CI: use hashes for actions' versions in publishing job #8

	name: Build Wheel and Release
	on:
	pull_request:
	branches:
	- main
	push:
	tags:
	- v*

	jobs:
	sdist_wheel:
	name: sdist and wheels
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
	with:
	fetch-depth: 0
	- uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
	with:
	python-version: "3.12"
	- name: Build wheels
	run: \|
	git clean -fxd
	pip install -U build twine wheel
	python -m build --sdist --wheel
	- run: twine check --strict dist/*
	- uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
	with:
	name: dist
	path: dist

	pypi-publish:
	needs: sdist_wheel
	name: upload release to PyPI
	if: github.repository_owner == 'numpy' && startsWith(github.ref, 'refs/tags/v') && github.actor == 'jarrodmillman' && always()
	runs-on: ubuntu-latest
	# Specifying a GitHub environment is optional, but strongly encouraged
	environment: release
	permissions:
	# IMPORTANT: this permission is mandatory for trusted publishing
	id-token: write
	steps:
	- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
	with:
	name: dist
	path: dist
	- uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0

Provide feedback