Skip to content

Commit ee10b53

Browse files
authored
chore: hash-pin everything (#165)
1 parent 300d339 commit ee10b53

File tree

13 files changed

+249
-34
lines changed

13 files changed

+249
-34
lines changed

.github/workflows/ci.yml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,11 @@ jobs:
1010
lint:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1414
with:
1515
persist-credentials: false
1616

17-
- uses: actions/setup-python@v5
18-
with:
19-
python-version: "3.x"
17+
- uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
2018

2119
- name: lint
2220
run: make lint

.github/workflows/release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
release:
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2020
with:
2121
persist-credentials: false
2222

.github/workflows/selftest.yml

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
runs-on: ${{ matrix.os }}
2626
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
2727
steps:
28-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2929
with:
3030
persist-credentials: false
31-
- uses: actions/setup-python@v5
31+
- uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
3232
if: ${{ matrix.os != 'ubuntu-latest' }}
3333
with:
3434
python-version: "3.x"
@@ -55,7 +55,7 @@ jobs:
5555
runs-on: ${{ matrix.os }}
5656
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
5757
steps:
58-
- uses: actions/checkout@v4
58+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
5959
with:
6060
persist-credentials: false
6161
- name: Sign artifact and publish signature
@@ -81,10 +81,10 @@ jobs:
8181
runs-on: ${{ matrix.os }}
8282
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
8383
steps:
84-
- uses: actions/checkout@v4
84+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
8585
with:
8686
persist-credentials: false
87-
- uses: actions/setup-python@v5
87+
- uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
8888
if: ${{ matrix.os != 'ubuntu-latest' }}
8989
with:
9090
python-version: "3.x"
@@ -117,7 +117,7 @@ jobs:
117117
- "/tmp/extremely-nonexistent-file"
118118
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
119119
steps:
120-
- uses: actions/checkout@v4
120+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
121121
with:
122122
persist-credentials: false
123123
- name: Sign artifact and publish signature
@@ -142,7 +142,7 @@ jobs:
142142
runs-on: ubuntu-latest
143143
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
144144
steps:
145-
- uses: actions/checkout@v4
145+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
146146
with:
147147
persist-credentials: false
148148
- name: Sign artifact and publish signature
@@ -162,7 +162,7 @@ jobs:
162162
runs-on: ubuntu-latest
163163
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
164164
steps:
165-
- uses: actions/checkout@v4
165+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
166166
with:
167167
persist-credentials: false
168168
- name: Sign artifacts and publish signatures
@@ -186,7 +186,7 @@ jobs:
186186
TEST_DIR: test
187187
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
188188
steps:
189-
- uses: actions/checkout@v4
189+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
190190
with:
191191
persist-credentials: false
192192
- name: Sign artifacts and publish signatures
@@ -214,7 +214,7 @@ jobs:
214214
runs-on: ubuntu-latest
215215
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
216216
steps:
217-
- uses: actions/checkout@v4
217+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
218218
with:
219219
persist-credentials: false
220220
- name: Sign artifacts and publish signatures
@@ -241,7 +241,7 @@ jobs:
241241
runs-on: ubuntu-latest
242242
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
243243
steps:
244-
- uses: actions/checkout@v4
244+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
245245
with:
246246
persist-credentials: false
247247
- name: Sign artifact and publish signature
@@ -252,7 +252,7 @@ jobs:
252252
staging: true
253253
upload-signing-artifacts: true
254254
internal-be-careful-debug: true
255-
- uses: actions/download-artifact@v4
255+
- uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
256256
with:
257257
name: "signing-artifacts-${{ github.job }}"
258258
path: ./test/uploaded
@@ -268,7 +268,7 @@ jobs:
268268
runs-on: ubuntu-latest
269269
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
270270
steps:
271-
- uses: actions/checkout@v4
271+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
272272
with:
273273
persist-credentials: false
274274
- name: Sign artifact and publish signature
@@ -308,7 +308,7 @@ jobs:
308308

309309
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
310310
steps:
311-
- uses: actions/checkout@v4
311+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
312312
with:
313313
persist-credentials: false
314314
- name: Sign artifact and publish signature
@@ -338,7 +338,7 @@ jobs:
338338
runs-on: ubuntu-latest
339339
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
340340
steps:
341-
- uses: actions/checkout@v4
341+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
342342
with:
343343
persist-credentials: false
344344
- name: Get OIDC token

.github/workflows/semgrep.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
image: semgrep/semgrep
2020

2121
steps:
22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2323
with:
2424
persist-credentials: false
2525
- run: semgrep ci

.github/workflows/zizmor.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,20 @@ jobs:
1717
actions: read
1818
steps:
1919
- name: Checkout repository
20-
uses: actions/checkout@v4
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2121
with:
2222
persist-credentials: false
2323

2424
- name: Install the latest version of uv
25-
uses: astral-sh/setup-uv@v5
25+
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
2626

2727
- name: Run zizmor 🌈
2828
run: uvx zizmor --format sarif . > results.sarif
2929
env:
3030
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3131

3232
- name: Upload SARIF file
33-
uses: github/codeql-action/upload-sarif@v3
33+
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3
3434
with:
3535
sarif_file: results.sarif
3636
category: zizmor

Makefile

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
1+
12
.PHONY: all
23
all:
34
@echo "Run my targets individually!"
45

5-
env/pyvenv.cfg: dev-requirements.txt
6-
python3 -m venv env
7-
./env/bin/python -m pip install --upgrade pip
8-
./env/bin/python -m pip install --requirement dev-requirements.txt
6+
.PHONY: requirements
7+
requirements: requirements/main.txt requirements/dev.txt
8+
9+
requirements/%.txt: requirements/%.in
10+
uv pip compile --generate-hashes --prerelease=allow --output-file=$@ $<
11+
12+
env/pyvenv.cfg: requirements/dev.txt requirements/main.txt
13+
uv venv
14+
uv pip install -r requirements/main.txt -r requirements/dev.txt
915

1016
.PHONY: dev
1117
dev: env/pyvenv.cfg
1218

1319
.PHONY: lint
1420
lint: env/pyvenv.cfg action.py
15-
. ./env/bin/activate && \
21+
. ./.venv/bin/activate && \
1622
black action.py && \
1723
isort action.py && \
1824
mypy action.py && \

action.py

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,10 @@
3737
_SUMMARY = Path(_summary_path).open("a")
3838

3939
_RENDER_SUMMARY = os.getenv("GHA_SIGSTORE_PYTHON_SUMMARY", "true") == "true"
40-
_DEBUG = os.getenv("GHA_SIGSTORE_PYTHON_INTERNAL_BE_CAREFUL_DEBUG", "false") != "false" or \
41-
os.getenv("ACTIONS_STEP_DEBUG", "false") == "true"
40+
_DEBUG = (
41+
os.getenv("GHA_SIGSTORE_PYTHON_INTERNAL_BE_CAREFUL_DEBUG", "false") != "false"
42+
or os.getenv("ACTIONS_STEP_DEBUG", "false") == "true"
43+
)
4244

4345
_RELEASE_SIGNING_ARTIFACTS = (
4446
os.getenv("GHA_SIGSTORE_PYTHON_RELEASE_SIGNING_ARTIFACTS", "true") == "true"

action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,13 +101,13 @@ runs:
101101
GHA_SIGSTORE_PYTHON_INPUTS: "${{ inputs.inputs }}"
102102
shell: bash
103103

104-
- uses: actions/upload-artifact@v4
104+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
105105
if: inputs.upload-signing-artifacts == 'true'
106106
with:
107107
name: "signing-artifacts-${{ github.job }}"
108108
path: "${{ env.GHA_SIGSTORE_PYTHON_INTERNAL_SIGNING_ARTIFACTS }}"
109109

110-
- uses: softprops/action-gh-release@v2
110+
- uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2
111111
if: inputs.release-signing-artifacts == 'true' && github.event_name == 'release' && github.event.action == 'published'
112112
with:
113113
files: "${{ env.GHA_SIGSTORE_PYTHON_INTERNAL_SIGNING_ARTIFACTS }}"
File renamed without changes.

requirements/dev.txt

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# This file was autogenerated by uv via the following command:
2+
# uv pip compile --generate-hashes --prerelease=allow --output-file=requirements/dev.txt requirements/dev.in
3+
black==25.1.0 \
4+
--hash=sha256:030b9759066a4ee5e5aca28c3c77f9c64789cdd4de8ac1df642c40b708be6171 \
5+
--hash=sha256:055e59b198df7ac0b7efca5ad7ff2516bca343276c466be72eb04a3bcc1f82d7 \
6+
--hash=sha256:0e519ecf93120f34243e6b0054db49c00a35f84f195d5bce7e9f5cfc578fc2da \
7+
--hash=sha256:172b1dbff09f86ce6f4eb8edf9dede08b1fce58ba194c87d7a4f1a5aa2f5b3c2 \
8+
--hash=sha256:1e2978f6df243b155ef5fa7e558a43037c3079093ed5d10fd84c43900f2d8ecc \
9+
--hash=sha256:33496d5cd1222ad73391352b4ae8da15253c5de89b93a80b3e2c8d9a19ec2666 \
10+
--hash=sha256:3b48735872ec535027d979e8dcb20bf4f70b5ac75a8ea99f127c106a7d7aba9f \
11+
--hash=sha256:4b60580e829091e6f9238c848ea6750efed72140b91b048770b64e74fe04908b \
12+
--hash=sha256:759e7ec1e050a15f89b770cefbf91ebee8917aac5c20483bc2d80a6c3a04df32 \
13+
--hash=sha256:8f0b18a02996a836cc9c9c78e5babec10930862827b1b724ddfe98ccf2f2fe4f \
14+
--hash=sha256:95e8176dae143ba9097f351d174fdaf0ccd29efb414b362ae3fd72bf0f710717 \
15+
--hash=sha256:96c1c7cd856bba8e20094e36e0f948718dc688dba4a9d78c3adde52b9e6c2299 \
16+
--hash=sha256:a1ee0a0c330f7b5130ce0caed9936a904793576ef4d2b98c40835d6a65afa6a0 \
17+
--hash=sha256:a22f402b410566e2d1c950708c77ebf5ebd5d0d88a6a2e87c86d9fb48afa0d18 \
18+
--hash=sha256:a39337598244de4bae26475f77dda852ea00a93bd4c728e09eacd827ec929df0 \
19+
--hash=sha256:afebb7098bfbc70037a053b91ae8437c3857482d3a690fefc03e9ff7aa9a5fd3 \
20+
--hash=sha256:bacabb307dca5ebaf9c118d2d2f6903da0d62c9faa82bd21a33eecc319559355 \
21+
--hash=sha256:bce2e264d59c91e52d8000d507eb20a9aca4a778731a08cfff7e5ac4a4bb7096 \
22+
--hash=sha256:d9e6827d563a2c820772b32ce8a42828dc6790f095f441beef18f96aa6f8294e \
23+
--hash=sha256:db8ea9917d6f8fc62abd90d944920d95e73c83a5ee3383493e35d271aca872e9 \
24+
--hash=sha256:ea0213189960bda9cf99be5b8c8ce66bb054af5e9e861249cd23471bd7b0b3ba \
25+
--hash=sha256:f3df5f1bf91d36002b0a75389ca8663510cf0531cca8aa5c1ef695b46d98655f
26+
# via -r requirements/dev.in
27+
click==8.1.8 \
28+
--hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2 \
29+
--hash=sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a
30+
# via black
31+
flake8==7.2.0 \
32+
--hash=sha256:93b92ba5bdb60754a6da14fa3b93a9361fd00a59632ada61fd7b130436c40343 \
33+
--hash=sha256:fa558ae3f6f7dbf2b4f22663e5343b6b6023620461f8d4ff2019ef4b5ee70426
34+
# via -r requirements/dev.in
35+
isort==6.0.1 \
36+
--hash=sha256:1cb5df28dfbc742e490c5e41bad6da41b805b0a8be7bc93cd0fb2a8a890ac450 \
37+
--hash=sha256:2dc5d7f65c9678d94c88dfc29161a320eec67328bc97aad576874cb4be1e9615
38+
# via -r requirements/dev.in
39+
mccabe==0.7.0 \
40+
--hash=sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325 \
41+
--hash=sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e
42+
# via flake8
43+
mypy==1.15.0 \
44+
--hash=sha256:1124a18bc11a6a62887e3e137f37f53fbae476dc36c185d549d4f837a2a6a14e \
45+
--hash=sha256:171a9ca9a40cd1843abeca0e405bc1940cd9b305eaeea2dda769ba096932bb22 \
46+
--hash=sha256:1905f494bfd7d85a23a88c5d97840888a7bd516545fc5aaedff0267e0bb54e2f \
47+
--hash=sha256:1fbb8da62dc352133d7d7ca90ed2fb0e9d42bb1a32724c287d3c76c58cbaa9c2 \
48+
--hash=sha256:2922d42e16d6de288022e5ca321cd0618b238cfc5570e0263e5ba0a77dbef56f \
49+
--hash=sha256:2e2c2e6d3593f6451b18588848e66260ff62ccca522dd231cd4dd59b0160668b \
50+
--hash=sha256:2ee2d57e01a7c35de00f4634ba1bbf015185b219e4dc5909e281016df43f5ee5 \
51+
--hash=sha256:2f2147ab812b75e5b5499b01ade1f4a81489a147c01585cda36019102538615f \
52+
--hash=sha256:404534629d51d3efea5c800ee7c42b72a6554d6c400e6a79eafe15d11341fd43 \
53+
--hash=sha256:5469affef548bd1895d86d3bf10ce2b44e33d86923c29e4d675b3e323437ea3e \
54+
--hash=sha256:5a95fb17c13e29d2d5195869262f8125dfdb5c134dc8d9a9d0aecf7525b10c2c \
55+
--hash=sha256:6983aae8b2f653e098edb77f893f7b6aca69f6cffb19b2cc7443f23cce5f4828 \
56+
--hash=sha256:712e962a6357634fef20412699a3655c610110e01cdaa6180acec7fc9f8513ba \
57+
--hash=sha256:8023ff13985661b50a5928fc7a5ca15f3d1affb41e5f0a9952cb68ef090b31ee \
58+
--hash=sha256:811aeccadfb730024c5d3e326b2fbe9249bb7413553f15499a4050f7c30e801d \
59+
--hash=sha256:8f8722560a14cde92fdb1e31597760dc35f9f5524cce17836c0d22841830fd5b \
60+
--hash=sha256:93faf3fdb04768d44bf28693293f3904bbb555d076b781ad2530214ee53e3445 \
61+
--hash=sha256:973500e0774b85d9689715feeffcc980193086551110fd678ebe1f4342fb7c5e \
62+
--hash=sha256:979e4e1a006511dacf628e36fadfecbcc0160a8af6ca7dad2f5025529e082c13 \
63+
--hash=sha256:98b7b9b9aedb65fe628c62a6dc57f6d5088ef2dfca37903a7d9ee374d03acca5 \
64+
--hash=sha256:aea39e0583d05124836ea645f412e88a5c7d0fd77a6d694b60d9b6b2d9f184fd \
65+
--hash=sha256:b9378e2c00146c44793c98b8d5a61039a048e31f429fb0eb546d93f4b000bedf \
66+
--hash=sha256:baefc32840a9f00babd83251560e0ae1573e2f9d1b067719479bfb0e987c6357 \
67+
--hash=sha256:be68172e9fd9ad8fb876c6389f16d1c1b5f100ffa779f77b1fb2176fcc9ab95b \
68+
--hash=sha256:c43a7682e24b4f576d93072216bf56eeff70d9140241f9edec0c104d0c515036 \
69+
--hash=sha256:c4bb0e1bd29f7d34efcccd71cf733580191e9a264a2202b0239da95984c5b559 \
70+
--hash=sha256:c7be1e46525adfa0d97681432ee9fcd61a3964c2446795714699a998d193f1a3 \
71+
--hash=sha256:c9817fa23833ff189db061e6d2eff49b2f3b6ed9856b4a0a73046e41932d744f \
72+
--hash=sha256:ce436f4c6d218a070048ed6a44c0bbb10cd2cc5e272b29e7845f6a2f57ee4464 \
73+
--hash=sha256:d10d994b41fb3497719bbf866f227b3489048ea4bbbb5015357db306249f7980 \
74+
--hash=sha256:e601a7fa172c2131bff456bb3ee08a88360760d0d2f8cbd7a75a65497e2df078 \
75+
--hash=sha256:f95579473af29ab73a10bada2f9722856792a36ec5af5399b653aa28360290a5
76+
# via -r requirements/dev.in
77+
mypy-extensions==1.1.0 \
78+
--hash=sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505 \
79+
--hash=sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558
80+
# via
81+
# black
82+
# mypy
83+
packaging==25.0 \
84+
--hash=sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484 \
85+
--hash=sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f
86+
# via black
87+
pathspec==0.12.1 \
88+
--hash=sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08 \
89+
--hash=sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712
90+
# via black
91+
platformdirs==4.3.7 \
92+
--hash=sha256:a03875334331946f13c549dbd8f4bac7a13a50a895a0eb1e8c6a8ace80d40a94 \
93+
--hash=sha256:eb437d586b6a0986388f0d6f74aa0cde27b48d0e3d66843640bfb6bdcdb6e351
94+
# via black
95+
pycodestyle==2.13.0 \
96+
--hash=sha256:35863c5974a271c7a726ed228a14a4f6daf49df369d8c50cd9a6f58a5e143ba9 \
97+
--hash=sha256:c8415bf09abe81d9c7f872502a6eee881fbe85d8763dd5b9924bb0a01d67efae
98+
# via flake8
99+
pyflakes==3.3.2 \
100+
--hash=sha256:5039c8339cbb1944045f4ee5466908906180f13cc99cc9949348d10f82a5c32a \
101+
--hash=sha256:6dfd61d87b97fba5dcfaaf781171ac16be16453be6d816147989e7f6e6a9576b
102+
# via flake8
103+
types-requests==2.32.0.20250328 \
104+
--hash=sha256:72ff80f84b15eb3aa7a8e2625fffb6a93f2ad5a0c20215fc1dcfa61117bcb2a2 \
105+
--hash=sha256:c9e67228ea103bd811c96984fac36ed2ae8da87a36a633964a21f199d60baf32
106+
# via -r requirements/dev.in
107+
typing-extensions==4.13.2 \
108+
--hash=sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c \
109+
--hash=sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef
110+
# via mypy
111+
urllib3==2.4.0 \
112+
--hash=sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466 \
113+
--hash=sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813
114+
# via types-requests

0 commit comments

Comments
 (0)