From 67c14fea600a5ed6d1875384832352ed73e775be Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Fri, 27 Mar 2026 11:08:24 -0700 Subject: [PATCH] chore(ci): pin actions in PR-triggered workflows --- .github/workflows/check-md-link.yml | 4 ++- .github/workflows/codeql.yml | 8 +++-- .github/workflows/license_check.yml | 4 ++- .github/workflows/python-ci-docs.yml | 6 ++-- .github/workflows/python-ci.yml | 52 ++++++++++++++++++---------- 5 files changed, 48 insertions(+), 26 deletions(-) diff --git a/.github/workflows/check-md-link.yml b/.github/workflows/check-md-link.yml index 4a77e78436..cba684b886 100644 --- a/.github/workflows/check-md-link.yml +++ b/.github/workflows/check-md-link.yml @@ -39,5 +39,7 @@ jobs: markdown-link-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@master + - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master + with: + persist-credentials: false - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 17bfd8bf3d..75c10c7eaf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,14 +41,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@d4b3ca9fa7f69d38bfcd667bdc45bc373d16277e # v4 with: languages: actions - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@d4b3ca9fa7f69d38bfcd667bdc45bc373d16277e # v4 with: category: "/language:actions" diff --git a/.github/workflows/license_check.yml b/.github/workflows/license_check.yml index daf0b2f102..951811a444 100644 --- a/.github/workflows/license_check.yml +++ b/.github/workflows/license_check.yml @@ -27,5 +27,7 @@ jobs: rat: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - run: dev/check-license diff --git a/.github/workflows/python-ci-docs.yml b/.github/workflows/python-ci-docs.yml index 4821435d77..23f19cf1a2 100644 --- a/.github/workflows/python-ci-docs.yml +++ b/.github/workflows/python-ci-docs.yml @@ -38,8 +38,10 @@ jobs: runs-on: ubuntu-slim steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: 3.12 - name: Install UV diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index 205f6b3022..f011b97fc4 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -55,8 +55,10 @@ jobs: python: ['3.10', '3.11', '3.12', '3.13'] steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ matrix.python }} - name: Install UV @@ -79,8 +81,10 @@ jobs: integration-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.12' - name: Install UV @@ -97,7 +101,7 @@ jobs: if: ${{ failure() }} run: docker compose -f dev/docker-compose-integration.yml logs - name: Upload coverage data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: coverage-integration path: .coverage* @@ -106,8 +110,10 @@ jobs: integration-test-s3: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.12' - name: Install UV @@ -124,7 +130,7 @@ jobs: if: ${{ failure() }} run: docker compose -f dev/docker-compose.yml logs - name: Upload coverage data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: coverage-s3 path: .coverage* @@ -133,8 +139,10 @@ jobs: integration-test-adls: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.12' - name: Install UV @@ -151,7 +159,7 @@ jobs: if: ${{ failure() }} run: docker compose -f dev/docker-compose-azurite.yml logs - name: Upload coverage data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: coverage-adls path: .coverage* @@ -160,8 +168,10 @@ jobs: integration-test-gcs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.12' - name: Install UV @@ -178,7 +188,7 @@ jobs: if: ${{ failure() }} run: docker compose -f dev/docker-compose-gcs-server.yml logs - name: Upload coverage data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: coverage-gcs path: .coverage* @@ -188,8 +198,10 @@ jobs: runs-on: ubuntu-latest needs: [integration-test, integration-test-s3, integration-test-adls, integration-test-gcs] steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.12' - name: Install UV @@ -199,7 +211,7 @@ jobs: - name: Install dependencies run: uv sync --group dev - name: Download all coverage artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: coverage-* merge-multiple: true @@ -209,8 +221,10 @@ jobs: cibw-dev-env-smoke-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.12' - name: Install UV