From bb116c67a533fba1b798199c58f24a2c0800f087 Mon Sep 17 00:00:00 2001 From: erni Date: Sat, 19 Sep 2026 18:04:22 +0300 Subject: [PATCH] chore(ci): pin actions/checkout, setup-node and setup-python to commit SHAs in the 11 workflows that still floated @v7 Closes #1399. Seven of the eleven are the publish workflows that hold npm and PyPI credentials, so they are where a retagged upstream action matters most. Reuses the exact SHAs ci.yml and legacy-name-ratchet.yml already pin, so every workflow lands on one version per action: actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 v7.0.1 actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 v7.0.0 actions/setup-python 5fda3b95a4ea91299a34e894583c3862153e4b97 v7.0.0 Dependabot's github-actions entry understands SHA pins, so updates keep flowing. Verified: grep -rn 'uses: [a-zA-Z].*@v[0-9]' .github/workflows/ prints nothing. Signed-off-by: erni --- .github/workflows/claude_code_review.yml | 6 +++--- .github/workflows/client-python-ci.yml | 4 ++-- .github/workflows/client-typescript-ci.yml | 4 ++-- .github/workflows/publish-npm-caura-client.yml | 4 ++-- .github/workflows/publish-npm-caura-sdk.yml | 4 ++-- .github/workflows/publish-npm-client.yml | 4 ++-- .github/workflows/publish-npm-sdk.yml | 4 ++-- .github/workflows/publish-python-client.yml | 4 ++-- .github/workflows/publish-python-metapackage.yml | 4 ++-- .github/workflows/publish-python-sdk.yml | 4 ++-- .github/workflows/verify-npm-credential.yml | 4 ++-- 11 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/claude_code_review.yml b/.github/workflows/claude_code_review.yml index 893e882c3..1426ff49f 100644 --- a/.github/workflows/claude_code_review.yml +++ b/.github/workflows/claude_code_review.yml @@ -337,7 +337,7 @@ jobs: # review script (lets a workflow/script change self-test on its own PR). # Secrets are withheld from fork-PR runs and pre-checks gate the rest. - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 1 @@ -447,7 +447,7 @@ jobs: # which doesn't exist in the base repo, so checkout exited 1 (.github#111). - name: Checkout base repo (trusted review script) if: steps.auth.outputs.authorized == 'true' && steps.pr.outputs.is_pr == 'true' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 1 @@ -503,7 +503,7 @@ jobs: # request 403s without it. pull-requests: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 1 diff --git a/.github/workflows/client-python-ci.yml b/.github/workflows/client-python-ci.yml index 16f79b17b..b10ef905e 100644 --- a/.github/workflows/client-python-ci.yml +++ b/.github/workflows/client-python-ci.yml @@ -18,10 +18,10 @@ jobs: run: working-directory: clients/python steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Install diff --git a/.github/workflows/client-typescript-ci.yml b/.github/workflows/client-typescript-ci.yml index a5e47a023..c2cae415d 100644 --- a/.github/workflows/client-typescript-ci.yml +++ b/.github/workflows/client-typescript-ci.yml @@ -18,10 +18,10 @@ jobs: run: working-directory: clients/typescript steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" - name: Install diff --git a/.github/workflows/publish-npm-caura-client.yml b/.github/workflows/publish-npm-caura-client.yml index e39f3ae99..eb5818010 100644 --- a/.github/workflows/publish-npm-caura-client.yml +++ b/.github/workflows/publish-npm-caura-client.yml @@ -45,10 +45,10 @@ jobs: run: working-directory: clients/npm-caura-client steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-npm-caura-sdk.yml b/.github/workflows/publish-npm-caura-sdk.yml index a4d277a22..b100e8afe 100644 --- a/.github/workflows/publish-npm-caura-sdk.yml +++ b/.github/workflows/publish-npm-caura-sdk.yml @@ -45,10 +45,10 @@ jobs: run: working-directory: clients/npm-caura-sdk steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-npm-client.yml b/.github/workflows/publish-npm-client.yml index 1fffce37d..6874e3329 100644 --- a/.github/workflows/publish-npm-client.yml +++ b/.github/workflows/publish-npm-client.yml @@ -45,10 +45,10 @@ jobs: run: working-directory: clients/typescript steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-npm-sdk.yml b/.github/workflows/publish-npm-sdk.yml index 90596706d..96ec6ed7f 100644 --- a/.github/workflows/publish-npm-sdk.yml +++ b/.github/workflows/publish-npm-sdk.yml @@ -45,10 +45,10 @@ jobs: run: working-directory: clients/npm-sdk steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-python-client.yml b/.github/workflows/publish-python-client.yml index 56ce51335..be917ab63 100644 --- a/.github/workflows/publish-python-client.yml +++ b/.github/workflows/publish-python-client.yml @@ -46,10 +46,10 @@ jobs: exit 1 fi echo "OIDC token-request context is present" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" # A tag that disagrees with pyproject.toml does not fail — it publishes diff --git a/.github/workflows/publish-python-metapackage.yml b/.github/workflows/publish-python-metapackage.yml index d61d865b2..a717420e4 100644 --- a/.github/workflows/publish-python-metapackage.yml +++ b/.github/workflows/publish-python-metapackage.yml @@ -47,10 +47,10 @@ jobs: exit 1 fi echo "OIDC token-request context is present" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" # This package was created under the Caura name and has no legacy tag diff --git a/.github/workflows/publish-python-sdk.yml b/.github/workflows/publish-python-sdk.yml index 0bb7bbec3..a7140f34e 100644 --- a/.github/workflows/publish-python-sdk.yml +++ b/.github/workflows/publish-python-sdk.yml @@ -50,10 +50,10 @@ jobs: exit 1 fi echo "OIDC token-request context is present" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" # This package was created under the Caura name and has no legacy tag diff --git a/.github/workflows/verify-npm-credential.yml b/.github/workflows/verify-npm-credential.yml index bac7f78e7..1d3286adb 100644 --- a/.github/workflows/verify-npm-credential.yml +++ b/.github/workflows/verify-npm-credential.yml @@ -44,10 +44,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" registry-url: "https://registry.npmjs.org"