From b5908024e484cea33b2237882274f488c23af2dc Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Tue, 1 Sep 2026 12:38:55 +0100 Subject: [PATCH] Pin GitHub Actions to full commit hashes --- .github/workflows/build_wheels.yml | 4 ++-- .github/workflows/docs.yml | 4 ++-- .github/workflows/mypy_primer.yml | 10 +++++----- .github/workflows/mypy_primer_comment.yml | 4 ++-- .github/workflows/sync_typeshed.yml | 4 ++-- .github/workflows/test.yml | 8 ++++---- .github/workflows/test_stubgenc.yml | 4 ++-- 7 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml index dae4937d5081d..2a830efe7faa3 100644 --- a/.github/workflows/build_wheels.yml +++ b/.github/workflows/build_wheels.yml @@ -13,10 +13,10 @@ jobs: if: github.repository == 'python/mypy' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.11' - name: Trigger script diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index b8303342a254c..955277cf023ac 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -37,10 +37,10 @@ jobs: TOX_SKIP_MISSING_INTERPRETERS: False VERIFY_MYPY_ERROR_CODES: 1 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.12' - name: Install tox diff --git a/.github/workflows/mypy_primer.yml b/.github/workflows/mypy_primer.yml index 478dc09c3d464..654cdf2c5cf11 100644 --- a/.github/workflows/mypy_primer.yml +++ b/.github/workflows/mypy_primer.yml @@ -32,12 +32,12 @@ jobs: fail-fast: false timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: path: mypy_to_test fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.14" - name: Install dependencies @@ -75,7 +75,7 @@ jobs: run: | echo ${{ github.event.pull_request.number }} | tee pr_number.txt - name: Upload mypy_primer diff + PR number - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 if: ${{ matrix.shard-index == 0 }} with: name: mypy_primer_diffs-${{ matrix.shard-index }} @@ -83,7 +83,7 @@ jobs: diff_${{ matrix.shard-index }}.txt pr_number.txt - name: Upload mypy_primer diff - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 if: ${{ matrix.shard-index != 0 }} with: name: mypy_primer_diffs-${{ matrix.shard-index }} @@ -95,7 +95,7 @@ jobs: needs: [mypy_primer] steps: - name: Merge artifacts - uses: actions/upload-artifact/merge@v4 + uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: mypy_primer_diffs pattern: mypy_primer_diffs-* diff --git a/.github/workflows/mypy_primer_comment.yml b/.github/workflows/mypy_primer_comment.yml index 21f1222a5b893..48c5ef4adc927 100644 --- a/.github/workflows/mypy_primer_comment.yml +++ b/.github/workflows/mypy_primer_comment.yml @@ -19,7 +19,7 @@ jobs: if: ${{ github.event.workflow_run.conclusion == 'success' }} steps: - name: Download diffs - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const fs = require('fs'); @@ -45,7 +45,7 @@ jobs: - name: Post comment id: post-comment - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/sync_typeshed.yml b/.github/workflows/sync_typeshed.yml index 2d5361a5919ce..41ee9f513308e 100644 --- a/.github/workflows/sync_typeshed.yml +++ b/.github/workflows/sync_typeshed.yml @@ -17,13 +17,13 @@ jobs: pull-requests: write timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 persist-credentials: true # needed to `git push` the PR branch # TODO: use whatever solution ends up working for # https://github.com/python/typeshed/issues/8434 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.10" - name: git config diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b06f181746c35..3b6a9dea66513 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -160,7 +160,7 @@ jobs: PYTEST_ADDOPTS: --color=yes steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false @@ -198,7 +198,7 @@ jobs: sudo ln -s /opt/pythondev/bin/python3 /opt/pythondev/bin/python sudo ln -s /opt/pythondev/bin/pip3 /opt/pythondev/bin/pip echo "/opt/pythondev/bin" >> $GITHUB_PATH - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 if: ${{ !(matrix.debug_build || endsWith(matrix.python, '-dev')) }} with: python-version: ${{ matrix.python }} @@ -253,7 +253,7 @@ jobs: CXX: i686-linux-gnu-g++ CC: i686-linux-gnu-gcc steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: Install 32-bit build dependencies @@ -273,7 +273,7 @@ jobs: liblzma-dev:i386 \ uuid-dev:i386 - name: Compile, install, and activate 32-bit Python - uses: gabrielfalcao/pyenv-action@v13 + uses: gabrielfalcao/pyenv-action@5668dcb49bd9d228bba29dd5e1fbb6e0aae55a71 # v13 with: default: 3.11.1 command: python -c "import platform; print(f'{platform.architecture()=} {platform.machine()=}');" diff --git a/.github/workflows/test_stubgenc.yml b/.github/workflows/test_stubgenc.yml index 7102b6513ddc2..bc381118c55f7 100644 --- a/.github/workflows/test_stubgenc.yml +++ b/.github/workflows/test_stubgenc.yml @@ -28,12 +28,12 @@ jobs: timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: Setup 🐍 3.10 - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.10'