From 7236b0b6ea04aef52c7f61b78245f7e573579c17 Mon Sep 17 00:00:00 2001 From: "Jeffrey A. Clark" Date: Mon, 28 Apr 2025 10:38:34 -0400 Subject: [PATCH] PYTHON-5353 Pin github actions --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/dist.yml | 2 +- .github/workflows/release-python.yml | 4 ++-- .github/workflows/test-python.yml | 30 ++++++++++++++-------------- .github/workflows/zizmor.yml | 4 ++-- 5 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 98cfa2f43f..f7cfea144e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,7 +46,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -63,6 +63,6 @@ jobs: pip install -e . - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dist.yml b/.github/workflows/dist.yml index 81f86721ef..be172864dc 100644 --- a/.github/workflows/dist.yml +++ b/.github/workflows/dist.yml @@ -60,7 +60,7 @@ jobs: - name: Set up QEMU if: runner.os == 'Linux' - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3 with: # setup-qemu-action by default uses `tonistiigi/binfmt:latest` image, # which is out of date. This causes seg faults during build. diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml index a684ff79b0..9cce310d91 100644 --- a/.github/workflows/release-python.yml +++ b/.github/workflows/release-python.yml @@ -81,14 +81,14 @@ jobs: name: all-dist-${{ github.run_id }} path: dist/ - name: Publish package distributions to TestPyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1 with: repository-url: https://test.pypi.org/legacy/ skip-existing: true attestations: ${{ env.DRY_RUN }} - name: Publish package distributions to PyPI if: startsWith(env.DRY_RUN, 'false') - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1 post-publish: needs: [publish] diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml index 6d215bed0e..05b87f4f81 100644 --- a/.github/workflows/test-python.yml +++ b/.github/workflows/test-python.yml @@ -23,9 +23,9 @@ jobs: with: persist-credentials: false - name: Install just - uses: extractions/setup-just@v3 + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true python-version: "3.9" @@ -63,16 +63,16 @@ jobs: with: persist-credentials: false - name: Install just - uses: extractions/setup-just@v3 + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true python-version: ${{ matrix.python-version }} - name: Install dependencies run: just install - name: Start MongoDB - uses: supercharge/mongodb-github-action@1.12.0 + uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0 with: mongodb-version: 6.0 - name: Run tests @@ -86,14 +86,14 @@ jobs: with: persist-credentials: false - name: Install just - uses: extractions/setup-just@v3 + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true python-version: "3.9" - name: Start MongoDB - uses: supercharge/mongodb-github-action@1.12.0 + uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0 with: mongodb-version: '8.0.0-rc4' - name: Install dependencies @@ -111,12 +111,12 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true python-version: "3.9" - name: Install just - uses: extractions/setup-just@v3 + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Install dependencies run: just install - name: Build docs @@ -130,12 +130,12 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true python-version: "3.9" - name: Install just - uses: extractions/setup-just@v3 + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Install dependencies run: just install - name: Build docs @@ -152,12 +152,12 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true python-version: "${{matrix.python}}" - name: Install just - uses: extractions/setup-just@v3 + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Install dependencies run: | just install @@ -211,7 +211,7 @@ jobs: # Test sdist on lowest supported Python python-version: '3.9' - name: Start MongoDB - uses: supercharge/mongodb-github-action@1.12.0 + uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0 - name: Run connect test from sdist shell: bash run: | diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 31afeb6655..16f2ba2cbb 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -18,7 +18,7 @@ jobs: with: persist-credentials: false - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@9d7e65c320fdb52dcd45ffaa68deb6c02c8754d9 # v1 - name: Get zizmor run: cargo install zizmor - name: Run zizmor 🌈 @@ -26,7 +26,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3 with: sarif_file: results.sarif category: zizmor