Skip to content

Pin the unsloth-sd-prebuilt actions to commit SHAs - #12

Merged
danielhanchen merged 1 commit into
masterfrom
pin-actions-to-sha
Aug 25, 2026
Merged

Pin the unsloth-sd-prebuilt actions to commit SHAs#12
danielhanchen merged 1 commit into
masterfrom
pin-actions-to-sha

Conversation

@danielhanchen

Copy link
Copy Markdown
Member

Same change as unslothai/llama.cpp#105 (merged) and unslothai/whisper.cpp#25. Scoped to unsloth-sd-prebuilt.yml, the only unsloth-owned workflow here: 1/19 pinned, now 19/19.

action tag pinned commit
ilammy/msvc-dev-cmd v1 0b201ec
Jimver/cuda-toolkit v0.2.22 95b5a29
actions/checkout v4 11d5960
actions/upload-artifact v4 ea165f8
actions/download-artifact v4 d3f86a1
actions/setup-python v5 a26af69
actions/cache/save v6 55cc834

Why this cannot change behaviour

Every SHA is the commit its tag points at right now, so identical code runs before and after. Note this workflow deliberately sits on older majors than our other repos (checkout@v4, setup-python@v5, cuda-toolkit@v0.2.22). Those are pinned where they are, not moved forward — this PR is not a version bump and does not pull in the v6/v7 breaking changes.

Verified before pushing:

  • git diff is 18 insertions / 18 deletions in one file, and every changed line is a uses: line.
  • Every pinned commit resolves on its action repository with action.yml present, including save/action.yml for the actions/cache/save subaction.
  • All 4 workflows parse; actionlint reports nothing new.

Deliberately not touched

Upstream build.yml (50 refs), close-inactive-issues.yml and stale-prs.yml are left unpinned so this costs nothing at the next upstream sync. That is why the repo total is 19/71 rather than 71/71. Worth noting separately that upstream build.yml still uses actions/checkout@v3, which actionlint flags as too old to run on GitHub Actions, and declares an unknown artifact-metadata permission scope. Both are upstream problems, not ours to fix here.

All 18 action references in unsloth-sd-prebuilt.yml resolved through a moving
tag, including msvc-dev-cmd and cuda-toolkit, which run in the jobs that build
and upload the prebuilt binaries.

Each SHA is the commit the corresponding tag points at today, so nothing about
what runs changes and no version is bumped. That includes the older majors this
workflow pins deliberately, checkout v4, upload-artifact v4, download-artifact
v4, setup-python v5 and cuda-toolkit v0.2.22, none of which are moved forward
here.

Upstream build.yml, close-inactive-issues.yml and stale-prs.yml are left alone
so this costs nothing at the next upstream sync.
@danielhanchen
danielhanchen merged commit ea65600 into master Aug 25, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant