Merge pull request #431 from github/claude/update-github-workflows-pinned-dependencies

fix: pin GitHub Actions dependencies to SHA hashes for security

Author: zkoppert

.github/workflows/copilot-setup-steps.yml

@@ -26,12 +26,12 @@ jobs:
     # If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 

.github/workflows/docker-image.yml

@@ -14,7 +14,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Build the Docker image

.github/workflows/linter.yaml

@@ -18,22 +18,22 @@ jobs:
       statuses: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Full git history is needed to get a proper
           # list of changed files within `super-linter`
           fetch-depth: 0
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt -r requirements-test.txt
       - name: Lint Code Base
-        uses: super-linter/super-linter@502f4fe48a81a392756e173e39a861f8c8efe056
+        uses: super-linter/super-linter@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
         env:
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/major-version-updater.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-tags: true
           ref: ${{ github.event.inputs.TAG_NAME || github.ref }}

.github/workflows/python-package.yml

@@ -19,11 +19,11 @@ jobs:
       matrix:
         python-version: [3.11, 3.12, 3.13]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -36,7 +36,7 @@ jobs:
           results_format: sarif
           publish_results: true
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v6.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/stale.yaml

@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10.1.1
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           stale-issue-message: "This issue is stale because it has been open 21 days with no activity. Remove stale label or comment or this will be closed in 14 days."
           close-issue-message: "This issue was closed because it has been stalled for 35 days with no activity."

.github/workflows/use-action.yml

@@ -19,7 +19,7 @@ jobs:
       packages: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Run stale_repos tool

stale_repos.py

@@ -188,10 +188,8 @@ def get_days_since_last_release(repo):
         last_release = next(repo.releases())
         return (datetime.now(timezone.utc) - last_release.created_at).days
     except TypeError:
-        print(
-            f"{repo.html_url} had an exception trying to get the last release.\
-            Potentially caused by ghost user."
-        )
+        print(f"{repo.html_url} had an exception trying to get the last release.\
+            Potentially caused by ghost user.")
         return None
     except StopIteration:
         return None
@@ -233,17 +231,13 @@ def get_active_date(repo):
                 return None
             active_date = parse(last_push_str)
         else:
-            raise ValueError(
-                f"""
+            raise ValueError(f"""
                 ACTIVITY_METHOD environment variable has unsupported value: '{activity_method}'.
                 Allowed values are: 'pushed' and 'default_branch_updated'
-                """
-            )
+                """)
     except github3.exceptions.GitHubException:
-        print(
-            f"{repo.html_url} had an exception trying to get the activity date.\
- Potentially caused by ghost user."
-        )
+        print(f"{repo.html_url} had an exception trying to get the activity date.\
+ Potentially caused by ghost user.")
         return None
     return active_date
 
@@ -254,7 +248,7 @@ def output_to_json(inactive_repos, file=None):
     Args:
         inactive_repos: A list of dictionaries containing the repo,
             days inactive, the date of the last push,
-            visiblity of the repository (public/private),
+            visibility of the repository (public/private),
             days since the last release, and days since the last pr.
 
     Returns:
@@ -339,10 +333,8 @@ def set_repo_data(
             try:
                 repo_data["days_since_last_pr"] = get_days_since_last_pr(repo)
             except github3.exceptions.GitHubException:
-                print(
-                    f"{repo.html_url} had an exception trying to get the last PR.\
- Potentially caused by ghost user."
-                )
+                print(f"{repo.html_url} had an exception trying to get the last PR.\
+ Potentially caused by ghost user.")
 
     print(f"{repo.html_url} {days_inactive} days inactive")  # type: ignore
     return repo_data