Skip to content

Commit 9516cf6

Browse files
committed
build: hash-pin all actions
1 parent c6e0985 commit 9516cf6

8 files changed

+42
-41
lines changed

.github/workflows/codeql-analysis.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,11 @@ jobs:
4545

4646
steps:
4747
- name: Checkout repository
48-
uses: actions/checkout@v4
48+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
4949

5050
# Initializes the CodeQL tools for scanning.
5151
- name: Initialize CodeQL
52-
uses: github/codeql-action/init@v3
52+
uses: github/codeql-action/init@412ab5c4176178930892df540237c587c71786c9 # v3
5353
with:
5454
languages: ${{ matrix.language }}
5555
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
6060
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
6161
# If this step fails, then you should remove it and run the build manually (see below)
6262
- name: Autobuild
63-
uses: github/codeql-action/autobuild@v3
63+
uses: github/codeql-action/autobuild@412ab5c4176178930892df540237c587c71786c9 # v3
6464

6565
# ℹ️ Command-line programs to run using the OS shell.
6666
# 📚 https://git.io/JvXDl
@@ -74,4 +74,4 @@ jobs:
7474
# make release
7575

7676
- name: Perform CodeQL Analysis
77-
uses: github/codeql-action/analyze@v3
77+
uses: github/codeql-action/analyze@412ab5c4176178930892df540237c587c71786c9 # v3

.github/workflows/coverage.yml

+9-9
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,10 @@ jobs:
8181

8282
steps:
8383
- name: "Check out the repo"
84-
uses: "actions/checkout@v4"
84+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
8585

8686
- name: "Set up Python"
87-
uses: "actions/setup-python@v5"
87+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
8888
with:
8989
python-version: "${{ matrix.python-version }}"
9090
allow-prereleases: true
@@ -125,7 +125,7 @@ jobs:
125125
mv .metacov .metacov.$MATRIX_ID
126126
127127
- name: "Upload coverage data"
128-
uses: actions/upload-artifact@v4
128+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
129129
with:
130130
name: metacov-${{ env.MATRIX_ID }}
131131
path: .metacov.*
@@ -141,10 +141,10 @@ jobs:
141141

142142
steps:
143143
- name: "Check out the repo"
144-
uses: "actions/checkout@v4"
144+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
145145

146146
- name: "Set up Python"
147-
uses: "actions/setup-python@v5"
147+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
148148
with:
149149
python-version: "3.8" # Minimum of PYVERSIONS
150150
# At a certain point, installing dependencies failed on pypy 3.9 and
@@ -167,7 +167,7 @@ jobs:
167167
python igor.py zip_mods
168168
169169
- name: "Download coverage data"
170-
uses: actions/download-artifact@v4
170+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
171171
with:
172172
pattern: metacov-*
173173
merge-multiple: true
@@ -181,7 +181,7 @@ jobs:
181181
python igor.py combine_html
182182
183183
- name: "Upload HTML report"
184-
uses: actions/upload-artifact@v4
184+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
185185
with:
186186
name: html_report
187187
path: htmlcov
@@ -234,7 +234,7 @@ jobs:
234234
235235
- name: "Download coverage HTML report"
236236
if: ${{ github.ref == 'refs/heads/master' }}
237-
uses: actions/download-artifact@v4
237+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
238238
with:
239239
name: html_report
240240
path: reports_repo/${{ env.report_dir }}
@@ -270,7 +270,7 @@ jobs:
270270
github.repository_owner == 'nedbat'
271271
&& github.ref == 'refs/heads/master'
272272
# https://gist.githubusercontent.com/nedbat/8c6980f77988a327348f9b02bbaf67f5
273-
uses: schneegans/dynamic-badges-action@e9a478b16159b4d31420099ba146cdc50f134483
273+
uses: schneegans/dynamic-badges-action@e9a478b16159b4d31420099ba146cdc50f134483 # v1.7.0
274274
with:
275275
auth: ${{ secrets.METACOV_GIST_SECRET }}
276276
gistID: 8c6980f77988a327348f9b02bbaf67f5

.github/workflows/dependency-review.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,10 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: 'Checkout Repository'
26-
uses: actions/checkout@v4
26+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
27+
2728
- name: 'Dependency Review'
28-
uses: actions/dependency-review-action@v4
29+
uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3
2930
with:
3031
base-ref: ${{ github.event.pull_request.base.sha || 'master' }}
3132
head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

.github/workflows/kit.yml

+13-13
Original file line numberDiff line numberDiff line change
@@ -143,15 +143,15 @@ jobs:
143143
steps:
144144
- name: "Setup QEMU"
145145
if: matrix.os == 'ubuntu'
146-
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
146+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
147147
with:
148148
platforms: arm64
149149

150150
- name: "Check out the repo"
151-
uses: actions/checkout@v4
151+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
152152

153153
- name: "Install Python 3.8"
154-
uses: actions/setup-python@v5
154+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
155155
with:
156156
# PYVERSIONS
157157
python-version: "3.8"
@@ -181,7 +181,7 @@ jobs:
181181
python -m twine check wheelhouse/*
182182
183183
- name: "Upload wheels"
184-
uses: actions/upload-artifact@v4
184+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
185185
with:
186186
name: dist-${{ env.MATRIX_ID }}
187187
path: wheelhouse/*.whl
@@ -192,10 +192,10 @@ jobs:
192192
runs-on: ubuntu-latest
193193
steps:
194194
- name: "Check out the repo"
195-
uses: actions/checkout@v4
195+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
196196

197197
- name: "Install Python 3.8"
198-
uses: actions/setup-python@v5
198+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
199199
with:
200200
# PYVERSIONS
201201
python-version: "3.8"
@@ -219,7 +219,7 @@ jobs:
219219
python -m twine check dist/*
220220
221221
- name: "Upload sdist"
222-
uses: actions/upload-artifact@v4
222+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
223223
with:
224224
name: dist-sdist
225225
path: dist/*.tar.gz
@@ -230,10 +230,10 @@ jobs:
230230
runs-on: ubuntu-latest
231231
steps:
232232
- name: "Check out the repo"
233-
uses: actions/checkout@v4
233+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
234234

235235
- name: "Install PyPy"
236-
uses: actions/setup-python@v5
236+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
237237
with:
238238
python-version: "pypy-3.8" # Minimum of PyPy PYVERSIONS
239239
cache: pip
@@ -261,7 +261,7 @@ jobs:
261261
python -m twine check dist/*
262262
263263
- name: "Upload wheels"
264-
uses: actions/upload-artifact@v4
264+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
265265
with:
266266
name: dist-pypy
267267
path: dist/*.whl
@@ -280,13 +280,13 @@ jobs:
280280
id-token: write
281281
steps:
282282
- name: "Download artifacts"
283-
uses: actions/download-artifact@v4
283+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
284284
with:
285285
pattern: dist-*
286286
merge-multiple: true
287287

288288
- name: "Sign artifacts"
289-
uses: sigstore/[email protected]
289+
uses: sigstore/gh-action-sigstore-python@61f6a500bbfdd9a2a339cf033e5421951fbc1cd2 # v2.1.1
290290
with:
291291
inputs: coverage-*.*
292292

@@ -295,7 +295,7 @@ jobs:
295295
ls -alR
296296
297297
- name: "Upload signatures"
298-
uses: actions/upload-artifact@v4
298+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
299299
with:
300300
name: signatures
301301
path: |

.github/workflows/publish.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
steps:
3131
- name: "Find latest kit.yml run"
3232
id: runs
33-
uses: octokit/[email protected]
33+
uses: octokit/request-action@872c5c97b3c85c23516a572f02b31401ef82415d # v2.3.1
3434
with:
3535
route: GET /repos/nedbat/coveragepy/actions/workflows/kit.yml/runs
3636
env:

.github/workflows/python-nightly.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -84,17 +84,17 @@ jobs:
8484

8585
steps:
8686
- name: "Check out the repo"
87-
uses: "actions/checkout@v4"
87+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
8888

8989
- name: "Install ${{ matrix.python-version }} with deadsnakes"
90-
uses: deadsnakes/action@6c8b9b82fe0b4344f4b98f2775fcc395df45e494
90+
uses: deadsnakes/action@6c8b9b82fe0b4344f4b98f2775fcc395df45e494 # v3.1.0
9191
if: "!startsWith(matrix.python-version, 'pypy-')"
9292
with:
9393
python-version: "${{ matrix.python-version }}"
9494
nogil: "${{ matrix.nogil || false }}"
9595

9696
- name: "Install ${{ matrix.python-version }} with setup-python"
97-
uses: "actions/setup-python@v5"
97+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
9898
if: "startsWith(matrix.python-version, 'pypy-')"
9999
with:
100100
python-version: "${{ matrix.python-version }}"

.github/workflows/quality.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ jobs:
3737

3838
steps:
3939
- name: "Check out the repo"
40-
uses: "actions/checkout@v4"
40+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
4141

4242
- name: "Install Python"
43-
uses: "actions/setup-python@v5"
43+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
4444
with:
4545
python-version: "3.8" # Minimum of PYVERSIONS
4646
cache: pip
@@ -60,10 +60,10 @@ jobs:
6060

6161
steps:
6262
- name: "Check out the repo"
63-
uses: "actions/checkout@v4"
63+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
6464

6565
- name: "Install Python"
66-
uses: "actions/setup-python@v5"
66+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
6767
with:
6868
python-version: "3.8" # Minimum of PYVERSIONS, but at least 3.8
6969
cache: pip
@@ -83,10 +83,10 @@ jobs:
8383

8484
steps:
8585
- name: "Check out the repo"
86-
uses: "actions/checkout@v4"
86+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
8787

8888
- name: "Install Python"
89-
uses: "actions/setup-python@v5"
89+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
9090
with:
9191
python-version: "3.11" # Doc version from PYVERSIONS
9292
cache: pip

.github/workflows/testsuite.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ jobs:
7474

7575
steps:
7676
- name: "Check out the repo"
77-
uses: "actions/checkout@v4"
77+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
7878

7979
- name: "Set up Python"
80-
uses: "actions/setup-python@v5"
80+
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
8181
with:
8282
python-version: "${{ matrix.python-version }}"
8383
allow-prereleases: true
@@ -123,6 +123,6 @@ jobs:
123123
runs-on: ubuntu-latest
124124
steps:
125125
- name: Decide whether the needed jobs succeeded or failed
126-
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
126+
uses: re-actors/alls-green@afee1c1eac2a506084c274e9c02c8e0687b48d9e # v1.2.2
127127
with:
128128
jobs: ${{ toJSON(needs) }}

0 commit comments

Comments
 (0)