🔧 chore(deps): pin github actions to commit hashes and fix temp file

.github/workflows/labeler.yml

@@ -2,9 +2,15 @@ name: Labeler
 
 on:
   push:
-    branches:
-      - main
-      - master
+    branches: [main]
+    paths:
+      - .github/labels.yml
+      - .github/workflows/labeler.yml
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
 
 jobs:
   labeler:
@@ -14,6 +20,6 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Run Labeler
-        uses: crazy-max/[email protected]
+        uses: crazy-max/ghaction-github-labeler@3de87da19416edc45c90cd89e7a4ea922a3aae5a # v4.1.0
         with:
           skip-delete: true

.github/workflows/publish-to-pypi.yml

@@ -28,14 +28,14 @@ jobs:
     outputs:
       is_release: ${{ steps.check-version.outputs.tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
         with:
           persist-credentials: true
           fetch-depth: 2
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup uv with Python 3.12
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@b5f58b2abc5763ade55e4e9d0fe52cd1ff7979ca # v5.2.1
         with:
           python-version: "3.12"
           enable-cache: true
@@ -49,7 +49,7 @@ jobs:
       - name: Detect and tag new version
         id: check-version
         if: steps.check-parent-commit.outputs.sha
-        uses: salsify/[email protected].1
+        uses: salsify/action-detect-and-tag-new-version@2e972ec550a624c846f9f37e87376a6f9f6a682a # v2.0.3
         with:
           version-command: |
             cat pyproject.toml | grep "version = " | head -n 1 | awk -F'"' '{print $2}'
@@ -68,7 +68,7 @@ jobs:
         run: "uv build"
 
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.3.0
         with:
           name: python-package-distributions
           path: dist/
@@ -89,13 +89,13 @@ jobs:
 
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: python-package-distributions
           path: dist/
 
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
 
   publish-to-testpypi:
     name: Publish Python 🐍 distribution 📦 to TestPyPI
@@ -113,13 +113,13 @@ jobs:
 
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf65639a7c09 # v4.1.7
         with:
           name: python-package-distributions
           path: dist/
 
       - name: Publish distribution 📦 to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -138,14 +138,14 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
         with:
           persist-credentials: true
           fetch-depth: 2
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish the release notes
-        uses: release-drafter/release-drafter@v5.23.0
+        uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5.25.0
         with:
           publish: ${{ needs.build.outputs.is_release != '' }}
           tag: ${{ needs.build.outputs.is_release }}

.github/workflows/test.yml

@@ -5,6 +5,10 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     name: Run Python Tests
@@ -14,17 +18,17 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
         with:
           persist-credentials: false
       - name: Cached models
         id: cache-mods
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.2
         with:
           path: ~/.cache/huggingface/hub/models--wybxc--DocLayout-YOLO-DocStructBench-onnx
           key: ${{runner.os}}-huggingmodel-wybxc--DocLayout-YOLO-DocStructBench-onnx
       - name: Setup uv with Python ${{ matrix.python-version }}
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@b5f58b2abc5763ade55e4e9d0fe52cd1ff7979ca # v5.2.1
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true

yadt/document_il/midend/il_translator.py

@@ -134,7 +134,7 @@ def translate(self, docs: Document):
             self.stage_name, total
         ) as pbar:
             with concurrent.futures.ThreadPoolExecutor(
-                max_workers=self.translation_config.qps * 2
+                max_workers=min(self.translation_config.qps * 2, self.translation_config.qps + 5)
             ) as executor:
                 for page in docs.page:
                     self.process_page(page, executor, pbar, tracker.new_page())

yadt/document_il/translator/cache.py

@@ -111,7 +111,10 @@ def init_db(remove_exists=False):
 def init_test_db():
     import tempfile
 
-    cache_db_path = tempfile.mktemp(suffix=".db")
+    temp_file = tempfile.NamedTemporaryFile(suffix=".db", delete=False)
+    cache_db_path = temp_file.name
+    temp_file.close()
+
     test_db = SqliteDatabase(
         cache_db_path,
         pragmas={