DEVOPS-1133: Pin GitHub Actions to commit hashes - #211
Open
RomFloreani wants to merge 2 commits into
Open
Conversation
github-actions
Bot
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates this repository’s GitHub Actions workflows and composite actions to move from major-version tags (e.g., @v6) to patch-level semver tags (e.g., @v6.1.0) for third-party actions and internal reusable workflows/actions.
Changes:
- Expand multiple
uses:references from major tags to full semver tags across reusable workflows. - Update internal
MiraGeoscience/CI-toolsreusable workflows/actions references to@v3.9.1. - Refresh action references used by Python build/test/release and zizmor security scanning workflows.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/reusable-zizmor-security.yml | Updates checkout and internal zizmor-config action references to patch-level semver tags. |
| .github/workflows/reusable-zizmor-annotate.yml | Updates checkout and internal zizmor-config action references to patch-level semver tags. |
| .github/workflows/reusable-zizmor-advanced-security.yml | Updates checkout and internal zizmor-config action references to patch-level semver tags. |
| .github/workflows/reusable-version-check.yml | Updates setup-python and setup-uv to patch-level semver tags. |
| .github/workflows/reusable-python-static_analysis.yml | Updates checkout/setup-python and internal setup actions to patch-level semver tags. |
| .github/workflows/reusable-python-release_pypi_assets.yml | Updates internal release/artifactory publishing action references to patch-level semver tags. |
| .github/workflows/reusable-python-release_conda_assets.yml | Updates internal release/artifactory publishing action references to patch-level semver tags. |
| .github/workflows/reusable-python-pytest.yml | Updates checkout/setup-python, internal setup actions, and codecov action to patch-level semver tags. |
| .github/workflows/reusable-python-publish_rattler_package.yml | Updates checkout/setup-python, artifact actions, and internal reusable workflow/action references to patch-level semver tags. |
| .github/workflows/reusable-python-publish_pypi_package.yml | Updates internal reusable workflow/action references and download-artifact to patch-level semver tags. |
| .github/workflows/reusable-python-build_setuptools_package.yml | Updates checkout/setup-python and upload-artifact to patch-level semver tags. |
| .github/workflows/reusable-python-build_poetry_package.yml | Updates checkout/setup-python and upload-artifact to patch-level semver tags. |
| .github/workflows/reusable-pre_commit.yml | Updates checkout/setup-python/setup-uv/cache actions to patch-level semver tags. |
| .github/workflows/reusable-jira-issue_to_jira.yml | Updates create-or-update-comment action to a patch-level semver tag. |
| .github/workflows/move-major-minor-tags.yml | Updates checkout action to a patch-level semver tag. |
| .github/actions/reusable-python-setup_poetry/action.yml | Updates install-poetry and cache actions to patch-level semver tags. |
| .github/actions/reusable-python-setup_hatch/action.yml | Updates cache action to a patch-level semver tag. |
| .github/actions/reusable-python-setup_conda/action.yml | Updates checkout and setup-micromamba actions to patch-level semver tags. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "base-depth=$depth" | ||
| echo "base-depth=$depth" >> $GITHUB_OUTPUT | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v6.1.0 |
| using: composite | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@v5.1.0 |
…voids Windows glob bug)
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
.github/workflows/reusable-zizmor-annotate.yml:42
- The version comment repeats the commit SHA ("# 0dce…") rather than a tag/semver label. If the intent is to keep Dependabot-readable version hints consistent with other pinned actions in this PR, update the comment to the corresponding upstream release ref (e.g. "# vX.Y.Z") that points to this SHA.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-advanced-security.yml:42
- The version comment repeats the commit SHA ("# 0dce…") rather than a tag/semver label. For the Dependabot-readable hint described in the PR, this comment should reference the tag/release ref that resolves to this SHA (e.g. "# vX.Y.Z") to match the approach used for other actions here.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-security.yml:42
- The version comment repeats the commit SHA ("# 0dce…") rather than a tag/semver label. If the goal is a Dependabot-readable version hint (as described in the PR), this should be the action’s release ref (e.g. "# vX.Y.Z" or whatever tag points at this SHA); otherwise the comment is redundant and may not help automated updates.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
with:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every
uses:to a commit hash with a dependabot-readable version comment.Tags expanded in this repo:
actions/checkout@v5 -> @v5.1.0mamba-org/setup-micromamba@v2 -> @v2.0.7mamba-org/setup-micromamba@v2 -> @v2.0.7actions/cache@v4 -> @v4.3.0snok/install-poetry@v1 -> @v1.4.2actions/cache@v4 -> @v4.3.0actions/checkout@v6 -> @v6.1.0peter-evans/create-or-update-comment@v5 -> @v5.0.0actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0astral-sh/setup-uv@v7 -> @v7.6.0actions/cache@v5 -> @v5.1.0actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0actions/upload-artifact@v7 -> @v7.0.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0actions/upload-artifact@v7 -> @v7.0.1MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_poetry_package.yml@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_setuptools_package.yml@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0actions/upload-artifact@v7 -> @v7.0.1MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@v3 -> @v3.9.1codecov/codecov-action@v6 -> @v6.0.2MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@v3 -> @v3.9.1actions/setup-python@v6 -> @v6.3.0astral-sh/setup-uv@v7 -> @v7.6.0actions/checkout@v6 -> @v6.1.0MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@v3 -> @v3.9.1actions/checkout@v6 -> @v6.1.0MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@v3 -> @v3.9.1actions/checkout@v6 -> @v6.1.0MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@v3 -> @v3.9.1