From b988ca046065d03f4f0fb50007c182d9d39e8378 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Sat, 1 Aug 2026 19:10:47 +0800 Subject: [PATCH] ci: pin checkout action by commit SHA Co-Authored-By: Codex --- .github/workflows/vps_codex_service_ops.yml | 2 +- tests/test_run_monthly_codex_audit.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/vps_codex_service_ops.yml b/.github/workflows/vps_codex_service_ops.yml index 5ffffe1..441985b 100644 --- a/.github/workflows/vps_codex_service_ops.yml +++ b/.github/workflows/vps_codex_service_ops.yml @@ -34,7 +34,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout Bridge - uses: actions/checkout@v6.0.3 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Verify trusted QPK drift workflow refs env: diff --git a/tests/test_run_monthly_codex_audit.py b/tests/test_run_monthly_codex_audit.py index c2c3319..9e67ade 100644 --- a/tests/test_run_monthly_codex_audit.py +++ b/tests/test_run_monthly_codex_audit.py @@ -2425,7 +2425,7 @@ def test_vps_ops_workflow_runs_only_manual_self_hosted_ops(self) -> None: self.assertIn("QuantStrategyLab/CryptoLivePoolPipelines", workflow) self.assertIn("QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main", workflow) self.assertNotIn("QuantStrategyLab/CodexAuditBridge", workflow) - self.assertIn("actions/checkout@v6.0.3", workflow) + self.assertIn("actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3", workflow) def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None: deploy_script = Path("scripts/deploy_codex_audit_service.sh").read_text(encoding="utf-8")