Skip to content

Commit 3d97dee

Browse files
Copilotjkowalleck
Copilot
and
jkowalleck
authored
chore(ci): pin GitHub Actions to immutable commit SHAs (#1043)
### Description Pin all GitHub Actions `uses:` references in `.github/workflows/*.yml` from floating tags/branch refs to immutable full commit SHAs. This prevents unexpected changes if an action tag is moved, while keeping the original ref as an inline comment (e.g. `# v6`, `# v10.0.2`, `# release/v1`) so maintainers can easily see which version is pinned. The existing `dependabot.yml` already configures the `github-actions` ecosystem with weekly updates, so Dependabot will continue detecting upstream changes and opening PRs to bump the pinned SHAs. Resolves or fixes issue: #532 ### AI Tool Disclosure - [ ] My contribution does not include any AI-generated content - [x] My contribution includes AI-generated content, as disclosed below: - AI Tools: `GitHub Copilot Coding Agent` - LLMs and versions: `Claude Sonnet 4.5` - Prompts: `Pin all GitHub Actions workflow uses: references to immutable commit SHAs while preserving Dependabot update behavior via inline tag comments.` ### Affirmation - [x] My code follows the [CONTRIBUTING.md](https://github.com/CycloneDX/cyclonedx-python/blob/main/CONTRIBUTING.md) guidelines --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>
1 parent b3bb790 commit 3d97dee

3 files changed

Lines changed: 46 additions & 46 deletions

File tree

‎.github/workflows/docker.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,19 +48,19 @@ jobs:
4848
steps:
4949
- name: Checkout code
5050
# see https://github.com/actions/checkout
51-
uses: actions/checkout@v6
51+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5252
with:
5353
fetch-depth: 0
5454
- name: setup reports-dir
5555
run: mkdir "$REPORTS_DIR"
5656
- name: Setup python ${{ env.PYTHON_VERSION }}
5757
# see https://github.com/actions/setup-python
58-
uses: actions/setup-python@v6
58+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
5959
with:
6060
python-version: ${{ env.PYTHON_VERSION }}
6161
- name: Setup poetry ${{ env.POETRY_VERSION }}
6262
# see https://github.com/marketplace/actions/setup-poetry
63-
uses: Gr1N/setup-poetry@v9
63+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
6464
with:
6565
poetry-version: ${{ env.POETRY_VERSION }}
6666
- name: bump version
@@ -76,7 +76,7 @@ jobs:
7676
!failure() && !cancelled() &&
7777
steps.after-release.outputs.released
7878
# see https://github.com/actions/upload-artifact
79-
uses: actions/upload-artifact@v6
79+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
8080
with:
8181
name: ${{ env.RUN_ARTIFACT_PYTHON_DIST }}
8282
path: ${{ env.DIST_SOURCE_DIR }}/
@@ -108,7 +108,7 @@ jobs:
108108
- name: Artifact reports
109109
if: ${{ ! cancelled() }}
110110
# see https://github.com/actions/upload-artifact
111-
uses: actions/upload-artifact@v6
111+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
112112
with:
113113
name: ${{ env.REPORTS_ARTIFACT }}
114114
path: ${{ env.REPORTS_DIR }}

‎.github/workflows/python.yml‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,15 @@ jobs:
5252
steps:
5353
- name: Checkout
5454
# see https://github.com/actions/checkout
55-
uses: actions/checkout@v6
55+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5656
- name: Setup Python Environment
5757
# see https://github.com/actions/setup-python
58-
uses: actions/setup-python@v6
58+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
5959
with:
6060
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
6161
- name: Install poetry
6262
# see https://github.com/marketplace/actions/setup-poetry
63-
uses: Gr1N/setup-poetry@v9
63+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
6464
with:
6565
poetry-version: ${{ env.POETRY_VERSION }}
6666
- name: Install dependencies
@@ -75,15 +75,15 @@ jobs:
7575
steps:
7676
- name: Checkout
7777
# see https://github.com/actions/checkout
78-
uses: actions/checkout@v6
78+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7979
- name: Setup Python Environment
8080
# see https://github.com/actions/setup-python
81-
uses: actions/setup-python@v6
81+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
8282
with:
8383
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
8484
- name: Install poetry
8585
# see https://github.com/marketplace/actions/setup-poetry
86-
uses: Gr1N/setup-poetry@v9
86+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
8787
with:
8888
poetry-version: ${{ env.POETRY_VERSION }}
8989
- name: Install dependencies
@@ -98,15 +98,15 @@ jobs:
9898
steps:
9999
- name: Checkout
100100
# see https://github.com/actions/checkout
101-
uses: actions/checkout@v6
101+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
102102
- name: Setup Python Environment
103103
# see https://github.com/actions/setup-python
104-
uses: actions/setup-python@v6
104+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
105105
with:
106106
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
107107
- name: Install poetry
108108
# see https://github.com/marketplace/actions/setup-poetry
109-
uses: Gr1N/setup-poetry@v9
109+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
110110
with:
111111
poetry-version: ${{ env.POETRY_VERSION }}
112112
- name: Install dependencies
@@ -131,15 +131,15 @@ jobs:
131131
steps:
132132
- name: Checkout
133133
# see https://github.com/actions/checkout
134-
uses: actions/checkout@v6
134+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
135135
- name: Setup Python Environment
136136
# see https://github.com/actions/setup-python
137-
uses: actions/setup-python@v6
137+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
138138
with:
139139
python-version: ${{ matrix.python-version }}
140140
- name: Install poetry
141141
# see https://github.com/marketplace/actions/setup-poetry
142-
uses: Gr1N/setup-poetry@v9
142+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
143143
with:
144144
poetry-version: ${{ env.POETRY_VERSION }}
145145
- name: Install dependencies
@@ -154,15 +154,15 @@ jobs:
154154
steps:
155155
- name: Checkout
156156
# see https://github.com/actions/checkout
157-
uses: actions/checkout@v6
157+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
158158
- name: Setup Python Environment
159159
# see https://github.com/actions/setup-python
160-
uses: actions/setup-python@v6
160+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
161161
with:
162162
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
163163
- name: Install poetry
164164
# see https://github.com/marketplace/actions/setup-poetry
165-
uses: Gr1N/setup-poetry@v9
165+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
166166
with:
167167
poetry-version: ${{ env.POETRY_VERSION }}
168168
- name: Install dependencies
@@ -187,10 +187,10 @@ jobs:
187187
steps:
188188
- name: Checkout
189189
# see https://github.com/actions/checkout
190-
uses: actions/checkout@v6
190+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
191191
- name: Setup Python Environment
192192
# see https://github.com/actions/setup-python
193-
uses: actions/setup-python@v6
193+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
194194
with:
195195
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
196196
- name: Install self
@@ -224,12 +224,12 @@ jobs:
224224
steps:
225225
- name: Checkout
226226
# see https://github.com/actions/checkout
227-
uses: actions/checkout@v6
227+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
228228
- name: Create reports directory
229229
run: mkdir ${{ env.REPORTS_DIR }}
230230
- name: Setup Python Environment
231231
# see https://github.com/actions/setup-python
232-
uses: actions/setup-python@v6
232+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
233233
with:
234234
python-version: ${{ matrix.python-version }}
235235
- name: craft PY_UT_ARGS
@@ -243,7 +243,7 @@ jobs:
243243
env_file.write(f'PY_UT_ARGS={" ".join(PY_UT_ARGS)}\n')
244244
- name: Install poetry
245245
# see https://github.com/marketplace/actions/setup-poetry
246-
uses: Gr1N/setup-poetry@v9
246+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
247247
with:
248248
poetry-version: ${{ env.POETRY_VERSION }}
249249
- name: Install dependencies
@@ -262,7 +262,7 @@ jobs:
262262
- name: Artifact reports
263263
if: ${{ ! cancelled() }}
264264
# see https://github.com/actions/upload-artifact
265-
uses: actions/upload-artifact@v6
265+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
266266
with:
267267
name: '${{ env.TESTS_REPORTS_ARTIFACT }}_bnt_${{ matrix.os }}_py${{ matrix.python-version }}'
268268
path: ${{ env.REPORTS_DIR }}
@@ -276,7 +276,7 @@ jobs:
276276
steps:
277277
- name: fetch test artifacts
278278
# see https://github.com/actions/download-artifact
279-
uses: actions/download-artifact@v7
279+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
280280
with:
281281
pattern: '${{ env.TESTS_REPORTS_ARTIFACT }}_bnt_*'
282282
merge-multiple: true
@@ -287,7 +287,7 @@ jobs:
287287
## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
288288
if: ${{ env.CODACY_PROJECT_TOKEN != '' }}
289289
# see https://github.com/codacy/codacy-coverage-reporter-action
290-
uses: codacy/codacy-coverage-reporter-action@v1
290+
uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1
291291
with:
292292
project-token: ${{ env.CODACY_PROJECT_TOKEN }}
293293
coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -71,15 +71,15 @@ jobs:
7171
steps:
7272
- name: Checkout code
7373
# see https://github.com/actions/checkout
74-
uses: actions/checkout@v6
74+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7575
- name: Setup Python Environment
7676
# see https://github.com/actions/setup-python
77-
uses: actions/setup-python@v6
77+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
7878
with:
7979
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
8080
- name: Install poetry
8181
# see https://github.com/marketplace/actions/setup-poetry
82-
uses: Gr1N/setup-poetry@v9
82+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
8383
with:
8484
poetry-version: ${{ env.POETRY_VERSION }}
8585
- name: Install dependencies
@@ -94,15 +94,15 @@ jobs:
9494
steps:
9595
- name: Checkout
9696
# see https://github.com/actions/checkout
97-
uses: actions/checkout@v6
97+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9898
- name: Setup Python Environment
9999
# see https://github.com/actions/setup-python
100-
uses: actions/setup-python@v6
100+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
101101
with:
102102
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
103103
- name: Install poetry
104104
# see https://github.com/marketplace/actions/setup-poetry
105-
uses: Gr1N/setup-poetry@v9
105+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
106106
with:
107107
poetry-version: ${{ env.POETRY_VERSION }}
108108
- name: Install dependencies
@@ -132,17 +132,17 @@ jobs:
132132
steps:
133133
- name: Checkout code
134134
# see https://github.com/actions/checkout
135-
uses: actions/checkout@v6
135+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
136136
with:
137137
fetch-depth: 0
138138
- name: Setup python
139139
# see https://github.com/actions/setup-python
140-
uses: actions/setup-python@v6
140+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
141141
with:
142142
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
143143
- name: Install and configure Poetry
144144
# See https://github.com/marketplace/actions/install-poetry-action
145-
uses: snok/install-poetry@v1
145+
uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
146146
with:
147147
version: ${{ env.POETRY_VERSION }}
148148
virtualenvs-create: true
@@ -156,7 +156,7 @@ jobs:
156156
id: release
157157
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html
158158
# see https://github.com/python-semantic-release/python-semantic-release
159-
uses: python-semantic-release/python-semantic-release@v10.0.2
159+
uses: python-semantic-release/python-semantic-release@1a324000f2251a9e722e77b128bf72712653813f # v10.0.2
160160
with:
161161
github_token: ${{ secrets.GITHUB_TOKEN }}
162162
force: ${{ github.event.inputs.release_force }}
@@ -167,15 +167,15 @@ jobs:
167167
!failure() && !cancelled() &&
168168
steps.release.outputs.released == 'true'
169169
# see https://github.com/pypa/gh-action-pypi-publish
170-
uses: pypa/gh-action-pypi-publish@release/v1
170+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
171171
with:
172172
attestations: true
173173
- name: Publish package distributions to GitHub Releases
174174
if: |
175175
!failure() && !cancelled() &&
176176
steps.release.outputs.released == 'true'
177177
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html#python-semantic-release-publish-action
178-
uses: python-semantic-release/publish-action@v10
178+
uses: python-semantic-release/publish-action@310a9983a0ae878b29f3aac778d7c77c1db27378 # v10
179179
with:
180180
github_token: ${{ secrets.GITHUB_TOKEN }}
181181
tag: ${{ steps.release.outputs.tag }}
@@ -184,7 +184,7 @@ jobs:
184184
!failure() && !cancelled() &&
185185
steps.release.outputs.released == 'true'
186186
# see https://github.com/actions/upload-artifact
187-
uses: actions/upload-artifact@v6
187+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
188188
with:
189189
name: ${{ env.DIST_ARTIFACT }}
190190
path: ${{ env.DIST_DIR }}/
@@ -220,7 +220,7 @@ jobs:
220220
echo "GHCR_REPO=${GHCR_REPO@L}" >> "${GITHUB_ENV}"
221221
- name: Checkout code (${{ env.TAG }})
222222
# see https://github.com/actions/checkout
223-
uses: actions/checkout@v6
223+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
224224
with:
225225
ref: ${{ needs.release-PyPI.outputs.tag }}
226226
- name: setup dirs
@@ -229,7 +229,7 @@ jobs:
229229
mkdir "$DIST_DIR"
230230
- name: Fetch python dist artifact
231231
# see https://github.com/actions/download-artifact
232-
uses: actions/download-artifact@v7
232+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
233233
with:
234234
name: ${{ env.DIST_ARTIFACT }}
235235
path: ${{ env.DIST_DIR }}/
@@ -262,15 +262,15 @@ jobs:
262262
- name: Artifact reports
263263
if: ${{ ! cancelled() }}
264264
# see https://github.com/actions/upload-artifact
265-
uses: actions/upload-artifact@v6
265+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
266266
with:
267267
name: ${{ env.ARTIFACT_DOCKER_SBOM }}
268268
path: ${{ env.REPORTS_DIR }}/*.bom.*
269269
if-no-files-found: error
270270
# publish AFTER the boms were build, as the bom-generation is kind of a test if the image works
271271
- name: Login to DockerHub
272272
# see hhttps://github.com/docker/login-action?tab=readme-ov-file#docker-hub
273-
uses: docker/login-action@v3
273+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
274274
with:
275275
username: ${{ secrets.DOCKERHUB_USERNAME }}
276276
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -283,7 +283,7 @@ jobs:
283283
# region publish to GHCR
284284
- name: Login to GHCR
285285
# see https://github.com/docker/login-action#github-container-registry
286-
uses: docker/login-action@v3
286+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
287287
with:
288288
registry: ghcr.io
289289
username: ${{ github.actor }}

0 commit comments

Comments
 (0)