From af70cbeabef4ab9fcc915b431c0e78ec01dbb8d8 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 12:10:58 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++ .github/workflows/docs.yml | 8 +++---- .github/workflows/issue-auto-label.yml | 2 +- .github/workflows/issue-notify.yml | 4 ++-- .../needs-author-feedback-followup.yml | 2 +- .github/workflows/needs-author-feedback.yml | 4 ++-- .github/workflows/performance-comment.yml | 8 +++---- .github/workflows/performance.yml | 8 +++---- .github/workflows/pr-validation.yml | 24 +++++++++---------- 9 files changed, 41 insertions(+), 30 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 38f20e94..abf3e0dc 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -22,9 +22,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.11" @@ -39,7 +39,7 @@ jobs: cd docs make html - - uses: actions/upload-pages-artifact@v3 + - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: docs/_build/html @@ -51,4 +51,4 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/issue-auto-label.yml b/.github/workflows/issue-auto-label.yml index 4e009dca..aa1af63a 100644 --- a/.github/workflows/issue-auto-label.yml +++ b/.github/workflows/issue-auto-label.yml @@ -10,7 +10,7 @@ jobs: permissions: issues: write steps: - - uses: actions/github-script@v7 + - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const body = context.payload.issue.body || ''; diff --git a/.github/workflows/issue-notify.yml b/.github/workflows/issue-notify.yml index 190640c7..91f7038c 100644 --- a/.github/workflows/issue-notify.yml +++ b/.github/workflows/issue-notify.yml @@ -11,11 +11,11 @@ jobs: contents: read issues: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: sparse-checkout: .github/CODEOWNERS sparse-checkout-cone-mode: false - - uses: actions/github-script@v7 + - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/needs-author-feedback-followup.yml b/.github/workflows/needs-author-feedback-followup.yml index 84bd37b4..69673cee 100644 --- a/.github/workflows/needs-author-feedback-followup.yml +++ b/.github/workflows/needs-author-feedback-followup.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Remind or close issues waiting for author feedback - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const owner = context.repo.owner; diff --git a/.github/workflows/needs-author-feedback.yml b/.github/workflows/needs-author-feedback.yml index dfb185ae..6b8fd301 100644 --- a/.github/workflows/needs-author-feedback.yml +++ b/.github/workflows/needs-author-feedback.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Notify issue author - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const issue = context.payload.issue; @@ -48,7 +48,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Remove label when issue author replies - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const issue = context.payload.issue; diff --git a/.github/workflows/performance-comment.yml b/.github/workflows/performance-comment.yml index 54d1be53..53ff374c 100644 --- a/.github/workflows/performance-comment.yml +++ b/.github/workflows/performance-comment.yml @@ -34,14 +34,14 @@ jobs: steps: - name: Check out base repository (trusted) - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Download perf-results artifact id: download # Don't fail this job if the upstream Performance run was cancelled # or failed before producing the artifact — we just skip posting. continue-on-error: true - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: perf-results path: perf-results @@ -68,7 +68,7 @@ jobs: - name: Set up Python if: steps.pr.outputs.number != '' - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" @@ -102,7 +102,7 @@ jobs: - name: Post sticky PR comment if: steps.pr.outputs.number != '' && steps.report.outputs.found == 'true' - uses: marocchino/sticky-pull-request-comment@v2 + uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4 with: header: perf-comparison number: ${{ steps.pr.outputs.number }} diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml index e956ec62..18c6987b 100644 --- a/.github/workflows/performance.yml +++ b/.github/workflows/performance.yml @@ -22,20 +22,20 @@ jobs: steps: - name: Check out PR branch - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: path: pr fetch-depth: 0 - name: Check out base branch - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.base.sha || github.event.repository.default_branch }} path: base fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" @@ -100,7 +100,7 @@ jobs: - name: Upload artifacts if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: perf-results path: | diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index c8a84948..da266c72 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 @@ -40,10 +40,10 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.10" @@ -65,10 +65,10 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.10" @@ -98,10 +98,10 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -117,7 +117,7 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Detect minimum Python version id: python-version @@ -132,7 +132,7 @@ jobs: echo "version=$version" >> "$GITHUB_OUTPUT" - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ steps.python-version.outputs.version }} @@ -143,7 +143,7 @@ jobs: run: python -m build - name: Upload wheel - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: dist path: dist/ @@ -154,10 +154,10 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12"