpbmUgaW4gdjoKICAgICAgICAgICAgICAgICAgICBhc3NlcnQgbGluZS5zdHJpcCgpICE9IERFTElNSVRFUgogICAgICAgICAgICAgICAgZi53cml0ZShmIntrfTw8e0RFTElNSVRFUn1cbiIpCiAgICAgICAgICAgICAgICBmb3IgbGluZSBpbiB2OgogICAgICAgICAgICAgICAgICAgIGYud3JpdGUoZiJ7bGluZX1cbiIpCiAgICAgICAgICAgICAgICBmLndyaXRlKGYie0RFTElNSVRFUn1cbiIpCgogICAgICAgIHByaW50KGYie2t9IHdyaXR0ZW4gdG8gR0lUSFVCX0VOViIpCgoKaWYgX19uYW1lX18gPT0gIl9fbWFpbl9fIjoKICAgIHNldF9lbnYoc3lzLmFyZ3ZbMV0pCg==
           INPUTS_ENV: ${{ inputs.env }}
       - name: Run cibuildwheel
-        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1
+        uses: pypa/cibuildwheel@f11181315571b24e4a3c67f1a828532793f2df55 # v4.3.2
         with:
           output-dir: dist
           package-dir: ${{ inputs.working-directory }}
@@ -294,7 +294,7 @@ jobs:
           pattern: dist-*
           path: dist
           merge-multiple: true
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         name: Upload to PyPI
         if: ${{ needs.targets.outputs.upload_to_pypi == 'true' }}
         with:

.github/workflows/publish_pure_python.yml

@@ -157,7 +157,7 @@ jobs:
         with:
           name: "dist-publish-pure"
           path: dist/*
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         name: Upload to PyPI
         if: ${{ steps.set-upload.outputs.upload_to_pypi == 'true' }}
         with:

.github/workflows/test_publish.yml

@@ -82,4 +82,4 @@ jobs:
 
       - name: Run upload (this will fail)
         continue-on-error: true
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

.github/workflows/test_publish_pure_python.yml

@@ -59,4 +59,4 @@ jobs:
 
       - name: Run upload (this will fail)
         continue-on-error: true
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

.github/workflows/tox.yml

@@ -238,7 +238,7 @@ jobs:
           create-args: >-
             conda
             python=${{ matrix.python_version }}
-            uv=0.10.6
+            uv=0.13.4
           init-shell: bash
           cache-environment: true
           cache-downloads: true