Skip to content

Commit 496e2d7

Browse files
woodruffwwoodruffw
committed
[3.12] gh-146488: hash-pin all action references (gh-146489)
This is like #146489, but recreated for 3.12 because of CI drift. Signed-off-by: William Woodruff <william@yossarian.net>
1 parent 66dd179 commit 496e2d7

17 files changed

+55
-55
lines changed

‎.github/workflows/build.yml‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ jobs:
4949
needs: build-context
5050
if: needs.build-context.outputs.run-tests == 'true'
5151
steps:
52-
- uses: actions/checkout@v6
52+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5353
with:
5454
persist-credentials: false
55-
- uses: actions/setup-python@v6
55+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5656
- name: Install dependencies
5757
run: |
5858
sudo ./.github/workflows/posix-deps-apt.sh
@@ -81,7 +81,7 @@ jobs:
8181
if: ${{ failure() && steps.check.conclusion == 'failure' }}
8282
run: |
8383
make regen-abidump
84-
- uses: actions/upload-artifact@v6
84+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
8585
name: Publish updated ABI files
8686
if: ${{ failure() && steps.check.conclusion == 'failure' }}
8787
with:
@@ -103,7 +103,7 @@ jobs:
103103
run: |
104104
apt update && apt install git -yq
105105
git config --global --add safe.directory "$GITHUB_WORKSPACE"
106-
- uses: actions/checkout@v6
106+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
107107
with:
108108
fetch-depth: 1
109109
persist-credentials: false
@@ -140,16 +140,16 @@ jobs:
140140
needs: build-context
141141
if: needs.build-context.outputs.run-tests == 'true'
142142
steps:
143-
- uses: actions/checkout@v6
143+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
144144
with:
145145
persist-credentials: false
146-
- uses: actions/setup-python@v6
146+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
147147
with:
148148
python-version: '3.x'
149149
- name: Runner image version
150150
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
151151
- name: Restore config.cache
152-
uses: actions/cache@v5
152+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
153153
with:
154154
path: config.cache
155155
# Include env.pythonLocation in key to avoid changes in environment when setup-python updates Python
@@ -159,7 +159,7 @@ jobs:
159159
- name: Add ccache to PATH
160160
run: echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
161161
- name: Configure ccache action
162-
uses: hendrikmuhs/ccache-action@v1.2
162+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
163163
with:
164164
save: false
165165
- name: Configure CPython
@@ -275,13 +275,13 @@ jobs:
275275
OPENSSL_DIR: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}
276276
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib
277277
steps:
278-
- uses: actions/checkout@v6
278+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
279279
with:
280280
persist-credentials: false
281281
- name: Runner image version
282282
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
283283
- name: Restore config.cache
284-
uses: actions/cache@v5
284+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
285285
with:
286286
path: config.cache
287287
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
@@ -296,7 +296,7 @@ jobs:
296296
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
297297
- name: 'Restore OpenSSL build'
298298
id: cache-openssl
299-
uses: actions/cache@v5
299+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
300300
with:
301301
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
302302
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -307,7 +307,7 @@ jobs:
307307
run: |
308308
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
309309
- name: Configure ccache action
310-
uses: hendrikmuhs/ccache-action@v1.2
310+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
311311
with:
312312
save: false
313313
- name: Configure CPython
@@ -329,7 +329,7 @@ jobs:
329329
OPENSSL_VER: 3.0.15
330330
PYTHONSTRICTEXTENSIONBUILD: 1
331331
steps:
332-
- uses: actions/checkout@v6
332+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
333333
with:
334334
persist-credentials: false
335335
- name: Register gcc problem matcher
@@ -343,7 +343,7 @@ jobs:
343343
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
344344
- name: 'Restore OpenSSL build'
345345
id: cache-openssl
346-
uses: actions/cache@v5
346+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
347347
with:
348348
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
349349
key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -354,7 +354,7 @@ jobs:
354354
run: |
355355
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
356356
- name: Configure ccache action
357-
uses: hendrikmuhs/ccache-action@v1.2
357+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
358358
with:
359359
save: false
360360
- name: Setup directory envs for out-of-tree builds
@@ -368,7 +368,7 @@ jobs:
368368
- name: Runner image version
369369
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
370370
- name: Restore config.cache
371-
uses: actions/cache@v5
371+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
372372
with:
373373
path: ${{ env.CPYTHON_BUILDDIR }}/config.cache
374374
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
@@ -401,7 +401,7 @@ jobs:
401401
./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt"
402402
- name: 'Restore Hypothesis database'
403403
id: cache-hypothesis-database
404-
uses: actions/cache@v5
404+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
405405
with:
406406
path: ./hypothesis
407407
key: hypothesis-database-${{ github.head_ref || github.run_id }}
@@ -427,7 +427,7 @@ jobs:
427427
-x test_subprocess \
428428
-x test_signal \
429429
-x test_sysconfig
430-
- uses: actions/upload-artifact@v6
430+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
431431
if: always()
432432
with:
433433
name: hypothesis-example-db
@@ -448,13 +448,13 @@ jobs:
448448
PYTHONSTRICTEXTENSIONBUILD: 1
449449
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
450450
steps:
451-
- uses: actions/checkout@v6
451+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
452452
with:
453453
persist-credentials: false
454454
- name: Runner image version
455455
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
456456
- name: Restore config.cache
457-
uses: actions/cache@v5
457+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
458458
with:
459459
path: config.cache
460460
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
@@ -463,7 +463,7 @@ jobs:
463463
- name: Install dependencies
464464
run: sudo ./.github/workflows/posix-deps-apt.sh
465465
- name: Set up GCC-10 for ASAN
466-
uses: egor-tensin/setup-gcc@v2
466+
uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
467467
with:
468468
version: 10
469469
- name: Configure OpenSSL env vars
@@ -473,7 +473,7 @@ jobs:
473473
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
474474
- name: 'Restore OpenSSL build'
475475
id: cache-openssl
476-
uses: actions/cache@v5
476+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
477477
with:
478478
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
479479
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -484,7 +484,7 @@ jobs:
484484
run: |
485485
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
486486
- name: Configure ccache action
487-
uses: hendrikmuhs/ccache-action@v1.2
487+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
488488
with:
489489
save: ${{ github.event_name == 'push' }}
490490
max-size: "200M"

‎.github/workflows/documentation-links.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
timeout-minutes: 5
2323

2424
steps:
25-
- uses: readthedocs/actions/preview@v1
25+
- uses: readthedocs/actions/preview@b8bba1484329bda1a3abe986df7ebc80a8950333 # v1.5
2626
with:
2727
project-slug: "cpython-previews"
2828
single-version: "true"

‎.github/workflows/lint.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
timeout-minutes: 10
2020

2121
steps:
22-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2323
with:
2424
persist-credentials: false
25-
- uses: actions/setup-python@v6
25+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2626
with:
2727
python-version: "3.x"
28-
- uses: pre-commit/action@v3.0.1
28+
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

‎.github/workflows/mypy.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,10 @@ jobs:
3030
runs-on: ubuntu-latest
3131
timeout-minutes: 10
3232
steps:
33-
- uses: actions/checkout@v6
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3434
with:
3535
persist-credentials: false
36-
- uses: actions/setup-python@v6
36+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3737
with:
3838
python-version: "3.x"
3939
cache: pip

‎.github/workflows/new-bugs-announce-notifier.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ jobs:
1313
runs-on: ubuntu-latest
1414
timeout-minutes: 10
1515
steps:
16-
- uses: actions/setup-node@v6
16+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1717
with:
1818
node-version: 14
1919
- run: npm install mailgun.js form-data
2020
- name: Send notification
21-
uses: actions/github-script@v8
21+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
2222
env:
2323
MAILGUN_API_KEY: ${{ secrets.MAILGUN_PYTHON_ORG_MAILGUN_KEY }}
2424
with:

‎.github/workflows/project-updater.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
- { project: 32, label: sprint }
2525

2626
steps:
27-
- uses: actions/add-to-project@v1.0.2
27+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
2828
with:
2929
project-url: https://github.com/orgs/python/projects/${{ matrix.project }}
3030
github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

‎.github/workflows/require-pr-label.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
timeout-minutes: 10
1515

1616
steps:
17-
- uses: mheap/github-action-required-labels@v5
17+
- uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5.5.2
1818
with:
1919
mode: exactly
2020
count: 0

‎.github/workflows/reusable-change-detection.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
steps:
5656
- run: >-
5757
echo '${{ github.event_name }}'
58-
- uses: actions/checkout@v6
58+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5959
with:
6060
persist-credentials: false
6161
- name: Check for source changes
@@ -113,7 +113,7 @@ jobs:
113113
- name: Get a list of the changed documentation-related files
114114
if: github.event_name == 'pull_request'
115115
id: changed-docs-files
116-
uses: Ana06/get-changed-files@v2.3.0
116+
uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
117117
with:
118118
filter: |
119119
Doc/**

‎.github/workflows/reusable-context.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,14 @@ jobs:
4646
run-windows-tests: ${{ steps.changes.outputs.run-windows-tests }}
4747
steps:
4848
- name: Set up Python
49-
uses: actions/setup-python@v6
49+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5050
with:
5151
python-version: "3"
5252

5353
- run: >-
5454
echo '${{ github.event_name }}'
5555
56-
- uses: actions/checkout@v6
56+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5757
with:
5858
persist-credentials: false
5959
ref: >-

‎.github/workflows/reusable-docs.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
refspec_pr: '+${{ github.event.pull_request.head.sha }}:remotes/origin/${{ github.event.pull_request.head.ref }}'
2525
steps:
2626
- name: 'Check out latest PR branch commit'
27-
uses: actions/checkout@v6
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828
with:
2929
persist-credentials: false
3030
ref: >-
@@ -49,7 +49,7 @@ jobs:
4949
git fetch origin "${refspec_base}" --shallow-since="${DATE}" \
5050
--no-tags --prune --no-recurse-submodules
5151
- name: 'Set up Python'
52-
uses: actions/setup-python@v6
52+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5353
with:
5454
python-version: '3'
5555
cache: 'pip'
@@ -91,10 +91,10 @@ jobs:
9191
runs-on: ubuntu-24.04
9292
timeout-minutes: 60
9393
steps:
94-
- uses: actions/checkout@v6
94+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9595
with:
9696
persist-credentials: false
97-
- uses: actions/cache@v5
97+
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
9898
with:
9999
path: ~/.cache/pip
100100
key: ubuntu-doc-${{ hashFiles('Doc/requirements.txt') }}

0 commit comments

Comments
 (0)