Skip to content

chore(ci): pin GitHub Actions to immutable commit SHAs #1043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 2 commits into
base: main
Choose a base branch
from
+46 −46
Draft

chore(ci): pin GitHub Actions to immutable commit SHAs #1043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d477e9
Initial plan
Copilot Apr 15, 2026
c60e221
chore(ci): pin github actions to immutable commits
Copilot Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,19 +48,19 @@ jobs:
steps:
- name: Checkout code
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
- name: setup reports-dir
run: mkdir "$REPORTS_DIR"
- name: Setup python ${{ env.PYTHON_VERSION }}
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Setup poetry ${{ env.POETRY_VERSION }}
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: bump version
Expand All @@ -76,7 +76,7 @@ jobs:
!failure() && !cancelled() &&
steps.after-release.outputs.released
# see https://github.com/actions/upload-artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
with:
name: ${{ env.RUN_ARTIFACT_PYTHON_DIST }}
path: ${{ env.DIST_SOURCE_DIR }}/
Expand Down Expand Up @@ -108,7 +108,7 @@ jobs:
- name: Artifact reports
if: ${{ ! cancelled() }}
# see https://github.com/actions/upload-artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
with:
name: ${{ env.REPORTS_ARTIFACT }}
path: ${{ env.REPORTS_DIR }}
Expand Down
46 changes: 23 additions & 23 deletions .github/workflows/python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,15 +52,15 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -75,15 +75,15 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -98,15 +98,15 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -131,15 +131,15 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ matrix.python-version }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -154,15 +154,15 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -187,10 +187,10 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install self
Expand Down Expand Up @@ -224,12 +224,12 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Create reports directory
run: mkdir ${{ env.REPORTS_DIR }}
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ matrix.python-version }}
- name: craft PY_UT_ARGS
Expand All @@ -243,7 +243,7 @@ jobs:
env_file.write(f'PY_UT_ARGS={" ".join(PY_UT_ARGS)}\n')
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -262,7 +262,7 @@ jobs:
- name: Artifact reports
if: ${{ ! cancelled() }}
# see https://github.com/actions/upload-artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
with:
name: '${{ env.TESTS_REPORTS_ARTIFACT }}_bnt_${{ matrix.os }}_py${{ matrix.python-version }}'
path: ${{ env.REPORTS_DIR }}
Expand All @@ -276,7 +276,7 @@ jobs:
steps:
- name: fetch test artifacts
# see https://github.com/actions/download-artifact
uses: actions/download-artifact@v7
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
with:
pattern: '${{ env.TESTS_REPORTS_ARTIFACT }}_bnt_*'
merge-multiple: true
Expand All @@ -287,7 +287,7 @@ jobs:
## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
if: ${{ env.CODACY_PROJECT_TOKEN != '' }}
# see https://github.com/codacy/codacy-coverage-reporter-action
uses: codacy/codacy-coverage-reporter-action@v1
uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1
with:
project-token: ${{ env.CODACY_PROJECT_TOKEN }}
coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*
36 changes: 18 additions & 18 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,15 +71,15 @@ jobs:
steps:
- name: Checkout code
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand All @@ -94,15 +94,15 @@ jobs:
steps:
- name: Checkout
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup Python Environment
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install poetry
# see https://github.com/marketplace/actions/setup-poetry
uses: Gr1N/setup-poetry@v9
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
with:
poetry-version: ${{ env.POETRY_VERSION }}
- name: Install dependencies
Expand Down Expand Up @@ -132,17 +132,17 @@ jobs:
steps:
- name: Checkout code
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
- name: Setup python
# see https://github.com/actions/setup-python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
- name: Install and configure Poetry
# See https://github.com/marketplace/actions/install-poetry-action
uses: snok/install-poetry@v1
uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
with:
version: ${{ env.POETRY_VERSION }}
virtualenvs-create: true
Expand All @@ -156,7 +156,7 @@ jobs:
id: release
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html
# see https://github.com/python-semantic-release/python-semantic-release
uses: python-semantic-release/python-semantic-release@v10.0.2
uses: python-semantic-release/python-semantic-release@1a324000f2251a9e722e77b128bf72712653813f # v10.0.2
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
force: ${{ github.event.inputs.release_force }}
Expand All @@ -167,15 +167,15 @@ jobs:
!failure() && !cancelled() &&
steps.release.outputs.released == 'true'
# see https://github.com/pypa/gh-action-pypi-publish
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
with:
attestations: true
- name: Publish package distributions to GitHub Releases
if: |
!failure() && !cancelled() &&
steps.release.outputs.released == 'true'
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html#python-semantic-release-publish-action
uses: python-semantic-release/publish-action@v10
uses: python-semantic-release/publish-action@310a9983a0ae878b29f3aac778d7c77c1db27378 # v10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
tag: ${{ steps.release.outputs.tag }}
Expand All @@ -184,7 +184,7 @@ jobs:
!failure() && !cancelled() &&
steps.release.outputs.released == 'true'
# see https://github.com/actions/upload-artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
with:
name: ${{ env.DIST_ARTIFACT }}
path: ${{ env.DIST_DIR }}/
Expand Down Expand Up @@ -220,7 +220,7 @@ jobs:
echo "GHCR_REPO=${GHCR_REPO@L}" >> "${GITHUB_ENV}"
- name: Checkout code (${{ env.TAG }})
# see https://github.com/actions/checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ needs.release-PyPI.outputs.tag }}
- name: setup dirs
Expand All @@ -229,7 +229,7 @@ jobs:
mkdir "$DIST_DIR"
- name: Fetch python dist artifact
# see https://github.com/actions/download-artifact
uses: actions/download-artifact@v7
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
with:
name: ${{ env.DIST_ARTIFACT }}
path: ${{ env.DIST_DIR }}/
Expand Down Expand Up @@ -262,15 +262,15 @@ jobs:
- name: Artifact reports
if: ${{ ! cancelled() }}
# see https://github.com/actions/upload-artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
with:
name: ${{ env.ARTIFACT_DOCKER_SBOM }}
path: ${{ env.REPORTS_DIR }}/*.bom.*
if-no-files-found: error
# publish AFTER the boms were build, as the bom-generation is kind of a test if the image works
- name: Login to DockerHub
# see hhttps://github.com/docker/login-action?tab=readme-ov-file#docker-hub
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
Expand All @@ -283,7 +283,7 @@ jobs:
# region publish to GHCR
- name: Login to GHCR
# see https://github.com/docker/login-action#github-container-registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ghcr.io
username: ${{ github.actor }}
Expand Down
Loading