From 57f661bf6357079533479da0ef59d0359299033e Mon Sep 17 00:00:00 2001 From: Evgeni Burovski Date: Sun, 25 Oct 2026 13:02:46 +0100 Subject: [PATCH] CI: use hashes for GH workflows --- .github/workflows/array-api-tests.yml | 6 +++--- .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/docs-build.yml | 6 +++--- .github/workflows/docs-deploy.yml | 6 +++--- .github/workflows/publish-package.yml | 12 ++++++------ .github/workflows/ruff.yml | 4 ++-- .github/workflows/tests.yml | 4 ++-- 7 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/array-api-tests.yml b/.github/workflows/array-api-tests.yml index 25b4bd92..be0cd1e9 100644 --- a/.github/workflows/array-api-tests.yml +++ b/.github/workflows/array-api-tests.yml @@ -49,19 +49,19 @@ jobs: steps: - name: Checkout array-api-compat - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: array-api-compat - name: Checkout array-api-tests - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: data-apis/array-api-tests submodules: 'true' path: array-api-tests - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 48dfc680..af55c3c7 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml index 67db344f..7997caa0 100644 --- a/.github/workflows/docs-build.yml +++ b/.github/workflows/docs-build.yml @@ -6,8 +6,8 @@ jobs: docs-build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 - - uses: actions/setup-python@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 - name: Install Dependencies run: | python -m pip install --upgrade pip @@ -18,7 +18,7 @@ jobs: cd docs make html - name: Upload Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: docs-build path: docs/_build/html diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml index 904d6ae8..85da0a07 100644 --- a/.github/workflows/docs-deploy.yml +++ b/.github/workflows/docs-deploy.yml @@ -11,9 +11,9 @@ jobs: environment: name: docs-deploy steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download Artifact - uses: dawidd6/action-download-artifact@v27 + uses: dawidd6/action-download-artifact@eab87c9830c39eff17e5a6eadb20bfb4bc880477 # v27 with: workflow: docs-build.yml name: docs-build @@ -23,7 +23,7 @@ jobs: # See # https://github.com/JamesIves/github-pages-deploy-action/tree/dev#using-an-ssh-deploy-key- - name: Deploy - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0 with: folder: docs/_build/html ssh-key: ${{ secrets.DEPLOY_KEY }} diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml index 31c8db4f..401c0a6b 100644 --- a/.github/workflows/publish-package.yml +++ b/.github/workflows/publish-package.yml @@ -30,12 +30,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 #v7.1.0 with: python-version: '3.x' @@ -60,7 +60,7 @@ jobs: run: python -m zipfile --list dist/array_api_compat-*.whl - name: Upload distribution artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dist-artifact path: dist @@ -81,7 +81,7 @@ jobs: steps: - name: Download distribution artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: dist-artifact path: dist @@ -102,12 +102,12 @@ jobs: - name: Publish distribution 📦 to PyPI if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') - uses: pypa/gh-action-pypi-publish@v1.14.2 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: print-hash: true - name: Create GitHub Release from a Tag - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 if: startsWith(github.ref, 'refs/tags/') with: files: dist/* diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml index ff73623d..cc6eaebf 100644 --- a/.github/workflows/ruff.yml +++ b/.github/workflows/ruff.yml @@ -5,9 +5,9 @@ jobs: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 #v7.1.0 with: python-version: "3.11" - name: Install dependencies diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 8d1f2e1b..b21abff9 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -27,8 +27,8 @@ jobs: python-version: '3.14' steps: - - uses: actions/checkout@v7.0.1 - - uses: actions/setup-python@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 #v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Install Dependencies