Make workflows more secure against supply chain attacks

.github/workflows/build_doc.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
   build:
@@ -12,9 +13,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: 3.12
       - name: Install dependencies

.github/workflows/deploy_pypi.yml

@@ -13,9 +13,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: 3.12
       - name: Install dependencies
@@ -31,13 +31,13 @@ jobs:
         run: |
           python setup.py sdist bdist_wheel
       - name: Publish package to TestPyPI
-        uses: pypa/gh-action-pypi-publish@master
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
         with:
           user: __token__ 
           password: ${{ secrets.TLVIZ_PYPI_TEST_TOKEN }}
           repository_url: https://test.pypi.org/legacy/
       - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@master
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
         with:
           user: __token__ 
           password: ${{ secrets.TLVIZ_PYPI_TOKEN }}

.github/workflows/tests.yml

@@ -1,6 +1,6 @@
 name: tests
 
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
 jobs:
   tests:
     strategy:
@@ -9,8 +9,10 @@ jobs:
         python: ['3.11', '3.12', '3.13', '3.14']
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - name: Install Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with: 
           python-version: ${{ matrix.python }}
       - name: install dependencies
@@ -21,6 +23,6 @@ jobs:
         run: python3 -m pytest --cov=tlviz
       - name: upload coverage to Codecov
         if: ${{matrix.os == 'ubuntu-latest' && matrix.python == '3.13'}}
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6.0.0
         with:
           verbose: true

tlviz/_xarray_wrapper.py

@@ -57,12 +57,12 @@ def add_factor_metadata(cp_tensor, dataset):
     >>> bikes.coords
     Coordinates:
       * End station name  (End station name) object 2kB '7 Juni Plassen' ... 'Øke...
+        lat               (End station name) float64 2kB 59.92 59.93 ... 59.93 59.92
+        lon               (End station name) float64 2kB 10.73 10.75 ... 10.8 10.78
       * Year              (Year) int32 8B 2020 2021
       * Month             (Month) int32 48B 1 2 3 4 5 6 7 8 9 10 11 12
       * Day of week       (Day of week) int32 28B 0 1 2 3 4 5 6
       * Hour              (Hour) int32 96B 0 1 2 3 4 5 6 7 ... 17 18 19 20 21 22 23
-        lat               (End station name) float64 2kB 59.92 59.93 ... 59.93 59.92
-        lon               (End station name) float64 2kB 10.73 10.75 ... 10.8 10.78
 
     We see that the ``End station name`` dimension has two additional columns: ``lat`` and ``lon``.
     These contain metadata about the end station coordinates, and it can be useful to have these

tlviz/postprocessing.py

@@ -317,7 +317,7 @@ def postprocess(
         >>> print(type(cp_tensor[1][0]))
         <class 'numpy.ndarray'>
         >>> print(type(cp_tensor_postprocessed[1][0]))
-        <class 'pandas.core.frame.DataFrame'>
+        <class 'pandas.DataFrame'>
 
 
         We see that after postprocessing, the factor matrix has unit norm