From 4604f98e07e843ec02d41aece0a3953b30df3fbd Mon Sep 17 00:00:00 2001 From: Zon Date: Fri, 27 Mar 2026 10:35:58 +0100 Subject: [PATCH 1/2] chore(OP-2780): pin GitHub Actions to commit SHA --- .github/workflows/build.yaml | 4 ++-- .github/workflows/release.yaml | 4 ++-- .github/workflows/test.yaml | 10 +++++----- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 265a95e..0ed186b 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -14,9 +14,9 @@ jobs: package: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Python 3.10 - uses: actions/setup-python@v4 + uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1 with: python-version: "3.10" cache: "pip" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2407d8a..36b963c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,11 +15,11 @@ jobs: permissions: id-token: write # IMPORTANT: this permission is mandatory for trusted publishing steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: filter: blob:none fetch-depth: 0 - - uses: actions/setup-python@v4 + - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1 with: python-version: "3.x" cache: "pip" diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 15f40a0..01a27c5 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -41,17 +41,17 @@ jobs: R_KEEP_PKG_SOURCE: yes steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Python ${{ matrix.python }} - uses: actions/setup-python@v4 + uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1 with: python-version: ${{ matrix.python }} - - uses: r-lib/actions/setup-r@v2 + - uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4 with: r-version: ${{ matrix.r }} use-public-rspm: true - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2 - name: Install the project run: uv sync --extra dev --extra test --extra gtf --extra copykat @@ -74,4 +74,4 @@ jobs: run: | uv run coverage report - name: Upload coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6 From d618316d8c5581f0a50c11016edd22d013420afd Mon Sep 17 00:00:00 2001 From: Zon Date: Fri, 27 Mar 2026 12:49:07 +0100 Subject: [PATCH 2/2] chore(OP-2780): pin pypa/gh-action-pypi-publish to v1.13.0 SHA --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 36b963c..04c9af0 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -26,4 +26,4 @@ jobs: - run: pip install build - run: python -m build - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0