From aee6f5bbc828502ad185e7a3eae248bc5efe8ea5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 04:38:46 +0000 Subject: [PATCH] Harden CI: pin conformance/install/handoff workflow actions to SHAs Pins all 20 action references in conformance-heartbeat.yml, install-test.yml and cross-repo-handoff.yml to full commit SHAs, keeping the human-readable version in a trailing comment so Dependabot still tracks them. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Pw5EDmCUvFQMXbdGXehQm9 --- .github/workflows/conformance-heartbeat.yml | 14 +++++++------- .github/workflows/cross-repo-handoff.yml | 12 ++++++------ .github/workflows/install-test.yml | 14 +++++++------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/conformance-heartbeat.yml b/.github/workflows/conformance-heartbeat.yml index 68fdc3f2f1..9ca502b0c9 100644 --- a/.github/workflows/conformance-heartbeat.yml +++ b/.github/workflows/conformance-heartbeat.yml @@ -95,7 +95,7 @@ jobs: - os: ubuntu-latest python-version: "3.9" steps: - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} @@ -143,7 +143,7 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - name: Install from PyPI and smoke the CLI @@ -168,7 +168,7 @@ jobs: matrix: os: [ubuntu-latest, macos-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run install script run: bash install.sh - name: Verify binary @@ -184,8 +184,8 @@ jobs: runs-on: windows-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Run PowerShell install @@ -204,8 +204,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - name: Report the matrix diff --git a/.github/workflows/cross-repo-handoff.yml b/.github/workflows/cross-repo-handoff.yml index d858d5403d..b4ef5267bb 100644 --- a/.github/workflows/cross-repo-handoff.yml +++ b/.github/workflows/cross-repo-handoff.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout clawmetry (OSS) - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: oss @@ -52,7 +52,7 @@ jobs: # PRs skip gracefully; the test falls back to its inline stub in that case. - name: Checkout clawmetry-landing if: steps.access.outputs.available == 'true' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: vivekchand/clawmetry-landing token: ${{ secrets.CLOUD_REPO_PAT }} @@ -61,7 +61,7 @@ jobs: # Cloud repo provides run_cloud.py stub + DaemonSim wire-format simulator. - name: Checkout clawmetry-cloud if: steps.access.outputs.available == 'true' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: vivekchand/clawmetry-cloud token: ${{ secrets.CLOUD_REPO_PAT }} @@ -88,7 +88,7 @@ jobs: print("patched _throttle_patched: added node_id kwarg") EOF - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" @@ -152,7 +152,7 @@ jobs: - name: Upload JUnit results if: always() && steps.access.outputs.available == 'true' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: junit-c4-${{ github.run_id }} path: /tmp/junit-c4-${{ github.run_id }}.xml @@ -169,7 +169,7 @@ jobs: - name: Upload logs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: c4-handoff-logs path: | diff --git a/.github/workflows/install-test.yml b/.github/workflows/install-test.yml index b9fef6b8dd..7e72cc6c6c 100644 --- a/.github/workflows/install-test.yml +++ b/.github/workflows/install-test.yml @@ -15,7 +15,7 @@ jobs: test-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run install script run: bash install.sh - name: Verify clawmetry binary @@ -34,7 +34,7 @@ jobs: test-macos: runs-on: macos-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run install script run: bash install.sh - name: Add bin to PATH @@ -53,9 +53,9 @@ jobs: runs-on: windows-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Run PowerShell install @@ -110,9 +110,9 @@ jobs: runs-on: windows-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Run CMD install @@ -148,6 +148,6 @@ jobs: shellcheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: ShellCheck run: shellcheck install.sh