Harden against supply chain attacks

[twwd]

To protect against supply chain attacks, it would be great if you

1. commit the lockfile (uv.lock) for reproducible dependency resolution,
2. reference GitHub actions with a SHA-pinned version instead of tags, and
3. use a digest or at least a tag for the container image quay.io/fedora/fedora in the CI config.

In addition, use dependabot to keep these up-to-date.

[twwd]

Your GitHub workflow seems a bit strange. You could easily skip the podman installation and directly configure the job to be run inside the fedora container: https://docs.github.com/de/actions/how-tos/write-workflows/choose-where-workflows-run/run-jobs-in-a-container

[gunchev]

Hello and thanks for the suggestions.

1. I don't want to commit uv.lock (see .gitignore) because it will pin the versions and won't let me test with the latest every time (I regularly do make dc). Before each release I also compile as RPM package and test and later use it as package. Also, a 100K file pollutes the diffs quite a lot.
2. Addressed.
3. Same logic as in point 1 - I always want the latest Fedora.

About the podman install, I thought that's the only way to run fedora container...

[gunchev]

Now the workflow builds against Fedora 43 and 44.