Skip to content

Commit c0f0db2

Browse files
AlexWaygoodAlexWaygood
committed
Pin GitHub Actions to full commit hashes
1 parent 050197c commit c0f0db2

9 files changed

Lines changed: 54 additions & 55 deletions

File tree

‎.github/renovate.json5‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
33
"dependencyDashboard": true,
44
"suppressNotifications": ["prEditedNotification"],
5-
"extends": ["config:recommended"],
5+
"extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
66
"labels": ["bot: dependencies"],
77
"rebaseLabel": ["bot: rebase"],
88
"semanticCommits": "disabled",

‎.github/workflows/daily.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ jobs:
4343
fail-fast: false
4444

4545
steps:
46-
- uses: actions/checkout@v7
46+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4747
- name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
48-
uses: actions/setup-python@v6
48+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
4949
with:
5050
python-version: ${{ matrix.python-version }}
5151
cache: pip
@@ -67,8 +67,8 @@ jobs:
6767
shard-index: [0, 1, 2, 3]
6868
fail-fast: false
6969
steps:
70-
- uses: actions/checkout@v7
71-
- uses: actions/setup-python@v6
70+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
71+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
7272
with:
7373
python-version: "3.13"
7474
cache: pip
@@ -115,15 +115,15 @@ jobs:
115115
runs-on: ubuntu-latest
116116
steps:
117117
- name: Checkout typeshed
118-
uses: actions/checkout@v7
118+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
119119
with:
120120
path: typeshed
121121
- name: Checkout stub_uploader
122-
uses: actions/checkout@v7
122+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
123123
with:
124124
repository: typeshed-internal/stub_uploader
125125
path: stub_uploader
126-
- uses: astral-sh/setup-uv@v8.2.0
126+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
127127
with:
128128
version-file: "typeshed/requirements-tests.txt"
129129
- name: Run tests
@@ -141,7 +141,7 @@ jobs:
141141
permissions:
142142
issues: write
143143
steps:
144-
- uses: actions/github-script@v9
144+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
145145
with:
146146
github-token: ${{ secrets.GITHUB_TOKEN }}
147147
script: |

‎.github/workflows/meta_tests.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ jobs:
3535
platform: ["linux", "win32"]
3636
fail-fast: false
3737
steps:
38-
- uses: actions/checkout@v7
39-
- uses: astral-sh/setup-uv@v8.2.0
38+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
39+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
4040
with:
4141
version-file: "requirements-tests.txt"
4242
- name: Run check_typeshed_structure.py
@@ -56,16 +56,16 @@ jobs:
5656
python-platform: ["Linux", "Windows"]
5757
fail-fast: false
5858
steps:
59-
- uses: actions/checkout@v7
60-
- uses: actions/setup-python@v6
59+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
60+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
6161
with:
6262
python-version: "3.13"
63-
- uses: astral-sh/setup-uv@v8.2.0
63+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
6464
with:
6565
version-file: "requirements-tests.txt"
6666
- run: uv pip install -r requirements-tests.txt --system
6767
- name: Run pyright on typeshed
68-
uses: jakebailey/pyright-action@v3
68+
uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
6969
with:
7070
version: PATH
7171
python-platform: ${{ matrix.python-platform }}
@@ -76,8 +76,8 @@ jobs:
7676
name: "stubsabot: dry run"
7777
runs-on: ubuntu-latest
7878
steps:
79-
- uses: actions/checkout@v7
80-
- uses: astral-sh/setup-uv@v8.2.0
79+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
80+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
8181
with:
8282
version-file: "requirements-tests.txt"
8383
- name: Git config

‎.github/workflows/mypy_primer.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ jobs:
2525
shard-index: [0, 1, 2, 3, 4, 5]
2626
fail-fast: false
2727
steps:
28-
- uses: actions/checkout@v7
28+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2929
with:
3030
path: typeshed_to_test
3131
fetch-depth: 0
32-
- uses: actions/setup-python@v6
32+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
3333
with:
3434
python-version: "3.13"
3535
- name: Install dependencies
@@ -62,15 +62,15 @@ jobs:
6262
run: |
6363
echo ${{ github.event.pull_request.number }} | tee pr_number.txt
6464
- name: Upload mypy_primer diff + PR number
65-
uses: actions/upload-artifact@v7
65+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
6666
if: ${{ matrix.shard-index == 0 }}
6767
with:
6868
name: mypy_primer_diffs-${{ matrix.shard-index }}
6969
path: |
7070
diff_${{ matrix.shard-index }}.txt
7171
pr_number.txt
7272
- name: Upload mypy_primer diff
73-
uses: actions/upload-artifact@v7
73+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
7474
if: ${{ matrix.shard-index != 0 }}
7575
with:
7676
name: mypy_primer_diffs-${{ matrix.shard-index }}
@@ -84,7 +84,7 @@ jobs:
8484
contents: read
8585
steps:
8686
- name: Merge artifacts
87-
uses: actions/upload-artifact/merge@v7
87+
uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
8888
with:
8989
name: mypy_primer_diffs
9090
pattern: mypy_primer_diffs-*

‎.github/workflows/mypy_primer_comment.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
if: ${{ github.event.workflow_run.conclusion == 'success' }}
1919
steps:
2020
- name: Download diffs
21-
uses: actions/github-script@v9
21+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
2222
with:
2323
script: |
2424
const fs = require('fs');
@@ -44,7 +44,7 @@ jobs:
4444
4545
- name: Post comment
4646
id: post-comment
47-
uses: actions/github-script@v9
47+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
4848
with:
4949
github-token: ${{ secrets.GITHUB_TOKEN }}
5050
script: |
@@ -79,8 +79,7 @@ jobs:
7979
return prNumber
8080
8181
- name: Hide old comments
82-
# v0.4.0
83-
uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf
82+
uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf # v0.4.0
8483
with:
8584
github_token: ${{ secrets.GITHUB_TOKEN }}
8685
leave_visible: 1

‎.github/workflows/stubsabot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ jobs:
1919
if: github.repository == 'python/typeshed'
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v7
22+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2323
with:
2424
# use an ssh key so that checks automatically run on stubsabot PRs
2525
ssh-key: ${{ secrets.STUBSABOT_SSH_PRIVATE_KEY }}
2626
fetch-depth: 0
27-
- uses: astral-sh/setup-uv@v8.2.0
27+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
2828
with:
2929
version-file: "requirements-tests.txt"
3030
- name: Git config
@@ -48,7 +48,7 @@ jobs:
4848
needs: [stubsabot]
4949
if: ${{ github.repository == 'python/typeshed' && always() && (needs.stubsabot.result == 'failure') }}
5050
steps:
51-
- uses: actions/github-script@v9
51+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
5252
with:
5353
github-token: ${{ secrets.GITHUB_TOKEN }}
5454
script: |

‎.github/workflows/stubtest_stdlib.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,9 @@ jobs:
3939
fail-fast: false
4040

4141
steps:
42-
- uses: actions/checkout@v7
42+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4343
- name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
44-
uses: actions/setup-python@v6
44+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
4545
with:
4646
python-version: ${{ matrix.python-version }}
4747
cache: pip

‎.github/workflows/stubtest_third_party.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ jobs:
3636
fail-fast: false
3737

3838
steps:
39-
- uses: actions/checkout@v7
39+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4040
with:
4141
fetch-depth: 0
42-
- uses: actions/setup-python@v6
42+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
4343
with:
4444
python-version: "3.13"
4545
cache: pip

‎.github/workflows/tests.yml‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ jobs:
2626
name: Check typeshed structure
2727
runs-on: ubuntu-latest
2828
steps:
29-
- uses: actions/checkout@v7
30-
- uses: astral-sh/setup-uv@v8.2.0
29+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
30+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
3131
with:
3232
version-file: "requirements-tests.txt"
3333
- name: Run check_typeshed_structure.py
@@ -47,12 +47,12 @@ jobs:
4747
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
4848
fail-fast: false
4949
steps:
50-
- uses: actions/checkout@v7
51-
- uses: actions/setup-python@v6
50+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
51+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
5252
with:
5353
python-version: ${{ matrix.python-version }}
5454
allow-prereleases: true
55-
- uses: astral-sh/setup-uv@v8.2.0
55+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
5656
with:
5757
version-file: "requirements-tests.txt"
5858
- run: uv pip install -r requirements-tests.txt --system
@@ -70,8 +70,8 @@ jobs:
7070
name: "mypy: regression tests"
7171
runs-on: ubuntu-latest
7272
steps:
73-
- uses: actions/checkout@v7
74-
- uses: astral-sh/setup-uv@v8.2.0
73+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
74+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
7575
with:
7676
version-file: "requirements-tests.txt"
7777
- name: Run regr_test.py
@@ -94,11 +94,11 @@ jobs:
9494
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
9595
fail-fast: false
9696
steps:
97-
- uses: actions/checkout@v7
98-
- uses: actions/setup-python@v6
97+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
98+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
9999
with:
100100
python-version: "3.14"
101-
- uses: astral-sh/setup-uv@v8.2.0
101+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
102102
with:
103103
version-file: "requirements-tests.txt"
104104
- name: Install typeshed test-suite requirements
@@ -127,11 +127,11 @@ jobs:
127127
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
128128
fail-fast: false
129129
steps:
130-
- uses: actions/checkout@v7
131-
- uses: actions/setup-python@v6
130+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
131+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
132132
with:
133133
python-version: "3.14"
134-
- uses: astral-sh/setup-uv@v8.2.0
134+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
135135
with:
136136
version-file: "requirements-tests.txt"
137137
- name: Install typeshed test-suite requirements
@@ -161,11 +161,11 @@ jobs:
161161
python-version: ["3.11", "3.12", "3.13", "3.14"]
162162
fail-fast: false
163163
steps:
164-
- uses: actions/checkout@v7
165-
- uses: actions/setup-python@v6
164+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
165+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
166166
with:
167167
python-version: "3.13"
168-
- uses: astral-sh/setup-uv@v8.2.0
168+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
169169
with:
170170
version-file: "requirements-tests.txt"
171171
- name: Install typeshed test-suite requirements
@@ -192,22 +192,22 @@ jobs:
192192
- name: List 3rd-party stub dependencies installed
193193
run: uv pip freeze
194194
- name: Run pyright with basic settings on all the stubs
195-
uses: jakebailey/pyright-action@v3
195+
uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
196196
with:
197197
version: PATH
198198
python-platform: ${{ matrix.python-platform }}
199199
python-version: ${{ matrix.python-version }}
200200
annotate: ${{ matrix.python-version == '3.13' && matrix.python-platform == 'Linux' }} # Having each job create the same comment is too noisy.
201201
- name: Run pyright with stricter settings on some of the stubs
202-
uses: jakebailey/pyright-action@v3
202+
uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
203203
with:
204204
version: PATH
205205
python-platform: ${{ matrix.python-platform }}
206206
python-version: ${{ matrix.python-version }}
207207
annotate: ${{ matrix.python-version == '3.13' && matrix.python-platform == 'Linux' }} # Having each job create the same comment is too noisy.
208208
project: ./pyrightconfig.stricter.json
209209
- name: Run pyright on the test cases
210-
uses: jakebailey/pyright-action@v3
210+
uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
211211
with:
212212
version: PATH
213213
python-platform: ${{ matrix.python-platform }}
@@ -220,15 +220,15 @@ jobs:
220220
runs-on: ubuntu-latest
221221
steps:
222222
- name: Checkout typeshed
223-
uses: actions/checkout@v7
223+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
224224
with:
225225
path: typeshed
226226
- name: Checkout stub_uploader
227-
uses: actions/checkout@v7
227+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
228228
with:
229229
repository: typeshed-internal/stub_uploader
230230
path: stub_uploader
231-
- uses: astral-sh/setup-uv@v8.2.0
231+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
232232
with:
233233
version-file: "typeshed/requirements-tests.txt"
234234
- name: Run tests

0 commit comments

Comments
 (0)