From a76444f663ac648dd5bab9be28247af76b6a42dd Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Wed, 29 Jul 2026 12:39:00 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to commit hashes --- .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/python_analysis.yml | 4 ++-- .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- .github/workflows/security_scan.yml | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index 74e79b9..71a8da2 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -8,7 +8,7 @@ permissions: {} jobs: call-workflow-create-jira-issue: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3.9.1 permissions: contents: read issues: write diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index 084ddfc..7ca5c6a 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -6,7 +6,7 @@ on: jobs: call-workflow-pr_jira_actions: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3.9.1 permissions: contents: read pull-requests: write diff --git a/.github/workflows/python_analysis.yml b/.github/workflows/python_analysis.yml index 5c984dd..a74c057 100644 --- a/.github/workflows/python_analysis.yml +++ b/.github/workflows/python_analysis.yml @@ -26,7 +26,7 @@ concurrency: jobs: call-workflow-static-analysis: name: Static analysis - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3.9.1 permissions: contents: read pull-requests: read @@ -36,7 +36,7 @@ jobs: python-version: '3.12' call-workflow-pytest: name: Pytest - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3.9.1 permissions: contents: read pull-requests: read diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index 30114e9..27078d6 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -14,7 +14,7 @@ concurrency: jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.9.1 permissions: id-token: write contents: write @@ -30,7 +30,7 @@ jobs: JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory, TestPyPI) - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.9.1 permissions: id-token: write contents: write diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index ae9c136..f48e305 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -29,7 +29,7 @@ jobs: call-workflow-conda-release: name: Publish production Conda package on JFrog Artifactory if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.9.1 permissions: id-token: write contents: write @@ -42,7 +42,7 @@ jobs: call-workflow-pypi-release: name: Publish production PyPI package (JFrog Artifactory, PyPI) if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.9.1 permissions: id-token: write contents: write diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index 3eb2899..534c27b 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -31,7 +31,7 @@ jobs: security-events: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3.9.1 call-workflow-zizmor-advanced-security: name: Zizmor analysis (annotate) @@ -40,4 +40,4 @@ jobs: checks: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3.9.1 From 62957c90dc02ccbee93dc2e21a9bb94dee0349a0 Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Wed, 29 Jul 2026 13:26:13 -0400 Subject: [PATCH 2/2] Pin GitHub Actions to commit hashes (retry with explicit file list, avoids Windows glob bug) --- .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/python_analysis.yml | 4 ++-- .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- .github/workflows/security_scan.yml | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index 71a8da2..9b11874 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -8,7 +8,7 @@ permissions: {} jobs: call-workflow-create-jira-issue: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read issues: write diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index 7ca5c6a..1cc12e9 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -6,7 +6,7 @@ on: jobs: call-workflow-pr_jira_actions: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read pull-requests: write diff --git a/.github/workflows/python_analysis.yml b/.github/workflows/python_analysis.yml index a74c057..5438c2e 100644 --- a/.github/workflows/python_analysis.yml +++ b/.github/workflows/python_analysis.yml @@ -26,7 +26,7 @@ concurrency: jobs: call-workflow-static-analysis: name: Static analysis - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read pull-requests: read @@ -36,7 +36,7 @@ jobs: python-version: '3.12' call-workflow-pytest: name: Pytest - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read pull-requests: read diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index 27078d6..c592c4c 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -14,7 +14,7 @@ concurrency: jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: id-token: write contents: write @@ -30,7 +30,7 @@ jobs: JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory, TestPyPI) - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: id-token: write contents: write diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index f48e305..81319ab 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -29,7 +29,7 @@ jobs: call-workflow-conda-release: name: Publish production Conda package on JFrog Artifactory if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: id-token: write contents: write @@ -42,7 +42,7 @@ jobs: call-workflow-pypi-release: name: Publish production PyPI package (JFrog Artifactory, PyPI) if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: id-token: write contents: write diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index 534c27b..1c8f812 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -31,7 +31,7 @@ jobs: security-events: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 call-workflow-zizmor-advanced-security: name: Zizmor analysis (annotate) @@ -40,4 +40,4 @@ jobs: checks: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1