Skip to content

Pin GitHub Actions to commit hashes with version tags #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shenxianpeng merged 5 commits into from
Dec 13, 2025
Merged

Pin GitHub Actions to commit hashes with version tags #7

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
029f761
Initial plan
Copilot Dec 13, 2025
032b913
Pin GitHub Actions to commit hashes with version tags
Copilot Dec 13, 2025
ffc487a
Use specific patch versions in action comments for consistency
Copilot Dec 13, 2025
f8f9748
Update release.yml
shenxianpeng Dec 13, 2025
509dace
Update release.yml
shenxianpeng Dec 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 22 additions & 22 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ jobs:
arch: "arm64"

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
sparse-checkout: |
clang-format
Expand All @@ -113,7 +113,7 @@ jobs:

- name: Set up msvc on Windows
if: runner.os == 'Windows'
uses: ilammy/msvc-dev-cmd@v1
uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
with:
arch: ${{ matrix.arch }}

Expand All @@ -130,19 +130,19 @@ jobs:
cat clang-format_version.txt

- name: Set up QEMU
uses: docker/setup-qemu-action@v3.7.0
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
with:
image: tonistiigi/binfmt:qemu-v8.1.5
if: runner.os == 'Linux' && matrix.emulation == 'qemu'

- name: Build wheels
uses: pypa/cibuildwheel@v3.3.0
uses: pypa/cibuildwheel@63fd63b352a9a8bdcc24791c9dbee952ee9a8abc # v3.3.0
env:
CIBW_ARCHS: "${{ matrix.arch }}"
# restrict to a single Python version as wheel does not depend on Python:
CIBW_BUILD: "cp311-${{ matrix.platform }}*"

- uses: actions/upload-artifact@v5
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
with:
name: clang-format-wheels-${{ matrix.platform }}-${{ matrix.arch }}
path: ./wheelhouse/*.whl
Expand Down Expand Up @@ -186,7 +186,7 @@ jobs:
arch: "arm64"

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
sparse-checkout: |
clang-tidy
Expand All @@ -212,7 +212,7 @@ jobs:

- name: Set up msvc on Windows
if: runner.os == 'Windows'
uses: ilammy/msvc-dev-cmd@v1
uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
with:
arch: ${{ matrix.arch }}

Expand All @@ -227,7 +227,7 @@ jobs:
cat clang-tidy_version.txt

- name: Build wheels
uses: pypa/cibuildwheel@v3.3.0
uses: pypa/cibuildwheel@63fd63b352a9a8bdcc24791c9dbee952ee9a8abc # v3.3.0
env:
CIBW_ARCHS: "${{ matrix.arch }}"
CIBW_BEFORE_TEST: rm -rf {package}/clang_tidy
Expand All @@ -237,7 +237,7 @@ jobs:
# restrict to a single Python version as wheel does not depend on Python:
CIBW_BUILD: "cp311-${{ matrix.platform }}*"

- uses: actions/upload-artifact@v5
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
with:
name: clang-tidy-wheels-${{ matrix.platform }}-${{ matrix.arch }}
path: ./wheelhouse/*.whl
Expand All @@ -247,7 +247,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
sparse-checkout: |
clang-format
Expand Down Expand Up @@ -276,7 +276,7 @@ jobs:
- name: Build SDist
run: pipx run build --sdist

- uses: actions/upload-artifact@v5
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
with:
name: clang-format-sdist
path: dist/*.tar.gz
Expand All @@ -286,7 +286,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
sparse-checkout: |
clang-tidy
Expand Down Expand Up @@ -315,7 +315,7 @@ jobs:
- name: Build SDist
run: pipx run build --sdist

- uses: actions/upload-artifact@v5
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
with:
path: dist/*.tar.gz
name: clang-tidy-sdist
Expand All @@ -326,7 +326,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
sparse-checkout: |
clang-format
Expand All @@ -346,12 +346,12 @@ jobs:
rm -rf clang-format
fi

- uses: actions/setup-python@v6
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
name: Install Python
with:
python-version: '3.13'

- uses: actions/download-artifact@v6
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: clang-format-sdist
path: sdist
Expand Down Expand Up @@ -380,7 +380,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
sparse-checkout: |
clang-tidy
Expand All @@ -400,12 +400,12 @@ jobs:
rm -rf clang-tidy
fi

- uses: actions/setup-python@v6
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
name: Install Python
with:
python-version: '3.13'

- uses: actions/download-artifact@v6
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: clang-tidy-sdist
path: sdist
Expand Down Expand Up @@ -439,13 +439,13 @@ jobs:
contents: write

steps:
- uses: actions/download-artifact@v6
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
pattern: clang-format-*
merge-multiple: true
path: clang-format-dist

- uses: actions/download-artifact@v6
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
pattern: clang-tidy-*
merge-multiple: true
Expand All @@ -465,7 +465,7 @@ jobs:
ls -la release-assets/

- name: Create draft release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
Copy link

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The version comment uses "v2" without a specific patch version, which is inconsistent with other actions in this PR that use specific patch versions (e.g., v6.0.1, v3.7.0). Consider using a more specific version tag like "v2.x.x" for consistency and clarity, or verify that v2 is indeed the most specific tag available for this action.

Copilot uses AI. Check for mistakes.
if: github.event_name == 'workflow_dispatch' # only create release on manual trigger
with:
draft: true
Expand Down
Loading