diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68c3dc977..25197e629 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,9 +18,9 @@ jobs: linting: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv and set Python version - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 with: version: "0.11.2" python-version: "3.13" @@ -33,14 +33,14 @@ jobs: type-checking: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv and set Python version - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 with: version: "0.11.2" python-version: "3.13" enable-cache: true - - uses: actions/cache@v3 + - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 name: Cache mypy cache with: path: ./.mypy_cache @@ -75,8 +75,8 @@ jobs: name: Test on Python version ${{ matrix.python-version }} steps: - - uses: actions/checkout@v3 - - uses: pnpm/action-setup@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 with: version: 10.33.0 @@ -85,12 +85,12 @@ jobs: git clone https://github.com/langfuse/langfuse.git ./langfuse-server && echo $(cd ./langfuse-server && git rev-parse HEAD) - name: Setup node (for langfuse server) - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 24 - name: Cache langfuse server dependencies - uses: actions/cache@v3 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 with: path: ./langfuse-server/node_modules key: | @@ -155,7 +155,7 @@ jobs: echo "Langfuse server is up and running!" - name: Install uv and set Python version - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 with: version: "0.11.2" python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/claude-review-maintainer-prs.yml b/.github/workflows/claude-review-maintainer-prs.yml index 016559888..50193b89e 100644 --- a/.github/workflows/claude-review-maintainer-prs.yml +++ b/.github/workflows/claude-review-maintainer-prs.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Check author permission and existing review request id: check - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const owner = context.repo.owner; @@ -57,7 +57,7 @@ jobs: - name: Add Claude review comment if: steps.check.outputs.should_comment == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | await github.rest.issues.createComment({ diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 92cc5c1fc..02d502eb7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -55,11 +55,11 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -87,6 +87,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml index 043b7198d..1a86ae8f8 100644 --- a/.github/workflows/dependabot-merge.yml +++ b/.github/workflows/dependabot-merge.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v1 + uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs diff --git a/.github/workflows/dependabot-rebase-stale.yml b/.github/workflows/dependabot-rebase-stale.yml index 79d85964c..dcbe57211 100644 --- a/.github/workflows/dependabot-rebase-stale.yml +++ b/.github/workflows/dependabot-rebase-stale.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Rebase open Dependabot PR" - uses: orange-buffalo/dependabot-auto-rebase@v1 + uses: orange-buffalo/dependabot-auto-rebase@fa9e05d7a8152381af0a92ffca942a0d46712544 # v1 with: api-token: ${{ secrets.DEP_REBASE_PAT }} repository: ${{ github.repository }} diff --git a/.github/workflows/package-availability-check.yml b/.github/workflows/package-availability-check.yml index 70c53942b..e8074a9ba 100644 --- a/.github/workflows/package-availability-check.yml +++ b/.github/workflows/package-availability-check.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v2 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ matrix.python-version }} - name: Install dependencies using pip diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index af16d7927..e24bd45a0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,13 +62,13 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 token: ${{ secrets.GH_ACCESS_TOKEN }} - name: Install uv and set Python version - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8 with: version: "0.11.2" python-version: "3.12" @@ -285,7 +285,7 @@ jobs: - name: Create GitHub Release id: create-release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 with: tag_name: v${{ steps.new-version.outputs.version }} name: v${{ steps.new-version.outputs.version }} @@ -299,8 +299,10 @@ jobs: - name: Notify Slack on success if: success() - uses: slackapi/slack-github-action@v1.26.0 + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3 with: + webhook: ${{ secrets.SLACK_WEBHOOK_RELEASES }} + webhook-type: incoming-webhook payload: | { "text": "✅ Langfuse Python SDK v${{ steps.new-version.outputs.version }} published to PyPI", @@ -378,14 +380,13 @@ jobs: } ] } - env: - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_RELEASES }} - SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK - name: Notify Slack on failure if: failure() - uses: slackapi/slack-github-action@v1.26.0 + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3 with: + webhook: ${{ secrets.SLACK_WEBHOOK_ENGINEERING }} + webhook-type: incoming-webhook payload: | { "text": "❌ Langfuse Python SDK release workflow failed", @@ -471,6 +472,3 @@ jobs: } ] } - env: - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_ENGINEERING }} - SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK