Merge branch 'master' into step-security-bot/stepsecurity_remediation_1737675121

Author: MaxymVlasov

.github/workflows/ci-cd.yml

@@ -519,7 +519,8 @@ jobs:
 
     steps:
     - name: Decide whether the needed jobs succeeded or failed
-      uses: re-actors/alls-green@release/v1
+      # yamllint disable-line rule:line-length
+      uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # release/v1
       with:
         jobs: ${{ toJSON(needs) }}
 

.github/workflows/dependency-review.yml

@@ -0,0 +1,29 @@
+---
+
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a
+# Pull Request, surfacing known-vulnerable versions of the packages declared
+# or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repository
+      # yamllint disable-line rule:line-length
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - name: Dependency Review
+      # yamllint disable-line rule:line-length
+      uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019  # v4.5.0

.github/workflows/reusable-tox.yml

@@ -173,7 +173,8 @@ jobs:
     - name: Retrieve the project source from an sdist inside the GHA artifact
       if: >-
         !contains(fromJSON('["pre-commit", "spellcheck-docs"]'), inputs.toxenv)
-      uses: re-actors/checkout-python-sdist@release/v2
+      # yamllint disable-line rule:line-length
+      uses: re-actors/checkout-python-sdist@187f55296b0f54d88259aaaf99af32ad3647d3bc  # release/v2
       with:
         source-tarball-name: ${{ inputs.source-tarball-name }}
         workflow-artifact-name: ${{ inputs.dists-artifact-name }}