From 729b16eefd0ad237c9790a9cf2a1488c465b1cfe Mon Sep 17 00:00:00 2001 From: David Berenstein Date: Thu, 24 Sep 2026 20:56:48 +0900 Subject: [PATCH] ci: pin GitHub Actions to commit SHAs Replace mutable tag references with the commit SHA each tag points to today, keeping the tag as a trailing comment. Resolves the Semgrep github-actions-mutable-action-tag findings reported by Bastion. --- .github/actions/setup-uv-project/action.yml | 2 +- .github/workflows/assign-reviewers.yaml | 4 ++-- .github/workflows/build.yaml | 6 +++--- .github/workflows/docs.yaml | 4 ++-- .github/workflows/installation.yaml | 2 +- .github/workflows/stale.yaml | 2 +- .github/workflows/tests.yaml | 10 +++++----- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/actions/setup-uv-project/action.yml b/.github/actions/setup-uv-project/action.yml index 7fd1c693..bac7ea46 100644 --- a/.github/actions/setup-uv-project/action.yml +++ b/.github/actions/setup-uv-project/action.yml @@ -14,7 +14,7 @@ inputs: runs: using: composite steps: - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: ">=0.11.5" # introduction of per-index exclude-newer support activate-environment: true diff --git a/.github/workflows/assign-reviewers.yaml b/.github/workflows/assign-reviewers.yaml index 4e20421c..f880f285 100644 --- a/.github/workflows/assign-reviewers.yaml +++ b/.github/workflows/assign-reviewers.yaml @@ -11,9 +11,9 @@ jobs: pull-requests: write runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Install dependencies diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 3fe01774..5e4242b5 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -24,10 +24,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -44,7 +44,7 @@ jobs: echo "wheel_name=$wheel" >> $GITHUB_OUTPUT - name: Upload Wheel Artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: ${{ steps.get_wheel.outputs.wheel_name }} path: dist/*.whl diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 628050d0..89bb7045 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: ./.github/actions/setup-uv-project with: @@ -40,7 +40,7 @@ jobs: fi - name: Upload generated file - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: compression-rst path: compression.rst diff --git a/.github/workflows/installation.yaml b/.github/workflows/installation.yaml index d0622469..32b3f018 100644 --- a/.github/workflows/installation.yaml +++ b/.github/workflows/installation.yaml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: ./.github/actions/setup-uv-project with: diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index ec15ed6f..bf31af2a 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -20,7 +20,7 @@ jobs: DAYS_BEFORE_PR_CLOSE: 7 OPERATIONS_PER_RUN: 90 steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} operations-per-run: ${{ env.OPERATIONS_PER_RUN }} diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index d8c0f3b2..72684514 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -28,7 +28,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: ./.github/actions/setup-uv-project with: @@ -36,7 +36,7 @@ jobs: - name: Get changed Python files id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: | **/*.py @@ -44,7 +44,7 @@ jobs: tests/** - name: Run ruff on changed Pruna code if: steps.changed-files.outputs.any_changed == 'true' - uses: astral-sh/ruff-action@v3 + uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3.6.1 with: version: "latest" src: ${{ steps.changed-files.outputs.all_changed_files }} @@ -90,7 +90,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: ./.github/actions/setup-uv-project with: @@ -108,7 +108,7 @@ jobs: uv pip install --no-cache --reinstall-package llama-cpp-python --no-binary llama-cpp-python "llama-cpp-python>=0.2.78" - name: Cache Hugging Face datasets and models - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | .cache/huggingface/datasets