From de27d0f466c0103e0e010588914afbb948dbd9fc Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:05:43 +0000 Subject: [PATCH 1/2] fix(security): autofix 3rd party Github Actions should be pinned --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 927a465..12e6b3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: working-directory: python steps: - uses: actions/checkout@v4 - - uses: astral-sh/setup-uv@v5 + - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2 with: python-version: ${{ matrix.python-version }} # Keep uv.lock in step with pyproject.toml. Dependency scanners read the diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b88c178..61d7bd8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -118,7 +118,7 @@ jobs: # Authenticates through PyPI trusted publishing (OIDC). No API token is # stored: PyPI verifies this repository, workflow file, and environment. - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 with: packages-dir: dist/ skip-existing: true From 007f1e5abbaa18ffd3baf4e9aa259fd488a15ed3 Mon Sep 17 00:00:00 2001 From: Corvin Jaedicke Date: Wed, 23 Sep 2026 16:10:21 +0200 Subject: [PATCH 2/2] fix(ci): pin remaining uv setup invocation --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 12e6b3c..08d33e5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,7 +48,7 @@ jobs: working-directory: python steps: - uses: actions/checkout@v4 - - uses: astral-sh/setup-uv@v5 + - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2 with: python-version: "3.12" - uses: actions/cache@v4