From b2eaff84dfe7e49657d46cb07779b264dd42c823 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 14:06:39 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/ci.yml | 12 ++++++------ .github/workflows/install-script.yml | 4 ++-- .github/workflows/publish-python.yml | 8 ++++---- .github/workflows/publish-wrapper.yml | 6 +++--- .github/workflows/release-notes.yml | 4 ++-- 6 files changed, 28 insertions(+), 17 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2e4609d3..0568530c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,10 +38,10 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install uv - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4 with: enable-cache: true @@ -56,12 +56,12 @@ jobs: # runner against the Python runner. This is the ONLY cross-language check. # Without these, `make verify-parity` fails with FileNotFoundError: 'pnpm'. - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' - name: Install pnpm - uses: pnpm/action-setup@v3 + uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0 with: version: 9 @@ -93,10 +93,10 @@ jobs: working-directory: wrappers/typescript steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Install dependencies run: bun install --no-save diff --git a/.github/workflows/install-script.yml b/.github/workflows/install-script.yml index e39639f4..72fd85db 100644 --- a/.github/workflows/install-script.yml +++ b/.github/workflows/install-script.yml @@ -35,7 +35,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install shellcheck run: sudo apt-get update && sudo apt-get install -y shellcheck @@ -51,7 +51,7 @@ jobs: image: python:3.12-slim steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install prerequisites run: | diff --git a/.github/workflows/publish-python.yml b/.github/workflows/publish-python.yml index 4136f967..6c1794ba 100644 --- a/.github/workflows/publish-python.yml +++ b/.github/workflows/publish-python.yml @@ -42,10 +42,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 - name: Verify tag matches pyproject.toml version if: github.event_name != 'workflow_dispatch' @@ -87,10 +87,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 - name: Verify tag matches wrappers/python-py pyproject.toml version run: | diff --git a/.github/workflows/publish-wrapper.yml b/.github/workflows/publish-wrapper.yml index bd97f3a8..331fd2e3 100644 --- a/.github/workflows/publish-wrapper.yml +++ b/.github/workflows/publish-wrapper.yml @@ -30,16 +30,16 @@ jobs: run: working-directory: wrappers/typescript steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Node 24 ships npm >= 11.5.1, which is required for trusted publishing. # The registry-url is required for the npm CLI to recognize the OIDC environment. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24' registry-url: 'https://registry.npmjs.org/' - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Verify tag matches package.json version run: | diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml index 570f9b33..e7498056 100644 --- a/.github/workflows/release-notes.yml +++ b/.github/workflows/release-notes.yml @@ -24,14 +24,14 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: # Full history so the release-notes generator can diff against # the previous tag in the same series. fetch-depth: 0 - name: Create Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: generate_release_notes: true draft: false