From e3528236138d053fced8d88bb722ecba8f44fc63 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 5 Sep 2026 20:56:29 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yaml | 4 +++- .github/workflows/python.yaml | 6 +++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index f2518cb..cfc9de7 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -10,8 +10,10 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "/" # Location of package manifests schedule: - interval: "weekly" + interval: "weekly" \ No newline at end of file diff --git a/.github/workflows/python.yaml b/.github/workflows/python.yaml index 67a61b3..5a45d97 100644 --- a/.github/workflows/python.yaml +++ b/.github/workflows/python.yaml @@ -10,13 +10,13 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python 3 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 - name: Set up virtual environment and install dependencies run: | uv venv .venv