From e033c2a51ab178db700c1effe0dd52f1555e9b69 Mon Sep 17 00:00:00 2001 From: Julien Danjou Date: Wed, 23 Sep 2026 06:08:27 +0200 Subject: [PATCH] ci: pin all GitHub Actions to full commit SHAs The org now enforces SHA pinning for Actions (policy enabled 2026-09-09), so every job on main and every open PR has been failing before it even runs: "The actions actions/checkout@v7.0.1 and astral-sh/setup-uv@v10.1.0 are not allowed in Mergifyio/alembic-git-revisions because all actions must be pinned to a full-length commit SHA." Pin actions/checkout, astral-sh/setup-uv and (in release.yaml) pypa/gh-action-pypi-publish to their current commit SHAs, each with a trailing comment naming the tag or branch so Dependabot keeps updating them. This also carries the pending setup-uv 10.0.1 -> 10.1.0 bump (supersedes #52, whose branch has the same failure). astral-sh/setup-uv@v10.1.0 -> bec219d24cd3e171d82865faccec33120bb574f4 actions/checkout@v7.0.1 -> 3d3c42e5aac5ba805825da76410c181273ba90b1 pypa/gh-action-pypi-publish@release/v1 -> dc37677b2e1c63e2034f94d8a5b11f265b73ba33 Co-Authored-By: Claude Sonnet 5 Change-Id: I3f4a84f17f012d7b29f722bcc1ff5f067a539b65 --- .github/workflows/ci.yaml | 8 ++++---- .github/workflows/release.yaml | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 613c122..ff26d08 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -7,8 +7,8 @@ jobs: linters: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 - - uses: astral-sh/setup-uv@v10.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - run: uv run --extra dev poe linters test: @@ -17,8 +17,8 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v7.0.1 - - uses: astral-sh/setup-uv@v10.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - run: uv run --python ${{ matrix.python-version }} --extra dev poe test all-greens: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 01eb2a1..8f7b2cf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -12,7 +12,7 @@ jobs: permissions: id-token: write steps: - - uses: actions/checkout@v7.0.1 - - uses: astral-sh/setup-uv@v10.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - run: uv build - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1