ci: relocate Codecov config, pin actions, add concurrency

.github/workflows/auto-assign.yml

@@ -6,7 +6,8 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: bubkoo/auto-assign@master
+      # pin to current stable major tag instead of @master.
+      - uses: bubkoo/auto-assign@v3
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CONFIG_FILE: .github/auto-assign.yml

.github/workflows/linters.yml

@@ -11,24 +11,31 @@ on:
       - "requirements*"
       - ".pylintrc"
 
+# cancel superseded runs on the same PR/ref.
+concurrency:
+  group: linters-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.10"]
     steps:
-    - uses: actions/checkout@main
+    # pin to current stable major tags instead of @main.
+    - uses: actions/checkout@v7
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@main
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install .[all]
         pip install .[tests]
-        pip install pylint ruff
+        # pin ruff for reproducible lint results (verified latest 2026-06-27).
+        pip install pylint "ruff==0.15.20"
     - name: Ruff (lint)
       run: ruff check --output-format=github .
     - name: Ruff (format)

.github/workflows/publish-to-pypi.yml

@@ -15,9 +15,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@main
+      # pin to current stable major tags instead of @main / @master.
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@main
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
       - name: Install dependencies
@@ -27,7 +28,7 @@ jobs:
       - name: Build package
         run: python -m build
       - name: Publish package
-        uses: pypa/gh-action-pypi-publish@master
+        uses: pypa/gh-action-pypi-publish@v1.14.0
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/test-pytest-slow.yaml

@@ -26,9 +26,10 @@ jobs:
       PYTHON: ${{ matrix.python-version }}
       MPLBACKEND: Agg
     steps:
-      - uses: actions/checkout@main
+      # pin to current stable major tags instead of @main.
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@main
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/test_pytest.yaml

@@ -9,6 +9,11 @@ on:
       - "pyproject.toml"
       - "requirements*"
 
+# cancel superseded runs on the same PR/ref to save runner minutes.
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 defaults:
   run:
     shell: bash
@@ -25,9 +30,10 @@ jobs:
       PYTHON: ${{ matrix.python-version }}
       MPLBACKEND: Agg
     steps:
-      - uses: actions/checkout@main
+      # pin to current stable major tags instead of @main.
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@main
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
@@ -62,7 +68,7 @@ jobs:
         run: pytest tests/acceptance --cov=rocketpy --cov-append --cov-report=xml
 
       - name: Upload coverage to artifacts
-        uses: actions/upload-artifact@main
+        uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: coverage.xml
@@ -73,11 +79,11 @@ jobs:
     needs: Pytest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@v7
       - name: Download latest coverage report
-        uses: actions/download-artifact@main
+        uses: actions/download-artifact@v8
       - name: Upload to Codecov
-        uses: codecov/codecov-action@main
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: |

.github/workflows/upload-to-codecov.yml

@@ -18,7 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@main
+        # pin to current stable major tag instead of @main.
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ inputs.codecov_token }}
           directory: ./coverage/reports/