From 013866cc7933b7fe8a96b0608e59ebf8b6a7870f Mon Sep 17 00:00:00 2001 From: IC-1101asterisk <77051033+IC-1101asterisk@users.noreply.github.com> Date: Tue, 7 Jul 2026 11:01:27 +0000 Subject: [PATCH] chore: pin GitHub Actions to commit SHAs Pin third-party GitHub Actions referenced in workflows to immutable commit SHAs, with the original ref kept as a comment. --- .github/workflows/_build_container.yml | 4 ++-- .github/workflows/build-docs.yml | 2 +- .github/workflows/build-test-publish-wheel.yml | 2 +- .github/workflows/cherry-pick-release-commit.yml | 2 +- .github/workflows/close-inactive-issue-pr.yml | 2 +- .github/workflows/code-linting.yml | 2 +- .github/workflows/copyright-check.yml | 2 +- .github/workflows/release-freeze.yml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/secrets-detector.yml | 2 +- .github/workflows/unit-tests.yml | 2 +- 11 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/_build_container.yml b/.github/workflows/_build_container.yml index e3d9bd8554..6b8404d550 100644 --- a/.github/workflows/_build_container.yml +++ b/.github/workflows/_build_container.yml @@ -43,7 +43,7 @@ jobs: cache-from: ${{ steps.cache-from.outputs.LAST_PRS }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Get last merged PR id: cache-from @@ -68,7 +68,7 @@ jobs: echo "EOF" >> $GITHUB_OUTPUT build: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_container.yml@v0.55.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_container.yml@d7f020b83b60462b762eca9c24403e976dc549f2 # v0.55.0 needs: [pre-flight] with: image-name: ${{ inputs.image-name }} diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml index 6be8c667aa..9ce5ff1011 100644 --- a/.github/workflows/build-docs.yml +++ b/.github/workflows/build-docs.yml @@ -22,4 +22,4 @@ on: jobs: build-docs: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@v0.55.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@d7f020b83b60462b762eca9c24403e976dc549f2 # v0.55.0 diff --git a/.github/workflows/build-test-publish-wheel.yml b/.github/workflows/build-test-publish-wheel.yml index 24a341c9ab..8c02656d4f 100644 --- a/.github/workflows/build-test-publish-wheel.yml +++ b/.github/workflows/build-test-publish-wheel.yml @@ -27,7 +27,7 @@ defaults: jobs: build-test-publish-wheel: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_test_publish_wheel.yml@v0.55.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_test_publish_wheel.yml@d7f020b83b60462b762eca9c24403e976dc549f2 # v0.55.0 if: ${{ vars.BUILD_TEST_PUBLISH_WHEEL == 'true' }} with: dry-run: true diff --git a/.github/workflows/cherry-pick-release-commit.yml b/.github/workflows/cherry-pick-release-commit.yml index cf0fc2bb9f..2ec7c32f85 100644 --- a/.github/workflows/cherry-pick-release-commit.yml +++ b/.github/workflows/cherry-pick-release-commit.yml @@ -21,7 +21,7 @@ on: jobs: cherry-pick: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@v0.63.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@8ebb3aec4c246c944a25adc7b09107cbd6a76976 # v0.63.0 secrets: PAT: ${{ secrets.PAT }} SLACK_WEBHOOK_ADMIN: ${{ secrets.SLACK_WEBHOOK_ADMIN }} diff --git a/.github/workflows/close-inactive-issue-pr.yml b/.github/workflows/close-inactive-issue-pr.yml index 374a18bfea..b4bb578dd4 100644 --- a/.github/workflows/close-inactive-issue-pr.yml +++ b/.github/workflows/close-inactive-issue-pr.yml @@ -24,7 +24,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v6 + - uses: actions/stale@5ebf00ea0e4c1561e9b43a292ed34424fb1d4578 # v6 with: operations-per-run: 100 days-before-issue-stale: 30 diff --git a/.github/workflows/code-linting.yml b/.github/workflows/code-linting.yml index 95688888b5..83cad36d90 100644 --- a/.github/workflows/code-linting.yml +++ b/.github/workflows/code-linting.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: 'recursive' diff --git a/.github/workflows/copyright-check.yml b/.github/workflows/copyright-check.yml index 866d887137..6af2855c9f 100644 --- a/.github/workflows/copyright-check.yml +++ b/.github/workflows/copyright-check.yml @@ -19,4 +19,4 @@ on: jobs: copyright-check: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@v0.55.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@d7f020b83b60462b762eca9c24403e976dc549f2 # v0.55.0 diff --git a/.github/workflows/release-freeze.yml b/.github/workflows/release-freeze.yml index 5f202d50d3..9773c0749e 100644 --- a/.github/workflows/release-freeze.yml +++ b/.github/workflows/release-freeze.yml @@ -35,7 +35,7 @@ on: default: true jobs: code-freeze: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_code_freeze.yml@v0.55.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_code_freeze.yml@d7f020b83b60462b762eca9c24403e976dc549f2 # v0.55.0 with: library-name: NeMo-Gym python-package: nemo_gym diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2af8c95d81..45a4061383 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -38,7 +38,7 @@ on: jobs: release: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@v0.55.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@d7f020b83b60462b762eca9c24403e976dc549f2 # v0.55.0 with: release-ref: ${{ inputs.release-ref }} python-package: nemo_gym diff --git a/.github/workflows/secrets-detector.yml b/.github/workflows/secrets-detector.yml index c8c94bbef4..90d60f40f9 100644 --- a/.github/workflows/secrets-detector.yml +++ b/.github/workflows/secrets-detector.yml @@ -18,4 +18,4 @@ on: jobs: secrets-detector: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@v0.65.13 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@845ca1e302e9592b067c7696e372fa63fd1b8b6f # v0.65.13 diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 532b832ad2..fbc03c229a 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: 'recursive'