Skip to content

Commit 4282433

Browse files
artyom-morozovartyom-morozov
committed
feat: pin all actions
1 parent 3ce9493 commit 4282433

File tree

7 files changed

+56
-25
lines changed

7 files changed

+56
-25
lines changed

‎.github/actions/hatch-lint-test/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,21 +55,21 @@ runs:
5555
hatch test --python ${{ inputs.max-python-version }} --cover --parallel --junitxml=junit-${{ inputs.max-python-version }}.xml
5656
5757
- name: Status Check - Unit Tests on default python version
58-
uses: mikepenz/action-junit-report@v5
58+
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
5959
if: hashFiles('junit-default.xml') != ''
6060
with:
6161
check_name: Unit Tests on default python version
6262
report_paths: junit-default.xml
6363

6464
- name: Status Check - Unit Tests on Python ${{ inputs.min-python-version }}
65-
uses: mikepenz/action-junit-report@v5
65+
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
6666
if: hashFiles('junit-${{ inputs.min-python-version }}.xml') != ''
6767
with:
6868
check_name: Unit Tests on Python ${{ inputs.min-python-version }}
6969
report_paths: junit-${{ inputs.min-python-version }}.xml
7070

7171
- name: Status Check - Unit Tests on Python ${{ inputs.max-python-version }}
72-
uses: mikepenz/action-junit-report@v5
72+
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
7373
if: hashFiles('junit-${{ inputs.max-python-version }}.xml') != ''
7474
with:
7575
check_name: Unit Tests on Python ${{ inputs.max-python-version }}

‎.github/actions/hatch-release-pypi/action.yml‎

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,12 +101,43 @@ runs:
101101
shell: bash
102102
run: hatch build
103103

104-
# Publish using Trusted Publishing - no password required
104+
# Publish using Trusted Publishing - manual approach for composite action compatibility
105105
# See: https://docs.pypi.org/trusted-publishers/using-a-publisher/
106+
- name: Mint PyPI API token via OIDC
107+
id: mint-token
108+
shell: bash
109+
run: |
110+
# Retrieve the ambient OIDC token
111+
resp=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
112+
"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
113+
oidc_token=$(jq -r '.value' <<< "${resp}")
114+
115+
if [ -z "$oidc_token" ] || [ "$oidc_token" = "null" ]; then
116+
echo "::error::Failed to retrieve OIDC token"
117+
exit 1
118+
fi
119+
120+
# Exchange the OIDC token for a PyPI API token
121+
resp=$(curl -sS -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}")
122+
api_token=$(jq -r '.token' <<< "${resp}")
123+
124+
if [ -z "$api_token" ] || [ "$api_token" = "null" ]; then
125+
echo "::error::Failed to mint PyPI API token. Response: $resp"
126+
exit 1
127+
fi
128+
129+
# Mask the token to prevent leaking
130+
echo "::add-mask::${api_token}"
131+
echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}"
132+
106133
- name: Publish package distributions to PyPI
107-
uses: pypa/gh-action-pypi-publish@release/v1
108-
with:
109-
verbose: true
134+
shell: bash
135+
env:
136+
TWINE_USERNAME: __token__
137+
TWINE_PASSWORD: ${{ steps.mint-token.outputs.api-token }}
138+
run: |
139+
pip install --quiet twine
140+
twine upload --verbose dist/*
110141
111142
- name: Push version bump commit to main
112143
if: ${{ env.SKIP_BUMP == '0' }}
@@ -115,7 +146,7 @@ runs:
115146
git push
116147
117148
- name: Create Release
118-
uses: ncipollo/release-action@v1
149+
uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
119150
env:
120151
NEW_VERSION: ${{ env.NEW_VERSION }}
121152
GITHUB_TOKEN: ${{ inputs.github_token }}

‎.github/actions/hatch-setup/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ runs:
5959
echo "matrix-present=$MATRIX_PRESENT" >> $GITHUB_OUTPUT
6060
6161
- name: Restore Hatch Directory
62-
uses: actions/cache@v4
62+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
6363
id: cache
6464
with:
6565
path: |
@@ -70,7 +70,7 @@ runs:
7070
- name: Install Python Versions for Hatch Test Matrix
7171
id: setup-python
7272
if: steps.test-matrix-present.outputs.matrix-present == 'true'
73-
uses: actions/[email protected]
73+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
7474
with:
7575
python-version: |
7676
${{ inputs.min-python-version }}
@@ -81,7 +81,7 @@ runs:
8181
- name: Install Python Version from pyproject.toml
8282
id: setup-python-default
8383
if: steps.test-matrix-present.outputs.matrix-present == 'false'
84-
uses: actions/[email protected]
84+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
8585
with:
8686
python-version-file: "pyproject.toml"
8787
cache: "pip"

‎.github/actions/validate-dependency-conflicts/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ runs:
8989
9090
- name: Comment on PR with Conflicts
9191
if: steps.validate.outputs.conflicts-found == 'true' && github.event_name == 'pull_request'
92-
uses: actions/github-script@v7
92+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
9393
with:
9494
script: |
9595
const fs = require('fs');
@@ -147,7 +147,7 @@ runs:
147147
148148
- name: Upload Conflict Report
149149
if: always()
150-
uses: actions/upload-artifact@v4
150+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
151151
with:
152152
name: dependency-conflict-report
153153
path: dependency_conflicts.txt

‎.github/workflows/hatch_ci.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -137,12 +137,12 @@ jobs:
137137
path: workflows-repo
138138

139139
- name: Setup Python ${{ matrix.python-version }}
140-
uses: actions/[email protected]
140+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
141141
with:
142142
python-version: ${{ matrix.python-version }}
143143

144144
- name: Install uv
145-
uses: astral-sh/setup-uv@v4
145+
uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
146146
with:
147147
enable-cache: true
148148

@@ -188,7 +188,7 @@ jobs:
188188
shell: bash
189189

190190
- name: Upload Coverage and Test Results
191-
uses: actions/upload-artifact@v4
191+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
192192
with:
193193
name: coverage-${{ matrix.python-version }}
194194
path: |
@@ -230,12 +230,12 @@ jobs:
230230
npm run build
231231
232232
- name: Setup Python for Build
233-
uses: actions/[email protected]
233+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
234234
with:
235235
python-version: ${{ inputs.max-python-version }}
236236

237237
- name: Install uv
238-
uses: astral-sh/setup-uv@v4
238+
uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
239239
with:
240240
enable-cache: true
241241

@@ -285,7 +285,7 @@ jobs:
285285
fetch-depth: 0
286286

287287
- name: Download Coverage Artifacts
288-
uses: actions/download-artifact@v4
288+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
289289
with:
290290
pattern: coverage-${{ inputs.max-python-version }}
291291
path: coverage-data-${{ inputs.max-python-version }}
@@ -353,7 +353,7 @@ jobs:
353353
path: workflows-repo
354354

355355
- name: Setup Python for Whitesource Scan
356-
uses: actions/[email protected]
356+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
357357
with:
358358
python-version: ${{ inputs.max-python-version }}
359359
cache: "pip"

‎.github/workflows/hatch_release_pypi.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ jobs:
117117
commit_hash: ${{ steps.set_commit_hash.outputs.commit_hash }}
118118
steps:
119119
- name: Checkout
120-
uses: actions/checkout@v5
120+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
121121
with:
122122
fetch-depth: 0
123123
ssh-key: ${{ secrets.COMMIT_KEY }}
@@ -218,7 +218,7 @@ jobs:
218218
219219
- name: Setup Node.js
220220
if: inputs.npm_package_path != ''
221-
uses: actions/setup-node@v4
221+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
222222
with:
223223
node-version: ${{ inputs.node_version }}
224224
cache: "npm"
@@ -293,7 +293,7 @@ jobs:
293293
run: hatch build
294294

295295
- name: Publish package distributions to PyPI
296-
uses: pypa/[email protected]
296+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
297297
with:
298298
verbose: true
299299
password: ${{ secrets.PYPI_TOKEN }}
@@ -304,7 +304,7 @@ jobs:
304304
git push
305305
306306
- name: Create Release
307-
uses: ncipollo/release-action@v1
307+
uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
308308
env:
309309
NEW_VERSION: ${{ env.NEW_VERSION }}
310310
with:

‎.github/workflows/hatch_release_security_checks.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
runs-on: ubuntu-latest
7171
steps:
7272
- name: Checkout
73-
uses: actions/checkout@v5
73+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
7474
with:
7575
fetch-depth: 0
7676

0 commit comments

Comments
 (0)