From d1a2438c0bdbea3313e2a5bc03a97e30f4e942e7 Mon Sep 17 00:00:00 2001 From: Joeri Abbo Date: Sat, 26 Sep 2026 12:40:56 +0200 Subject: [PATCH] fix: drop unhashed pyinstaller install The hardcoded `pip install pyinstaller==v6.13.0` bypassed the hash-pinned requirements file and was not tracked by Dependabot. Invoke PyInstaller via `python3 -m` so the hash-verified --user install is used regardless of PATH. Co-Authored-By: Claude Opus 5.5 (1M context) --- action.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/action.yml b/action.yml index 653aa05..acf4e27 100644 --- a/action.yml +++ b/action.yml @@ -93,13 +93,12 @@ runs: if: ${{ steps.condition_check.outcome == 'success' }} shell: bash run: | - pip install pyinstaller==v6.13.0 python3 -m pip install \ --require-hashes \ --user \ --requirement \ ${GITHUB_ACTION_PATH}/configs/pip/pyinstaller/requirements.txt - pyinstaller --onefile main.py --name gomod-go-version-updater + python3 -m PyInstaller --onefile main.py --name gomod-go-version-updater # yamllint disable-line rule:line-length - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5 name: Attach a binary to a release