build: add pip supply-chain hardening to CI workflows

build: add pip supply-chain hardening to CI workflows

Author: julian-risch

.github/workflows/release.yml

@@ -24,7 +24,9 @@ jobs:
           python-version: "3.13"
 
       - name: Install Hatch
-        run: pip install hatch
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch --uploaded-prior-to=P1D
 
       - name: Build
         run: hatch build

.github/workflows/test.yml

@@ -36,7 +36,9 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install Hatch
-        run: pip install hatch
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch --uploaded-prior-to=P1D
 
       - name: Lint
         if: matrix.python-version == '3.10' && runner.os == 'Linux'