From d9ac7862fe1ada740ac7518dd87450013026c02c Mon Sep 17 00:00:00 2001 From: Tony Meyer Date: Thu, 2 Jul 2026 17:51:20 +1200 Subject: [PATCH 1/3] ci: hash-pin actions and drop zizmor config Pin every third-party action to its full commit SHA (with the tag preserved as a trailing comment for readability). This removes the need for the ref-pin policy overrides in .github/zizmor.yaml, so the config file is dropped and zizmor now runs with defaults. Co-Authored-By: Claude Opus 4.7 --- .github/actions/update-charm-pins/action.yaml | 2 +- .github/workflows/_build-wheels.yaml | 4 ++-- .github/workflows/charmcraft-pack.yaml | 4 ++-- .github/workflows/db-charm-tests.yaml | 4 ++-- .github/workflows/dependency-review.yaml | 4 ++-- .github/workflows/docs-linkcheck.yaml | 2 +- .github/workflows/docs.yaml | 2 +- .github/workflows/example-charm-charmcraft-test.yaml | 4 ++-- .../workflows/example-charm-integration-tests.yaml | 4 ++-- .github/workflows/example-charm-tests.yaml | 4 ++-- .github/workflows/framework-tests.yaml | 12 ++++++------ .github/workflows/hello-charm-tests.yaml | 6 +++--- .github/workflows/integration.yaml | 6 +++--- .github/workflows/observability-charm-tests.yaml | 4 ++-- .github/workflows/publish.yaml | 6 +++--- .github/workflows/published-charms-tests.yaml | 8 ++++---- .github/workflows/sbom-secscan.yaml | 6 +++--- .github/workflows/smoke.yaml | 4 ++-- .github/workflows/test-publish.yaml | 4 ++-- .github/workflows/tiobe.yaml | 2 +- .github/workflows/update-best-practice-doc.yaml | 6 +++--- .github/workflows/update-charm-tests.yaml | 2 +- .github/workflows/validate-pr-title.yaml | 2 +- .github/workflows/zizmor.yaml | 4 ++-- .github/zizmor.yaml | 7 ------- 25 files changed, 53 insertions(+), 60 deletions(-) delete mode 100644 .github/zizmor.yaml diff --git a/.github/actions/update-charm-pins/action.yaml b/.github/actions/update-charm-pins/action.yaml index a49220a07..62629cdf3 100644 --- a/.github/actions/update-charm-pins/action.yaml +++ b/.github/actions/update-charm-pins/action.yaml @@ -17,7 +17,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.12" diff --git a/.github/workflows/_build-wheels.yaml b/.github/workflows/_build-wheels.yaml index 2072fac91..55fd0252e 100644 --- a/.github/workflows/_build-wheels.yaml +++ b/.github/workflows/_build-wheels.yaml @@ -16,7 +16,7 @@ jobs: artifact-name: ${{ steps.artifact-name.outputs.name }} steps: - name: Checkout the operator repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -31,7 +31,7 @@ jobs: run: echo "name=operator-wheels-${{ github.sha }}" >> "$GITHUB_OUTPUT" - name: Upload wheels as artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: ${{ steps.artifact-name.outputs.name }} path: dist/*.whl diff --git a/.github/workflows/charmcraft-pack.yaml b/.github/workflows/charmcraft-pack.yaml index 224440af5..3c210ac33 100644 --- a/.github/workflows/charmcraft-pack.yaml +++ b/.github/workflows/charmcraft-pack.yaml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -67,7 +67,7 @@ jobs: - name: Archive charmcraft logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: charmcraft-logs path: /root/.local/state/charmcraft/log/*.log diff --git a/.github/workflows/db-charm-tests.yaml b/.github/workflows/db-charm-tests.yaml index db6b9a4d8..d1ccd897c 100644 --- a/.github/workflows/db-charm-tests.yaml +++ b/.github/workflows/db-charm-tests.yaml @@ -31,14 +31,14 @@ jobs: commit: 0088c9583f63999ff37d982948e47b9e3e3fba2a # 2026-01-20T15:48:23Z steps: - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} persist-credentials: false ref: ${{ matrix.commit }} - name: Download operator wheels - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index 7a79ecf61..5ce79906c 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -15,10 +15,10 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Dependency review - uses: actions/dependency-review-action@v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 with: fail-on-severity: high diff --git a/.github/workflows/docs-linkcheck.yaml b/.github/workflows/docs-linkcheck.yaml index 8dde256cf..7732f3aca 100644 --- a/.github/workflows/docs-linkcheck.yaml +++ b/.github/workflows/docs-linkcheck.yaml @@ -15,7 +15,7 @@ jobs: name: Links runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 215accd81..30d5c631f 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -15,7 +15,7 @@ jobs: name: Spelling runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv diff --git a/.github/workflows/example-charm-charmcraft-test.yaml b/.github/workflows/example-charm-charmcraft-test.yaml index 23e2c88bd..ba4387e7f 100644 --- a/.github/workflows/example-charm-charmcraft-test.yaml +++ b/.github/workflows/example-charm-charmcraft-test.yaml @@ -16,7 +16,7 @@ jobs: outputs: jobs: ${{ steps.collect.outputs.jobs }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Collect spread jobs @@ -39,7 +39,7 @@ jobs: matrix: include: ${{ fromJson(needs.collect-spread-jobs.outputs.jobs) }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up LXD diff --git a/.github/workflows/example-charm-integration-tests.yaml b/.github/workflows/example-charm-integration-tests.yaml index f53fd1e0a..afe6f7d0d 100644 --- a/.github/workflows/example-charm-integration-tests.yaml +++ b/.github/workflows/example-charm-integration-tests.yaml @@ -17,7 +17,7 @@ jobs: dir: - examples/machine-tinyproxy steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv @@ -51,7 +51,7 @@ jobs: - examples/k8s-4-action - examples/k8s-5-observe steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv diff --git a/.github/workflows/example-charm-tests.yaml b/.github/workflows/example-charm-tests.yaml index e6954f69d..5f8c1a3cd 100644 --- a/.github/workflows/example-charm-tests.yaml +++ b/.github/workflows/example-charm-tests.yaml @@ -28,11 +28,11 @@ jobs: - examples/k8s-5-observe steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up Python 3 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '${{ matrix.python-version }}' - name: Set up uv diff --git a/.github/workflows/framework-tests.yaml b/.github/workflows/framework-tests.yaml index b9b2c0cce..adbaf50e4 100644 --- a/.github/workflows/framework-tests.yaml +++ b/.github/workflows/framework-tests.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -36,7 +36,7 @@ jobs: python-version: ["3.10", "3.12", "3.14"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -59,7 +59,7 @@ jobs: python-version: ["3.10", "3.12", "3.14"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -67,7 +67,7 @@ jobs: - run: uv python install ${{ matrix.python-version }} - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: "1.22" # To suppress the "Restore cache failed" error, since there is no go.sum file here. @@ -93,12 +93,12 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Set up Python 3 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/hello-charm-tests.yaml b/.github/workflows/hello-charm-tests.yaml index 00958e194..23cd225e4 100644 --- a/.github/workflows/hello-charm-tests.yaml +++ b/.github/workflows/hello-charm-tests.yaml @@ -27,19 +27,19 @@ jobs: commit: 046b8ce758660d5aa9cf05207e2370fcbab688d0 # 2021-12-16T10:10:24Z steps: - name: Set up Python 3.10 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.10' - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} persist-credentials: false ref: ${{ matrix.commit }} - name: Download operator wheels - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index 50428706d..c873ab5e6 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -28,7 +28,7 @@ jobs: --juju-channel=3/stable --charmcraft-channel=3.x/stable -p "${{ matrix.preset }}" - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -54,7 +54,7 @@ jobs: --juju-channel=${{ matrix.juju-channel }} --charmcraft-channel=3.x/stable -p microk8s - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -81,7 +81,7 @@ jobs: sudo concierge prepare --juju-channel=${{ matrix.juju-channel }} -p "${{ matrix.preset }}" - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 diff --git a/.github/workflows/observability-charm-tests.yaml b/.github/workflows/observability-charm-tests.yaml index 6755a5e68..fa04b20e9 100644 --- a/.github/workflows/observability-charm-tests.yaml +++ b/.github/workflows/observability-charm-tests.yaml @@ -30,14 +30,14 @@ jobs: commit: f3999254035d5f39eda07261af2b86a4454846d4 # 2026-05-20T14:52:38Z steps: - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} persist-credentials: false ref: ${{ matrix.commit }} - name: Download operator wheels - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 883e3a5f4..a214cb28d 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -17,7 +17,7 @@ jobs: contents: read environment: publish-pypi steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -28,10 +28,10 @@ jobs: run: | set -xueo pipefail uvx --with "$(echo -n dist/ops-*.whl)[testing,tracing]" --with dist/ops_scenario-*.whl --with dist/ops_tracing-*.whl python -c 'import ops, scenario, ops_tracing; print("OK")' - - uses: actions/attest-build-provenance@v4.1.0 + - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-path: 'dist/*' - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 secscan: uses: ./.github/workflows/sbom-secscan.yaml diff --git a/.github/workflows/published-charms-tests.yaml b/.github/workflows/published-charms-tests.yaml index 60b5283d5..806b207b4 100644 --- a/.github/workflows/published-charms-tests.yaml +++ b/.github/workflows/published-charms-tests.yaml @@ -191,7 +191,7 @@ jobs: # END AUTOGENERATED CONTENT steps: - name: Checkout operator repository (for helper scripts) - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: path: operator-repo persist-credentials: false @@ -203,14 +203,14 @@ jobs: rm -rf operator-repo - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} path: charm-repo persist-credentials: false - name: Download operator wheels - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels @@ -289,7 +289,7 @@ jobs: run: charmcraft init --profile=${{ matrix.profile }} --author=charm-tech - name: Download operator wheels - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/sbom-secscan.yaml b/.github/workflows/sbom-secscan.yaml index 3b2a239b9..b8ad69064 100644 --- a/.github/workflows/sbom-secscan.yaml +++ b/.github/workflows/sbom-secscan.yaml @@ -17,7 +17,7 @@ jobs: runs-on: [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium] steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Install dependencies @@ -26,7 +26,7 @@ jobs: sudo apt-get install -y libapt-pkg-dev sudo apt install -y python3-apt - name: Checkout security scanner - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: canonical/sbomber path: scanner @@ -53,7 +53,7 @@ jobs: run: | cd scanner && ./sbomber download - name: Upload reports - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: secscan-report-upload-${{ matrix.manifest }} path: ./scanner/reports/ diff --git a/.github/workflows/smoke.yaml b/.github/workflows/smoke.yaml index d788f37cf..e93c403a6 100644 --- a/.github/workflows/smoke.yaml +++ b/.github/workflows/smoke.yaml @@ -26,7 +26,7 @@ jobs: --charmcraft-channel=3.x/stable -p "${{ matrix.preset }}" - name: Checkout the repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -40,7 +40,7 @@ jobs: - name: Archive charmcraft logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: charmcraft-logs path: /home/runner/.local/state/charmcraft/log/*.log diff --git a/.github/workflows/test-publish.yaml b/.github/workflows/test-publish.yaml index 328da1916..66809270e 100644 --- a/.github/workflows/test-publish.yaml +++ b/.github/workflows/test-publish.yaml @@ -12,13 +12,13 @@ jobs: name: Build and publish to Test PYPI runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: false - run: uv build --all - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 with: repository-url: https://test.pypi.org/legacy/ diff --git a/.github/workflows/tiobe.yaml b/.github/workflows/tiobe.yaml index 505e95169..9bf07ad24 100644 --- a/.github/workflows/tiobe.yaml +++ b/.github/workflows/tiobe.yaml @@ -11,7 +11,7 @@ jobs: TICS: runs-on: [self-hosted, reactive, amd64, tiobe, noble] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false diff --git a/.github/workflows/update-best-practice-doc.yaml b/.github/workflows/update-best-practice-doc.yaml index 973b45dac..970f8970b 100644 --- a/.github/workflows/update-best-practice-doc.yaml +++ b/.github/workflows/update-best-practice-doc.yaml @@ -11,19 +11,19 @@ jobs: update-docs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ secrets.UPDATE_DOCS_ACCESS_TOKEN }} path: operator persist-credentials: true - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: canonical/charmcraft path: charmcraft persist-credentials: false - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" - run: python .github/update-best-practice-table.py --path-to-charmcraft='${{ github.workspace }}/charmcraft' > docs/reuse/best-practices.txt diff --git a/.github/workflows/update-charm-tests.yaml b/.github/workflows/update-charm-tests.yaml index 54f1e5d3e..1a704c609 100644 --- a/.github/workflows/update-charm-tests.yaml +++ b/.github/workflows/update-charm-tests.yaml @@ -13,7 +13,7 @@ jobs: update-pins: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ secrets.UPDATE_CHARM_PINS_ACCESS_TOKEN }} persist-credentials: true diff --git a/.github/workflows/validate-pr-title.yaml b/.github/workflows/validate-pr-title.yaml index 1899bfba6..1f10cbc33 100644 --- a/.github/workflows/validate-pr-title.yaml +++ b/.github/workflows/validate-pr-title.yaml @@ -13,7 +13,7 @@ jobs: name: Validate PR title runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - run: python3 .github/check-conventional-pr-title.py diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index 53d1ce19e..b631e5009 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -16,7 +16,7 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -29,7 +29,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v4.36.2 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: results.sarif category: zizmor diff --git a/.github/zizmor.yaml b/.github/zizmor.yaml deleted file mode 100644 index 5b5b5e749..000000000 --- a/.github/zizmor.yaml +++ /dev/null @@ -1,7 +0,0 @@ -rules: - unpinned-uses: - config: - policies: - "actions/*": ref-pin - "github/*": ref-pin - "pypa/*": ref-pin From 4f018a38488a2900adc74f3ef7fea6dfa69e294b Mon Sep 17 00:00:00 2001 From: Tony Meyer Date: Thu, 2 Jul 2026 18:44:28 +1200 Subject: [PATCH 2/3] style: use two spaces before hash-pin version comment Co-Authored-By: Claude Opus 4.7 --- .github/actions/update-charm-pins/action.yaml | 2 +- .github/workflows/_build-wheels.yaml | 4 ++-- .github/workflows/charmcraft-pack.yaml | 4 ++-- .github/workflows/db-charm-tests.yaml | 4 ++-- .github/workflows/dependency-review.yaml | 4 ++-- .github/workflows/docs-linkcheck.yaml | 2 +- .github/workflows/docs.yaml | 2 +- .github/workflows/example-charm-charmcraft-test.yaml | 4 ++-- .../workflows/example-charm-integration-tests.yaml | 4 ++-- .github/workflows/example-charm-tests.yaml | 4 ++-- .github/workflows/framework-tests.yaml | 12 ++++++------ .github/workflows/hello-charm-tests.yaml | 6 +++--- .github/workflows/integration.yaml | 6 +++--- .github/workflows/observability-charm-tests.yaml | 4 ++-- .github/workflows/publish.yaml | 6 +++--- .github/workflows/published-charms-tests.yaml | 8 ++++---- .github/workflows/sbom-secscan.yaml | 6 +++--- .github/workflows/smoke.yaml | 4 ++-- .github/workflows/test-publish.yaml | 4 ++-- .github/workflows/tiobe.yaml | 2 +- .github/workflows/update-best-practice-doc.yaml | 6 +++--- .github/workflows/update-charm-tests.yaml | 2 +- .github/workflows/validate-pr-title.yaml | 2 +- .github/workflows/zizmor.yaml | 4 ++-- 24 files changed, 53 insertions(+), 53 deletions(-) diff --git a/.github/actions/update-charm-pins/action.yaml b/.github/actions/update-charm-pins/action.yaml index 62629cdf3..f4be97c15 100644 --- a/.github/actions/update-charm-pins/action.yaml +++ b/.github/actions/update-charm-pins/action.yaml @@ -17,7 +17,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.12" diff --git a/.github/workflows/_build-wheels.yaml b/.github/workflows/_build-wheels.yaml index 55fd0252e..b40735bc3 100644 --- a/.github/workflows/_build-wheels.yaml +++ b/.github/workflows/_build-wheels.yaml @@ -16,7 +16,7 @@ jobs: artifact-name: ${{ steps.artifact-name.outputs.name }} steps: - name: Checkout the operator repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -31,7 +31,7 @@ jobs: run: echo "name=operator-wheels-${{ github.sha }}" >> "$GITHUB_OUTPUT" - name: Upload wheels as artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: ${{ steps.artifact-name.outputs.name }} path: dist/*.whl diff --git a/.github/workflows/charmcraft-pack.yaml b/.github/workflows/charmcraft-pack.yaml index 3c210ac33..c47c93635 100644 --- a/.github/workflows/charmcraft-pack.yaml +++ b/.github/workflows/charmcraft-pack.yaml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -67,7 +67,7 @@ jobs: - name: Archive charmcraft logs if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: charmcraft-logs path: /root/.local/state/charmcraft/log/*.log diff --git a/.github/workflows/db-charm-tests.yaml b/.github/workflows/db-charm-tests.yaml index d1ccd897c..1bd6da8cc 100644 --- a/.github/workflows/db-charm-tests.yaml +++ b/.github/workflows/db-charm-tests.yaml @@ -31,14 +31,14 @@ jobs: commit: 0088c9583f63999ff37d982948e47b9e3e3fba2a # 2026-01-20T15:48:23Z steps: - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} persist-credentials: false ref: ${{ matrix.commit }} - name: Download operator wheels - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index 5ce79906c..ec256e868 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -15,10 +15,10 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Dependency review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 with: fail-on-severity: high diff --git a/.github/workflows/docs-linkcheck.yaml b/.github/workflows/docs-linkcheck.yaml index 7732f3aca..8d915df3d 100644 --- a/.github/workflows/docs-linkcheck.yaml +++ b/.github/workflows/docs-linkcheck.yaml @@ -15,7 +15,7 @@ jobs: name: Links runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 30d5c631f..784c4ceeb 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -15,7 +15,7 @@ jobs: name: Spelling runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv diff --git a/.github/workflows/example-charm-charmcraft-test.yaml b/.github/workflows/example-charm-charmcraft-test.yaml index ba4387e7f..2a8e7a532 100644 --- a/.github/workflows/example-charm-charmcraft-test.yaml +++ b/.github/workflows/example-charm-charmcraft-test.yaml @@ -16,7 +16,7 @@ jobs: outputs: jobs: ${{ steps.collect.outputs.jobs }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Collect spread jobs @@ -39,7 +39,7 @@ jobs: matrix: include: ${{ fromJson(needs.collect-spread-jobs.outputs.jobs) }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up LXD diff --git a/.github/workflows/example-charm-integration-tests.yaml b/.github/workflows/example-charm-integration-tests.yaml index afe6f7d0d..28d752092 100644 --- a/.github/workflows/example-charm-integration-tests.yaml +++ b/.github/workflows/example-charm-integration-tests.yaml @@ -17,7 +17,7 @@ jobs: dir: - examples/machine-tinyproxy steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv @@ -51,7 +51,7 @@ jobs: - examples/k8s-4-action - examples/k8s-5-observe steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up uv diff --git a/.github/workflows/example-charm-tests.yaml b/.github/workflows/example-charm-tests.yaml index 5f8c1a3cd..a00129b41 100644 --- a/.github/workflows/example-charm-tests.yaml +++ b/.github/workflows/example-charm-tests.yaml @@ -28,11 +28,11 @@ jobs: - examples/k8s-5-observe steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Set up Python 3 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '${{ matrix.python-version }}' - name: Set up uv diff --git a/.github/workflows/framework-tests.yaml b/.github/workflows/framework-tests.yaml index adbaf50e4..21f617b29 100644 --- a/.github/workflows/framework-tests.yaml +++ b/.github/workflows/framework-tests.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -36,7 +36,7 @@ jobs: python-version: ["3.10", "3.12", "3.14"] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -59,7 +59,7 @@ jobs: python-version: ["3.10", "3.12", "3.14"] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -67,7 +67,7 @@ jobs: - run: uv python install ${{ matrix.python-version }} - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: "1.22" # To suppress the "Restore cache failed" error, since there is no go.sum file here. @@ -93,12 +93,12 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Set up Python 3 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/hello-charm-tests.yaml b/.github/workflows/hello-charm-tests.yaml index 23cd225e4..91c2450c3 100644 --- a/.github/workflows/hello-charm-tests.yaml +++ b/.github/workflows/hello-charm-tests.yaml @@ -27,19 +27,19 @@ jobs: commit: 046b8ce758660d5aa9cf05207e2370fcbab688d0 # 2021-12-16T10:10:24Z steps: - name: Set up Python 3.10 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.10' - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} persist-credentials: false ref: ${{ matrix.commit }} - name: Download operator wheels - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index c873ab5e6..e74d1143a 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -28,7 +28,7 @@ jobs: --juju-channel=3/stable --charmcraft-channel=3.x/stable -p "${{ matrix.preset }}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -54,7 +54,7 @@ jobs: --juju-channel=${{ matrix.juju-channel }} --charmcraft-channel=3.x/stable -p microk8s - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -81,7 +81,7 @@ jobs: sudo concierge prepare --juju-channel=${{ matrix.juju-channel }} -p "${{ matrix.preset }}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 diff --git a/.github/workflows/observability-charm-tests.yaml b/.github/workflows/observability-charm-tests.yaml index fa04b20e9..1cb736f8d 100644 --- a/.github/workflows/observability-charm-tests.yaml +++ b/.github/workflows/observability-charm-tests.yaml @@ -30,14 +30,14 @@ jobs: commit: f3999254035d5f39eda07261af2b86a4454846d4 # 2026-05-20T14:52:38Z steps: - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} persist-credentials: false ref: ${{ matrix.commit }} - name: Download operator wheels - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index a214cb28d..4bf6b31b6 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -17,7 +17,7 @@ jobs: contents: read environment: publish-pypi steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 @@ -28,10 +28,10 @@ jobs: run: | set -xueo pipefail uvx --with "$(echo -n dist/ops-*.whl)[testing,tracing]" --with dist/ops_scenario-*.whl --with dist/ops_tracing-*.whl python -c 'import ops, scenario, ops_tracing; print("OK")' - - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-path: 'dist/*' - - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 secscan: uses: ./.github/workflows/sbom-secscan.yaml diff --git a/.github/workflows/published-charms-tests.yaml b/.github/workflows/published-charms-tests.yaml index 806b207b4..355ab556a 100644 --- a/.github/workflows/published-charms-tests.yaml +++ b/.github/workflows/published-charms-tests.yaml @@ -191,7 +191,7 @@ jobs: # END AUTOGENERATED CONTENT steps: - name: Checkout operator repository (for helper scripts) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: path: operator-repo persist-credentials: false @@ -203,14 +203,14 @@ jobs: rm -rf operator-repo - name: Checkout the ${{ matrix.charm-repo }} repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: ${{ matrix.charm-repo }} path: charm-repo persist-credentials: false - name: Download operator wheels - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels @@ -289,7 +289,7 @@ jobs: run: charmcraft init --profile=${{ matrix.profile }} --author=charm-tech - name: Download operator wheels - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.build-wheels.outputs.artifact-name }} path: operator-wheels diff --git a/.github/workflows/sbom-secscan.yaml b/.github/workflows/sbom-secscan.yaml index b8ad69064..9c063a06b 100644 --- a/.github/workflows/sbom-secscan.yaml +++ b/.github/workflows/sbom-secscan.yaml @@ -17,7 +17,7 @@ jobs: runs-on: [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium] steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Install dependencies @@ -26,7 +26,7 @@ jobs: sudo apt-get install -y libapt-pkg-dev sudo apt install -y python3-apt - name: Checkout security scanner - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: canonical/sbomber path: scanner @@ -53,7 +53,7 @@ jobs: run: | cd scanner && ./sbomber download - name: Upload reports - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: secscan-report-upload-${{ matrix.manifest }} path: ./scanner/reports/ diff --git a/.github/workflows/smoke.yaml b/.github/workflows/smoke.yaml index e93c403a6..797b8114e 100644 --- a/.github/workflows/smoke.yaml +++ b/.github/workflows/smoke.yaml @@ -26,7 +26,7 @@ jobs: --charmcraft-channel=3.x/stable -p "${{ matrix.preset }}" - name: Checkout the repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -40,7 +40,7 @@ jobs: - name: Archive charmcraft logs if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: charmcraft-logs path: /home/runner/.local/state/charmcraft/log/*.log diff --git a/.github/workflows/test-publish.yaml b/.github/workflows/test-publish.yaml index 66809270e..ec688e67d 100644 --- a/.github/workflows/test-publish.yaml +++ b/.github/workflows/test-publish.yaml @@ -12,13 +12,13 @@ jobs: name: Build and publish to Test PYPI runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: false - run: uv build --all - - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 with: repository-url: https://test.pypi.org/legacy/ diff --git a/.github/workflows/tiobe.yaml b/.github/workflows/tiobe.yaml index 9bf07ad24..0f2b74cea 100644 --- a/.github/workflows/tiobe.yaml +++ b/.github/workflows/tiobe.yaml @@ -11,7 +11,7 @@ jobs: TICS: runs-on: [self-hosted, reactive, amd64, tiobe, noble] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false diff --git a/.github/workflows/update-best-practice-doc.yaml b/.github/workflows/update-best-practice-doc.yaml index 970f8970b..fa3a557cf 100644 --- a/.github/workflows/update-best-practice-doc.yaml +++ b/.github/workflows/update-best-practice-doc.yaml @@ -11,19 +11,19 @@ jobs: update-docs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ secrets.UPDATE_DOCS_ACCESS_TOKEN }} path: operator persist-credentials: true - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: canonical/charmcraft path: charmcraft persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" - run: python .github/update-best-practice-table.py --path-to-charmcraft='${{ github.workspace }}/charmcraft' > docs/reuse/best-practices.txt diff --git a/.github/workflows/update-charm-tests.yaml b/.github/workflows/update-charm-tests.yaml index 1a704c609..408bae3dc 100644 --- a/.github/workflows/update-charm-tests.yaml +++ b/.github/workflows/update-charm-tests.yaml @@ -13,7 +13,7 @@ jobs: update-pins: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ secrets.UPDATE_CHARM_PINS_ACCESS_TOKEN }} persist-credentials: true diff --git a/.github/workflows/validate-pr-title.yaml b/.github/workflows/validate-pr-title.yaml index 1f10cbc33..119d6a2b0 100644 --- a/.github/workflows/validate-pr-title.yaml +++ b/.github/workflows/validate-pr-title.yaml @@ -13,7 +13,7 @@ jobs: name: Validate PR title runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - run: python3 .github/check-conventional-pr-title.py diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index b631e5009..a8e2a2547 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -16,7 +16,7 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -29,7 +29,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: results.sarif category: zizmor From 0a5254f212d99881769a1a2e4e4976dacd84bd9b Mon Sep 17 00:00:00 2001 From: Tony Meyer Date: Thu, 2 Jul 2026 19:28:02 +1200 Subject: [PATCH 3/3] ci: bump setup-python to v6 in update-charm-pins action Aligns with the v6 pin used in every other workflow. Co-Authored-By: Claude Opus 4.7 --- .github/actions/update-charm-pins/action.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/update-charm-pins/action.yaml b/.github/actions/update-charm-pins/action.yaml index f4be97c15..c69d4125f 100644 --- a/.github/actions/update-charm-pins/action.yaml +++ b/.github/actions/update-charm-pins/action.yaml @@ -17,7 +17,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12"