MNT: bump all GHA (and use commit shas) #50

	name: CD
	on:
	push:
	tags: v*
	pull_request:
	paths:
	- .github/workflows/cd.yml
	jobs:
	publish:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout Source
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Setup Python
	uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
	with:
	python-version: 3.x
	- name: Install build dependencies
	run: python -m pip install build wheel
	- name: Build distributions
	shell: bash -l {0}
	run: python -m build
	- name: Publish package to PyPI
	if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
	uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2
	with:
	user: __token__
	password: ${{ secrets.pypi_token }}

Provide feedback