From 5a56f5d463a5a8e30e65ce8d2ccc259aed202e33 Mon Sep 17 00:00:00 2001 From: Masen Furer Date: Mon, 5 Oct 2026 13:22:21 -0700 Subject: [PATCH] chore(ci): update reviewed SHA-pinned workflow actions --- .github/actions/bench_history/action.yml | 2 +- .github/actions/setup_build_env/action.yml | 4 ++-- .github/workflows/auto_release_internal.yml | 4 ++-- .github/workflows/benchmarks_daily.yml | 6 +++--- .github/workflows/build_packages.yml | 8 ++++---- .github/workflows/changelog.yml | 4 ++-- .github/workflows/check_node_latest.yml | 4 ++-- .../workflows/check_outdated_dependencies.yml | 4 ++-- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/dependency-review.yml | 2 +- .github/workflows/dispatch_release.yml | 4 ++-- .github/workflows/docs_tests.yml | 6 +++--- .github/workflows/docs_whitelist.yml | 2 +- .github/workflows/examples.yml | 4 ++-- .github/workflows/integration_app_harness.yml | 8 ++++---- .github/workflows/integration_tests.yml | 18 +++++++++--------- .github/workflows/macro_benchmarks.yml | 6 +++--- .github/workflows/performance.yml | 14 +++++++------- .github/workflows/pre-commit.yml | 4 ++-- .github/workflows/publish.yml | 18 +++++++++--------- .../workflows/reflex_init_in_docker_test.yml | 6 +++--- .github/workflows/release_from_changelog.yml | 4 ++-- .github/workflows/size_budgets.yml | 2 +- .github/workflows/unit_tests.yml | 8 ++++---- .../news/+workflow-action-pins.misc.md | 1 + .../workflows/auto_release_internal.yml | 4 ++-- .../templates/workflows/changelog.yml | 4 ++-- .../templates/workflows/dispatch_release.yml | 4 ++-- .../templates/workflows/publish.yml | 18 +++++++++--------- .../workflows/release_from_changelog.yml | 4 ++-- 30 files changed, 93 insertions(+), 92 deletions(-) create mode 100644 packages/reflex-release/news/+workflow-action-pins.misc.md diff --git a/.github/actions/bench_history/action.yml b/.github/actions/bench_history/action.yml index 12eb0ff26bb..bbaf69aa611 100644 --- a/.github/actions/bench_history/action.yml +++ b/.github/actions/bench_history/action.yml @@ -17,7 +17,7 @@ runs: using: composite steps: - name: Check out the benchmark-data branch - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: benchmark-data path: .benchmark-data diff --git a/.github/actions/setup_build_env/action.yml b/.github/actions/setup_build_env/action.yml index d412ae82ab0..8f89207e957 100644 --- a/.github/actions/setup_build_env/action.yml +++ b/.github/actions/setup_build_env/action.yml @@ -31,7 +31,7 @@ runs: using: "composite" steps: - name: Install UV - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: python-version: ${{ inputs.python-version }} enable-cache: true @@ -40,7 +40,7 @@ runs: cache-dependency-glob: "uv.lock" working-directory: ${{ inputs.working-directory }} - name: Setup Node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - name: Install Dependencies diff --git a/.github/workflows/auto_release_internal.yml b/.github/workflows/auto_release_internal.yml index 1735f86d510..9ca0c022d86 100644 --- a/.github/workflows/auto_release_internal.yml +++ b/.github/workflows/auto_release_internal.yml @@ -37,11 +37,11 @@ jobs: # The whole pushed range has to be reachable: the paths filter above # matches every commit in the push, so detection must diff the same range # rather than only the last commit. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" diff --git a/.github/workflows/benchmarks_daily.yml b/.github/workflows/benchmarks_daily.yml index 64a51731ad1..281380db1c8 100644 --- a/.github/workflows/benchmarks_daily.yml +++ b/.github/workflows/benchmarks_daily.yml @@ -58,7 +58,7 @@ jobs: runs-on: ubuntu-24.04-arm steps: # fetch-tags/fetch-depth: the workspace packages derive their versions from git. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -75,7 +75,7 @@ jobs: - name: Read the Playwright version id: playwright run: echo "version=$(uv run --no-sync python -c 'from importlib.metadata import version; print(version("playwright"))')" >> "$GITHUB_OUTPUT" - - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ runner.arch }}-${{ steps.playwright.outputs.version }} @@ -118,7 +118,7 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/build_packages.yml b/.github/workflows/build_packages.yml index 2117a2b08fd..54349771f4b 100644 --- a/.github/workflows/build_packages.yml +++ b/.github/workflows/build_packages.yml @@ -27,7 +27,7 @@ jobs: builds: ${{ steps.discover.outputs.builds }} checkable: ${{ steps.checkable.outputs.packages }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup_build_env @@ -54,7 +54,7 @@ jobs: include: ${{ fromJson(needs.discover.outputs.builds) }} fail-fast: false steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -94,7 +94,7 @@ jobs: steps: # fetch-tags/fetch-depth are required: the package is installed editable via # uv-dynamic-versioning, which derives the version from git tags/history. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -120,7 +120,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 94b64679209..80ed51fdd42 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -73,11 +73,11 @@ jobs: "skip=\(index("skip-changelog") != null)", "version_edit=\(index("changelog-version-edit") != null)" ' >> "$GITHUB_OUTPUT" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" diff --git a/.github/workflows/check_node_latest.yml b/.github/workflows/check_node_latest.yml index 8d90962e0a4..7afb6322e6e 100644 --- a/.github/workflows/check_node_latest.yml +++ b/.github/workflows/check_node_latest.yml @@ -23,7 +23,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -33,7 +33,7 @@ jobs: python-version: "3.13" run-uv-sync: true - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} - run: uv run playwright install --with-deps diff --git a/.github/workflows/check_outdated_dependencies.yml b/.github/workflows/check_outdated_dependencies.yml index fc45163f424..28d86fdc653 100644 --- a/.github/workflows/check_outdated_dependencies.yml +++ b/.github/workflows/check_outdated_dependencies.yml @@ -14,7 +14,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cfbb90cefa8..bb521ebecac 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -69,7 +69,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} config-file: .github/codeql-config.yml @@ -98,7 +98,7 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{matrix.language}}" @@ -112,7 +112,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 223e7c61ba5..98732b54428 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout Repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Dependency Review" diff --git a/.github/workflows/dispatch_release.yml b/.github/workflows/dispatch_release.yml index b04b5358a6c..a78574fee38 100644 --- a/.github/workflows/dispatch_release.yml +++ b/.github/workflows/dispatch_release.yml @@ -170,12 +170,12 @@ jobs: pull-requests: write actions: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" diff --git a/.github/workflows/docs_tests.yml b/.github/workflows/docs_tests.yml index 08a758b6b5d..eeeaa4077e0 100644 --- a/.github/workflows/docs_tests.yml +++ b/.github/workflows/docs_tests.yml @@ -32,7 +32,7 @@ jobs: outputs: run: ${{ steps.filter.outputs.changed }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/changed_paths @@ -51,7 +51,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -73,7 +73,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/docs_whitelist.yml b/.github/workflows/docs_whitelist.yml index 86e7136c3d1..364ad115259 100644 --- a/.github/workflows/docs_whitelist.yml +++ b/.github/workflows/docs_whitelist.yml @@ -13,6 +13,6 @@ jobs: check-whitelist: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Assert whitelist is empty run: echo -e "\nassert not WHITELISTED_PAGES, f'WHITELISTED_PAGES includes {WHITELISTED_PAGES}'" | cat "docs/app/reflex_docs/whitelist.py" - | python3 diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index 07d56b0f6f8..e00fefebd86 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -45,7 +45,7 @@ jobs: runs-on: ubuntu-latest steps: # fetch-tags/fetch-depth: the workspace packages derive their versions from git. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -71,7 +71,7 @@ jobs: timeout-minutes: 20 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup_build_env diff --git a/.github/workflows/integration_app_harness.yml b/.github/workflows/integration_app_harness.yml index 7e405f6eaaf..a4dac0739c8 100644 --- a/.github/workflows/integration_app_harness.yml +++ b/.github/workflows/integration_app_harness.yml @@ -31,7 +31,7 @@ jobs: outputs: run: ${{ steps.filter.outputs.changed }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/changed_paths @@ -65,7 +65,7 @@ jobs: # Maps port 6379 on service container to the host - 6379:6379 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -104,7 +104,7 @@ jobs: ports: - 6379:6379 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -130,7 +130,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml index 6273f946de5..6ad52f54ed5 100644 --- a/.github/workflows/integration_tests.yml +++ b/.github/workflows/integration_tests.yml @@ -42,7 +42,7 @@ jobs: outputs: run: ${{ steps.filter.outputs.changed }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/changed_paths @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -78,7 +78,7 @@ jobs: run-uv-sync: true - name: Clone Reflex Examples Repo - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: reflex-dev/reflex-examples path: reflex-examples @@ -140,7 +140,7 @@ jobs: APP_HARNESS_FLAG: "true" runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -162,7 +162,7 @@ jobs: # Inline setup_build_env steps so all installs go through sfw. - name: Install UV - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: python-version: ${{ matrix.python-version }} enable-cache: true @@ -170,7 +170,7 @@ jobs: activate-environment: true cache-dependency-glob: "uv.lock" - name: Setup Node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 @@ -210,7 +210,7 @@ jobs: fail-fast: false runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -258,7 +258,7 @@ jobs: APP_HARNESS_FLAG: "true" runs-on: macos-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -286,7 +286,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/macro_benchmarks.yml b/.github/workflows/macro_benchmarks.yml index eb03d28f22f..7b3623ae532 100644 --- a/.github/workflows/macro_benchmarks.yml +++ b/.github/workflows/macro_benchmarks.yml @@ -67,7 +67,7 @@ jobs: runs-on: codspeed-macro-arm64-graviton-ubuntu-22-04 steps: # fetch-tags/fetch-depth: the workspace packages derive their versions from git. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -85,7 +85,7 @@ jobs: - name: Read the Playwright version id: playwright run: echo "version=$(uv run --no-sync python -c 'from importlib.metadata import version; print(version("playwright"))')" >> "$GITHUB_OUTPUT" - - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ runner.arch }}-${{ steps.playwright.outputs.version }} @@ -155,7 +155,7 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml index df77ebafd4b..d85d6fb9e99 100644 --- a/.github/workflows/performance.yml +++ b/.github/workflows/performance.yml @@ -28,17 +28,17 @@ jobs: REFLEX_CLI_BENCHMARK_TIMEOUT_SECONDS: "120" timeout-minutes: 60 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.14" @@ -46,7 +46,7 @@ jobs: run: uv sync --all-extras --dev - name: Run benchmarks - uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1 + uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0 with: mode: simulation simulation-track-subprocess: true @@ -78,7 +78,7 @@ jobs: runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -113,7 +113,7 @@ jobs: runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -153,7 +153,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index f87d1fecf44..2ea64e1fa7f 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -20,7 +20,7 @@ jobs: timeout-minutes: 30 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -32,7 +32,7 @@ jobs: # `uv sync` mutates tracked files (e.g. pyi_hashes.json), which would # cause pre-commit to flag changes that aren't from the PR. Re-checkout # with clean: false to restore source files while keeping the .venv. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: clean: false fetch-tags: true diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 36807ad2865..c81b41721ab 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -95,14 +95,14 @@ jobs: mark_latest: ${{ steps.prepare.outputs.mark_latest }} steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" @@ -125,14 +125,14 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" @@ -202,14 +202,14 @@ jobs: # Full history and tags: post_build.sh used to run in the build job, whose # checkout has both, and a hook that inspects them must keep working. - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" @@ -371,7 +371,7 @@ jobs: # installs no dependencies either — `uv publish` only uploads the files # the approval covered — so there is nothing to cache. - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" @@ -408,12 +408,12 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" diff --git a/.github/workflows/reflex_init_in_docker_test.yml b/.github/workflows/reflex_init_in_docker_test.yml index 66f3a62d8c9..e424b0e1792 100644 --- a/.github/workflows/reflex_init_in_docker_test.yml +++ b/.github/workflows/reflex_init_in_docker_test.yml @@ -27,7 +27,7 @@ jobs: outputs: run: ${{ steps.filter.outputs.changed }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/changed_paths @@ -44,7 +44,7 @@ jobs: timeout-minutes: 30 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -66,7 +66,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/.github/workflows/release_from_changelog.yml b/.github/workflows/release_from_changelog.yml index c785df88cc4..4fc98d67f11 100644 --- a/.github/workflows/release_from_changelog.yml +++ b/.github/workflows/release_from_changelog.yml @@ -51,12 +51,12 @@ jobs: last_packages: ${{ steps.detect.outputs.last_packages }} any_last: ${{ steps.detect.outputs.any_last }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: "0.12.5" python-version: "3.14.7" diff --git a/.github/workflows/size_budgets.yml b/.github/workflows/size_budgets.yml index 574fd728494..91df627438e 100644 --- a/.github/workflows/size_budgets.yml +++ b/.github/workflows/size_budgets.yml @@ -45,7 +45,7 @@ jobs: runs-on: ubuntu-latest steps: # fetch-tags/fetch-depth: the workspace packages derive their versions from git. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml index 5d7f897a052..0fffb0f8134 100644 --- a/.github/workflows/unit_tests.yml +++ b/.github/workflows/unit_tests.yml @@ -32,7 +32,7 @@ jobs: outputs: run: ${{ steps.filter.outputs.changed }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/changed_paths @@ -83,7 +83,7 @@ jobs: ports: - 5432:5432 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -137,7 +137,7 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"] runs-on: macos-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -166,7 +166,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/ci_gate diff --git a/packages/reflex-release/news/+workflow-action-pins.misc.md b/packages/reflex-release/news/+workflow-action-pins.misc.md new file mode 100644 index 00000000000..42e69193361 --- /dev/null +++ b/packages/reflex-release/news/+workflow-action-pins.misc.md @@ -0,0 +1 @@ +Update generated release workflows to use the latest stable SHA-pinned checkout and uv setup actions. diff --git a/packages/reflex-release/src/reflex_release/templates/workflows/auto_release_internal.yml b/packages/reflex-release/src/reflex_release/templates/workflows/auto_release_internal.yml index 6aa85625870..3f2b148e5c2 100644 --- a/packages/reflex-release/src/reflex_release/templates/workflows/auto_release_internal.yml +++ b/packages/reflex-release/src/reflex_release/templates/workflows/auto_release_internal.yml @@ -34,11 +34,11 @@ jobs: # The whole pushed range has to be reachable: the paths filter above # matches every commit in the push, so detection must diff the same range # rather than only the last commit. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ - id: detect env: diff --git a/packages/reflex-release/src/reflex_release/templates/workflows/changelog.yml b/packages/reflex-release/src/reflex_release/templates/workflows/changelog.yml index 4cf7cf767aa..c3d984c34e4 100644 --- a/packages/reflex-release/src/reflex_release/templates/workflows/changelog.yml +++ b/packages/reflex-release/src/reflex_release/templates/workflows/changelog.yml @@ -71,11 +71,11 @@ jobs: "skip=\(index("skip-changelog") != null)", "version_edit=\(index("changelog-version-edit") != null)" ' >> "$GITHUB_OUTPUT" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ # The heading guard runs even for skip-changelog PRs: that label only # waives the news-fragment requirement, not the publish-trigger guard. diff --git a/packages/reflex-release/src/reflex_release/templates/workflows/dispatch_release.yml b/packages/reflex-release/src/reflex_release/templates/workflows/dispatch_release.yml index 3997c618be3..ae7e397ec08 100644 --- a/packages/reflex-release/src/reflex_release/templates/workflows/dispatch_release.yml +++ b/packages/reflex-release/src/reflex_release/templates/workflows/dispatch_release.yml @@ -81,12 +81,12 @@ jobs: pull-requests: write actions: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ - name: Plan versions id: plan diff --git a/packages/reflex-release/src/reflex_release/templates/workflows/publish.yml b/packages/reflex-release/src/reflex_release/templates/workflows/publish.yml index 8ce3bd17349..6673d78f93d 100644 --- a/packages/reflex-release/src/reflex_release/templates/workflows/publish.yml +++ b/packages/reflex-release/src/reflex_release/templates/workflows/publish.yml @@ -93,14 +93,14 @@ jobs: mark_latest: ${{ steps.prepare.outputs.mark_latest }} steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ - name: Validate against changelog, branch rules and existing tags @@ -123,14 +123,14 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ - name: Pin lockstep siblings to exact versions @@ -199,14 +199,14 @@ jobs: # Full history and tags: post_build.sh used to run in the build job, whose # checkout has both, and a hook that inspects them must keep working. - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ # One artifact per build job — a platform matrix uploads one per leg — @@ -366,7 +366,7 @@ jobs: # installs no dependencies either — `uv publish` only uploads the files # the approval covered — so there is nothing to cache. - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_NO_CHECKOUT@@ - name: Download built artifacts @@ -399,12 +399,12 @@ jobs: actions: @@ACTIONS_PERMISSION@@ steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ # The same artifact the approval covered: the release notes and the diff --git a/packages/reflex-release/src/reflex_release/templates/workflows/release_from_changelog.yml b/packages/reflex-release/src/reflex_release/templates/workflows/release_from_changelog.yml index a06369e079a..bc643d9967e 100644 --- a/packages/reflex-release/src/reflex_release/templates/workflows/release_from_changelog.yml +++ b/packages/reflex-release/src/reflex_release/templates/workflows/release_from_changelog.yml @@ -49,12 +49,12 @@ jobs: last_packages: ${{ steps.detect.outputs.last_packages }} any_last: ${{ steps.detect.outputs.any_last }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 persist-credentials: false - - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 @@UV_SETUP_WITH@@ - id: detect env: