Skip to content

Commit df80da1

Browse files
B4nanB4nan
authored
ci: pin third-party actions to commit SHAs (#1024)
This pins every third-party action in the workflows to a full commit SHA, keeping the resolved version tag as a trailing comment. Renovate understands that convention and updates the SHA and comment together. Same change as apify/crawlee#4051, rolled out team-wide. The trigger was the `v11` tag of `EndBug/add-and-commit` moving to a broken release that failed to load and killed the crawlee publish workflow. With SHA pins, a tag moving under us, by accident or by compromise, can't break or hijack CI anymore. Where `EndBug/add-and-commit` is used, it's pinned to v11.0.0, the last working release. Own-org references (`apify/*`) stay on floating refs on purpose, since we control those repos.
1 parent 5196b25 commit df80da1

7 files changed

Lines changed: 37 additions & 37 deletions

‎.github/workflows/_checks.yaml‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,18 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v7
28+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2929
- name: Run actionlint
30-
uses: rhysd/actionlint@v1.7.12
30+
uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
3131

3232
spell_check:
3333
name: Spell check
3434
runs-on: ubuntu-latest
3535
steps:
3636
- name: Checkout repository
37-
uses: actions/checkout@v7
37+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3838
- name: Check spelling with typos
39-
uses: crate-ci/typos@v1
39+
uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
4040

4141
lint_check:
4242
name: Lint check
@@ -55,15 +55,15 @@ jobs:
5555
runs-on: ubuntu-latest
5656
steps:
5757
- name: Checkout repository
58-
uses: actions/checkout@v7
58+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5959

6060
- name: Set up Python
61-
uses: actions/setup-python@v7
61+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
6262
with:
6363
python-version: ${{ env.PYTHON_VERSION }}
6464

6565
- name: Set up uv package manager
66-
uses: astral-sh/setup-uv@v10.0.1
66+
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
6767
with:
6868
python-version: ${{ env.PYTHON_VERSION }}
6969

@@ -78,10 +78,10 @@ jobs:
7878
runs-on: ubuntu-latest
7979
steps:
8080
- name: Checkout repository
81-
uses: actions/checkout@v7
81+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
8282

8383
- name: Set up Node
84-
uses: actions/setup-node@v7
84+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
8585
with:
8686
node-version: ${{ env.NODE_VERSION }}
8787

@@ -99,10 +99,10 @@ jobs:
9999
runs-on: ubuntu-latest
100100
steps:
101101
- name: Checkout repository
102-
uses: actions/checkout@v7
102+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
103103

104104
- name: Set up Node
105-
uses: actions/setup-node@v7
105+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
106106
with:
107107
node-version: ${{ env.NODE_VERSION }}
108108

@@ -124,15 +124,15 @@ jobs:
124124
runs-on: ubuntu-latest
125125
steps:
126126
- name: Checkout repository
127-
uses: actions/checkout@v7
127+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
128128
with:
129129
fetch-depth: 0
130130

131131
# Doc images must be committed as optimized `.webp`. This fails when a PR adds raster
132132
# images in another format so they get converted via `pnpm opt:images` first.
133133
- name: Get changed unoptimized images
134134
id: changed-files
135-
uses: tj-actions/changed-files@v47
135+
uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
136136
with:
137137
files: |
138138
docs/**/*.{png,jpg,jpeg,gif,bmp,tif,tiff,avif}
@@ -191,15 +191,15 @@ jobs:
191191

192192
steps:
193193
- name: Checkout repository
194-
uses: actions/checkout@v7
194+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
195195

196196
- name: Set up Python ${{ matrix.python-version }}
197-
uses: actions/setup-python@v7
197+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
198198
with:
199199
python-version: ${{ matrix.python-version }}
200200

201201
- name: Set up uv package manager
202-
uses: astral-sh/setup-uv@v10.0.1
202+
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
203203
with:
204204
python-version: ${{ matrix.python-version }}
205205

@@ -219,7 +219,7 @@ jobs:
219219
matrix.python-version == '3.14' &&
220220
env.CODECOV_TOKEN != ''
221221
}}
222-
uses: codecov/codecov-action@v7
222+
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
223223
with:
224224
token: ${{ env.CODECOV_TOKEN }}
225225
files: coverage-integration.xml
@@ -230,10 +230,10 @@ jobs:
230230
runs-on: ubuntu-latest
231231
steps:
232232
- name: Checkout repository
233-
uses: actions/checkout@v7
233+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
234234

235235
- name: Set up uv package manager
236-
uses: astral-sh/setup-uv@v10.0.1
236+
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
237237
with:
238238
python-version: "3.14"
239239

‎.github/workflows/manual_release_beta.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ jobs:
8787
8888
# Publish the package to PyPI using PyPA official GitHub action with OIDC authentication.
8989
- name: Publish package to PyPI
90-
uses: pypa/gh-action-pypi-publish@release/v1
90+
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
9191

9292
doc_release_post_publish:
9393
name: Doc release post publish

‎.github/workflows/manual_release_docs.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,23 +49,23 @@ jobs:
4949
check-regexp: '^Checks'
5050

5151
- name: Checkout repository
52-
uses: actions/checkout@v7
52+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5353
with:
5454
ref: ${{ inputs.ref }}
5555
token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
5656

5757
- name: Set up Node
58-
uses: actions/setup-node@v7
58+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
5959
with:
6060
node-version: ${{ env.NODE_VERSION }}
6161

6262
- name: Set up Python
63-
uses: actions/setup-python@v7
63+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
6464
with:
6565
python-version: ${{ env.PYTHON_VERSION }}
6666

6767
- name: Set up uv package manager
68-
uses: astral-sh/setup-uv@v10.0.1
68+
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
6969
with:
7070
python-version: ${{ env.PYTHON_VERSION }}
7171

@@ -95,15 +95,15 @@ jobs:
9595
SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }}
9696

9797
- name: Set up GitHub Pages
98-
uses: actions/configure-pages@v6
98+
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
9999

100100
- name: Upload GitHub Pages artifact
101-
uses: actions/upload-pages-artifact@v5
101+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
102102
with:
103103
path: ./website/build
104104

105105
- name: Deploy artifact to GitHub Pages
106-
uses: actions/deploy-pages@v5
106+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
107107

108108
- name: Invalidate CloudFront cache
109109
run: |

‎.github/workflows/manual_release_stable.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ jobs:
8181
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8282
steps:
8383
- name: GitHub release
84-
uses: softprops/action-gh-release@v3
84+
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
8585
with:
8686
tag_name: ${{ needs.release_prepare.outputs.tag_name }}
8787
name: ${{ needs.release_prepare.outputs.version_number }}
@@ -120,7 +120,7 @@ jobs:
120120
121121
# Publish the package to PyPI using PyPA official GitHub action with OIDC authentication.
122122
- name: Publish package to PyPI
123-
uses: pypa/gh-action-pypi-publish@release/v1
123+
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
124124

125125
version_docs:
126126
name: Version docs

‎.github/workflows/manual_version_docs.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,22 +49,22 @@ jobs:
4949
check-regexp: '^Checks'
5050

5151
- name: Checkout repository
52-
uses: actions/checkout@v7
52+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5353
with:
5454
token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
5555

5656
- name: Set up Node
57-
uses: actions/setup-node@v7
57+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
5858
with:
5959
node-version: ${{ env.NODE_VERSION }}
6060

6161
- name: Set up Python
62-
uses: actions/setup-python@v7
62+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
6363
with:
6464
python-version: ${{ env.PYTHON_VERSION }}
6565

6666
- name: Set up uv package manager
67-
uses: astral-sh/setup-uv@v10.0.1
67+
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
6868
with:
6969
python-version: ${{ env.PYTHON_VERSION }}
7070

‎.github/workflows/on_issue.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818

1919
steps:
2020
# Add the "t-tooling" label to all new issues
21-
- uses: actions/github-script@v9
21+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
2222
with:
2323
script: |
2424
github.rest.issues.addLabels({

‎.github/workflows/on_schedule_regenerate_models.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,14 @@ jobs:
3939

4040
steps:
4141
- name: Checkout master
42-
uses: actions/checkout@v7
42+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4343
with:
4444
ref: master
4545
token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
4646
fetch-depth: 0
4747

4848
- name: Set up uv package manager
49-
uses: astral-sh/setup-uv@v10.0.1
49+
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
5050
with:
5151
python-version: ${{ env.PYTHON_VERSION }}
5252

@@ -234,7 +234,7 @@ jobs:
234234
}' > slack-payload.json
235235
236236
- name: Send Slack notification
237-
uses: slackapi/slack-github-action@v4.0.0
237+
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
238238
with:
239239
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
240240
webhook-type: incoming-webhook

0 commit comments

Comments
 (0)