From c0f0db2e7502bb795e198bac6cf1aba3d3780630 Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Fri, 28 Aug 2026 14:44:14 +0100 Subject: [PATCH] Pin GitHub Actions to full commit hashes --- .github/renovate.json5 | 2 +- .github/workflows/daily.yml | 16 ++++---- .github/workflows/meta_tests.yml | 16 ++++---- .github/workflows/mypy_primer.yml | 10 ++--- .github/workflows/mypy_primer_comment.yml | 7 ++-- .github/workflows/stubsabot.yml | 6 +-- .github/workflows/stubtest_stdlib.yml | 4 +- .github/workflows/stubtest_third_party.yml | 4 +- .github/workflows/tests.yml | 44 +++++++++++----------- 9 files changed, 54 insertions(+), 55 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 4fcaa043d3cb..68e6272a0922 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -2,7 +2,7 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "dependencyDashboard": true, "suppressNotifications": ["prEditedNotification"], - "extends": ["config:recommended"], + "extends": ["config:recommended", "helpers:pinGitHubActionDigests"], "labels": ["bot: dependencies"], "rebaseLabel": ["bot: rebase"], "semanticCommits": "disabled", diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index bda568659b9f..971051437762 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -43,9 +43,9 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} cache: pip @@ -67,8 +67,8 @@ jobs: shard-index: [0, 1, 2, 3] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" cache: pip @@ -115,15 +115,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout typeshed - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: path: typeshed - name: Checkout stub_uploader - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: repository: typeshed-internal/stub_uploader path: stub_uploader - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "typeshed/requirements-tests.txt" - name: Run tests @@ -141,7 +141,7 @@ jobs: permissions: issues: write steps: - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/meta_tests.yml b/.github/workflows/meta_tests.yml index 2c1dbc8f9a13..5dfd2b261284 100644 --- a/.github/workflows/meta_tests.yml +++ b/.github/workflows/meta_tests.yml @@ -35,8 +35,8 @@ jobs: platform: ["linux", "win32"] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v8.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Run check_typeshed_structure.py @@ -56,16 +56,16 @@ jobs: python-platform: ["Linux", "Windows"] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - run: uv pip install -r requirements-tests.txt --system - name: Run pyright on typeshed - uses: jakebailey/pyright-action@v3 + uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3 with: version: PATH python-platform: ${{ matrix.python-platform }} @@ -76,8 +76,8 @@ jobs: name: "stubsabot: dry run" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v8.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Git config diff --git a/.github/workflows/mypy_primer.yml b/.github/workflows/mypy_primer.yml index 43b42076ed41..ad9dc3d45a20 100644 --- a/.github/workflows/mypy_primer.yml +++ b/.github/workflows/mypy_primer.yml @@ -25,11 +25,11 @@ jobs: shard-index: [0, 1, 2, 3, 4, 5] fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: path: typeshed_to_test fetch-depth: 0 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" - name: Install dependencies @@ -62,7 +62,7 @@ jobs: run: | echo ${{ github.event.pull_request.number }} | tee pr_number.txt - name: Upload mypy_primer diff + PR number - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ matrix.shard-index == 0 }} with: name: mypy_primer_diffs-${{ matrix.shard-index }} @@ -70,7 +70,7 @@ jobs: diff_${{ matrix.shard-index }}.txt pr_number.txt - name: Upload mypy_primer diff - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ matrix.shard-index != 0 }} with: name: mypy_primer_diffs-${{ matrix.shard-index }} @@ -84,7 +84,7 @@ jobs: contents: read steps: - name: Merge artifacts - uses: actions/upload-artifact/merge@v7 + uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: mypy_primer_diffs pattern: mypy_primer_diffs-* diff --git a/.github/workflows/mypy_primer_comment.yml b/.github/workflows/mypy_primer_comment.yml index 4442d69111b9..57aedb865c3c 100644 --- a/.github/workflows/mypy_primer_comment.yml +++ b/.github/workflows/mypy_primer_comment.yml @@ -18,7 +18,7 @@ jobs: if: ${{ github.event.workflow_run.conclusion == 'success' }} steps: - name: Download diffs - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: script: | const fs = require('fs'); @@ -44,7 +44,7 @@ jobs: - name: Post comment id: post-comment - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -79,8 +79,7 @@ jobs: return prNumber - name: Hide old comments - # v0.4.0 - uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf + uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf # v0.4.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} leave_visible: 1 diff --git a/.github/workflows/stubsabot.yml b/.github/workflows/stubsabot.yml index 527fd8899310..3935eee29ed6 100644 --- a/.github/workflows/stubsabot.yml +++ b/.github/workflows/stubsabot.yml @@ -19,12 +19,12 @@ jobs: if: github.repository == 'python/typeshed' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: # use an ssh key so that checks automatically run on stubsabot PRs ssh-key: ${{ secrets.STUBSABOT_SSH_PRIVATE_KEY }} fetch-depth: 0 - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Git config @@ -48,7 +48,7 @@ jobs: needs: [stubsabot] if: ${{ github.repository == 'python/typeshed' && always() && (needs.stubsabot.result == 'failure') }} steps: - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/stubtest_stdlib.yml b/.github/workflows/stubtest_stdlib.yml index 5a4ad30473f6..5587e4e67bde 100644 --- a/.github/workflows/stubtest_stdlib.yml +++ b/.github/workflows/stubtest_stdlib.yml @@ -39,9 +39,9 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} cache: pip diff --git a/.github/workflows/stubtest_third_party.yml b/.github/workflows/stubtest_third_party.yml index 540a609ca1c2..e7d626572c79 100644 --- a/.github/workflows/stubtest_third_party.yml +++ b/.github/workflows/stubtest_third_party.yml @@ -36,10 +36,10 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" cache: pip diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ba4ce98734ee..14d4fc0c6b8b 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -26,8 +26,8 @@ jobs: name: Check typeshed structure runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v8.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Run check_typeshed_structure.py @@ -47,12 +47,12 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} allow-prereleases: true - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - run: uv pip install -r requirements-tests.txt --system @@ -70,8 +70,8 @@ jobs: name: "mypy: regression tests" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v8.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Run regr_test.py @@ -94,11 +94,11 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.14" - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Install typeshed test-suite requirements @@ -127,11 +127,11 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.14" - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Install typeshed test-suite requirements @@ -161,11 +161,11 @@ jobs: python-version: ["3.11", "3.12", "3.13", "3.14"] fail-fast: false steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" - name: Install typeshed test-suite requirements @@ -192,14 +192,14 @@ jobs: - name: List 3rd-party stub dependencies installed run: uv pip freeze - name: Run pyright with basic settings on all the stubs - uses: jakebailey/pyright-action@v3 + uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3 with: version: PATH python-platform: ${{ matrix.python-platform }} python-version: ${{ matrix.python-version }} annotate: ${{ matrix.python-version == '3.13' && matrix.python-platform == 'Linux' }} # Having each job create the same comment is too noisy. - name: Run pyright with stricter settings on some of the stubs - uses: jakebailey/pyright-action@v3 + uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3 with: version: PATH python-platform: ${{ matrix.python-platform }} @@ -207,7 +207,7 @@ jobs: annotate: ${{ matrix.python-version == '3.13' && matrix.python-platform == 'Linux' }} # Having each job create the same comment is too noisy. project: ./pyrightconfig.stricter.json - name: Run pyright on the test cases - uses: jakebailey/pyright-action@v3 + uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3 with: version: PATH python-platform: ${{ matrix.python-platform }} @@ -220,15 +220,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout typeshed - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: path: typeshed - name: Checkout stub_uploader - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: repository: typeshed-internal/stub_uploader path: stub_uploader - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "typeshed/requirements-tests.txt" - name: Run tests