From 1efa61c57fe01ceb3bce9ce62d0f6b13f6d6dfef Mon Sep 17 00:00:00 2001 From: "Peter A. Jonsson" Date: Tue, 21 Jul 2026 19:47:12 +0200 Subject: [PATCH] CI: pin actions by sha256 Update the actions to the latest version and pin them by sha256 to avoid supply-chain attacks if the action provider gets compromised. --- .github/workflows/build-wheel.yml | 6 +++--- .github/workflows/lint.yml | 4 ++-- .github/workflows/sphinx2ghpages.yml | 4 ++-- .github/workflows/unittests.yml | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml index 2bb066480..db13d48d2 100644 --- a/.github/workflows/build-wheel.yml +++ b/.github/workflows/build-wheel.yml @@ -8,9 +8,9 @@ jobs: name: Build wheel runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.11' - name: Install dependencies @@ -19,6 +19,6 @@ jobs: pip install wheel - name: Build bdist_wheel run: python setup.py bdist_wheel - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: path: dist/*.whl diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 06188b8f0..b411ebd75 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -12,9 +12,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - name: Install dependencies diff --git a/.github/workflows/sphinx2ghpages.yml b/.github/workflows/sphinx2ghpages.yml index 7c7536295..5494752b1 100644 --- a/.github/workflows/sphinx2ghpages.yml +++ b/.github/workflows/sphinx2ghpages.yml @@ -17,10 +17,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" diff --git a/.github/workflows/unittests.yml b/.github/workflows/unittests.yml index ead32edba..f709af90b 100644 --- a/.github/workflows/unittests.yml +++ b/.github/workflows/unittests.yml @@ -34,9 +34,9 @@ jobs: python-version: "3.11" runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Install dependencies