From 50ccb15b36c97b2b926d30e91119eabce7f36ad6 Mon Sep 17 00:00:00 2001 From: Jiri Stransky Date: Fri, 17 Jul 2026 10:51:37 +0200 Subject: [PATCH] Pin Github actions to SHAs Additionally, update the basic checkout and setup-python actions to non-EOL releases. Assisted-by: goose+gemini --- .github/workflows/docs.yaml | 6 +++--- .github/workflows/lint.yaml | 6 +++--- .github/workflows/stale-pr.yml | 2 +- .github/workflows/sync_branches_with_ext_trigger.yml | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 12f261d75..5a2861f97 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -17,14 +17,14 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: # this fetches all branches. Needed because we need gh-pages branch for deploy to work fetch-depth: 0 - - uses: actions/setup-python@v2 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.9' - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1 with: ruby-version: '3.2' diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index fe951c4ef..0b42a0aec 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -10,8 +10,8 @@ jobs: pre-commit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-python@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.13' - - uses: pre-commit/action@v3.0.1 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 diff --git a/.github/workflows/stale-pr.yml b/.github/workflows/stale-pr.yml index 82b5392b9..2c54e2496 100644 --- a/.github/workflows/stale-pr.yml +++ b/.github/workflows/stale-pr.yml @@ -8,7 +8,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9 with: stale-pr-message: | This PR is stale because it has been for over 15 days with no activity. diff --git a/.github/workflows/sync_branches_with_ext_trigger.yml b/.github/workflows/sync_branches_with_ext_trigger.yml index f2530c183..ce8565815 100644 --- a/.github/workflows/sync_branches_with_ext_trigger.yml +++ b/.github/workflows/sync_branches_with_ext_trigger.yml @@ -6,7 +6,7 @@ on: # yamllint disable-line rule:truthy jobs: trigger-sync: - uses: openstack-k8s-operators/ci-framework/.github/workflows/sync_branches_reusable_workflow.yml@main + uses: openstack-k8s-operators/ci-framework/.github/workflows/sync_branches_reusable_workflow.yml@8b22a75f4fa1b75a18b718c79a7395eca5c530ee # main with: source-branch: ${{ github.event.client_payload.source-branch }} target-branch: ${{ github.event.client_payload.target-branch }}