Skip to content

Commit fb15efa

Browse files
committed
build: pin hashes for publishing actions
1 parent c20af95 commit fb15efa

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

.github/workflows/publish.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,14 @@ jobs:
3232

3333
steps:
3434
- name: "Download dists"
35-
uses: actions/download-artifact@v4
35+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
3636
with:
3737
pattern: "dist-*"
3838
merge-multiple: true
3939
path: "dist/"
4040

4141
- name: "Publish dists to Test PyPI"
42-
uses: pypa/gh-action-pypi-publish@v1
42+
uses: pypa/gh-action-pypi-publish@4bb033805d9e19112d8c697528791ff53f6c2f74 # v1.9.0
4343
with:
4444
repository-url: https://test.pypi.org/legacy/
4545
print-hash: true
@@ -56,14 +56,14 @@ jobs:
5656

5757
steps:
5858
- name: "Download dists"
59-
uses: actions/download-artifact@v4
59+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
6060
with:
6161
pattern: "dist-*"
6262
merge-multiple: true
6363
path: "dist/"
6464

6565
- name: "Publish dists to PyPI"
66-
uses: pypa/gh-action-pypi-publish@v1
66+
uses: pypa/gh-action-pypi-publish@4bb033805d9e19112d8c697528791ff53f6c2f74 # v1.9.0
6767
with:
6868
print-hash: true
6969
verbose: true

0 commit comments

Comments
 (0)