1111 - ' main'
1212 - ' 3.*'
1313
14- permissions :
15- contents : read
14+ permissions : {}
1615
1716concurrency :
1817 # https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#concurrency
6463 run : |
6564 apt update && apt install git -yq
6665 git config --global --add safe.directory "$GITHUB_WORKSPACE"
67- - uses : actions/checkout@v6
66+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6867 with :
6968 fetch-depth : 1
7069 persist-credentials : false
@@ -101,10 +100,10 @@ jobs:
101100 needs : build-context
102101 if : needs.build-context.outputs.run-tests == 'true'
103102 steps :
104- - uses : actions/checkout@v6
103+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
105104 with :
106105 persist-credentials : false
107- - uses : actions/setup-python@v6
106+ - uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
108107 with :
109108 python-version : ' 3.x'
110109 - name : Runner image version
@@ -165,13 +164,21 @@ jobs:
165164 free-threading :
166165 - false
167166 - true
167+ interpreter :
168+ - switch-case
168169 exclude :
169170 # Skip Win32 on free-threaded builds
170171 - { arch: Win32, free-threading: true }
172+ include :
173+ # msvc::musttail is currently only supported on x64,
174+ # and only supported on 3.15+.
175+ - { arch: x64, free-threading: false, interpreter: tail-call }
176+ - { arch: x64, free-threading: true, interpreter: tail-call }
171177 uses : ./.github/workflows/reusable-windows.yml
172178 with :
173179 arch : ${{ matrix.arch }}
174180 free-threading : ${{ matrix.free-threading }}
181+ interpreter : ${{ matrix.interpreter }}
175182
176183 build-windows-msi :
177184 # ${{ '' } is a hack to nest jobs under the same sidebar category.
@@ -198,16 +205,16 @@ jobs:
198205 strategy :
199206 fail-fast : false
200207 matrix :
201- # macos-26 is Apple Silicon, macos-26 -intel is Intel.
202- # macos-26 -intel only runs tests against the GIL-enabled CPython.
208+ # macos-26 is Apple Silicon, macos-15 -intel is Intel.
209+ # macos-15 -intel only runs tests against the GIL-enabled CPython.
203210 os :
204211 - macos-26
205- - macos-26 -intel
212+ - macos-15 -intel
206213 free-threading :
207214 - false
208215 - true
209216 exclude :
210- - os : macos-26 -intel
217+ - os : macos-15 -intel
211218 free-threading : true
212219 uses : ./.github/workflows/reusable-macos.yml
213220 with :
@@ -283,7 +290,7 @@ jobs:
283290 SSLLIB_DIR : ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
284291 LD_LIBRARY_PATH : ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}/lib
285292 steps :
286- - uses : actions/checkout@v6
293+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
287294 with :
288295 persist-credentials : false
289296 - name : Runner image version
@@ -294,7 +301,7 @@ jobs:
294301 run : sudo ./.github/workflows/posix-deps-apt.sh
295302 - name : ' Restore SSL library build'
296303 id : cache-ssl-lib
297- uses : actions/cache@v5
304+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
298305 with :
299306 path : ./multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
300307 key : ${{ matrix.os }}-multissl-${{ matrix.ssllib.name }}-${{ matrix.ssllib.version }}
@@ -342,7 +349,7 @@ jobs:
342349
343350 runs-on : ${{ matrix.runs-on }}
344351 steps :
345- - uses : actions/checkout@v6
352+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
346353 with :
347354 persist-credentials : false
348355 - name : Build and test
@@ -355,7 +362,7 @@ jobs:
355362 timeout-minutes : 60
356363 runs-on : macos-14
357364 steps :
358- - uses : actions/checkout@v6
365+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
359366 with :
360367 persist-credentials : false
361368
@@ -393,7 +400,7 @@ jobs:
393400 OPENSSL_VER : 3.5.5
394401 PYTHONSTRICTEXTENSIONBUILD : 1
395402 steps :
396- - uses : actions/checkout@v6
403+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
397404 with :
398405 persist-credentials : false
399406 - name : Register gcc problem matcher
@@ -407,7 +414,7 @@ jobs:
407414 echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
408415 - name : ' Restore OpenSSL build'
409416 id : cache-openssl
410- uses : actions/cache@v5
417+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
411418 with :
412419 path : ./multissl/openssl/${{ env.OPENSSL_VER }}
413420 key : ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -454,7 +461,7 @@ jobs:
454461 ./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt"
455462 - name : ' Restore Hypothesis database'
456463 id : cache-hypothesis-database
457- uses : actions/cache@v5
464+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
458465 with :
459466 path : ${{ env.CPYTHON_BUILDDIR }}/.hypothesis/
460467 key : hypothesis-database-${{ github.head_ref || github.run_id }}
@@ -481,7 +488,7 @@ jobs:
481488 -x test_subprocess \
482489 -x test_signal \
483490 -x test_sysconfig
484- - uses : actions/upload-artifact@v7
491+ - uses : actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
485492 if : always()
486493 with :
487494 name : hypothesis-example-db
@@ -502,7 +509,7 @@ jobs:
502509 PYTHONSTRICTEXTENSIONBUILD : 1
503510 ASAN_OPTIONS : detect_leaks=0:allocator_may_return_null=1:handle_segv=0
504511 steps :
505- - uses : actions/checkout@v6
512+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
506513 with :
507514 persist-credentials : false
508515 - name : Runner image version
@@ -512,7 +519,7 @@ jobs:
512519 - name : Install dependencies
513520 run : sudo ./.github/workflows/posix-deps-apt.sh
514521 - name : Set up GCC-10 for ASAN
515- uses : egor-tensin/setup-gcc@v2
522+ uses : egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
516523 with :
517524 version : 10
518525 - name : Configure OpenSSL env vars
@@ -522,7 +529,7 @@ jobs:
522529 echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
523530 - name : ' Restore OpenSSL build'
524531 id : cache-openssl
525- uses : actions/cache@v5
532+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
526533 with :
527534 path : ./multissl/openssl/${{ env.OPENSSL_VER }}
528535 key : ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -569,7 +576,7 @@ jobs:
569576 needs : build-context
570577 if : needs.build-context.outputs.run-ubuntu == 'true'
571578 steps :
572- - uses : actions/checkout@v6
579+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
573580 with :
574581 persist-credentials : false
575582 - name : Runner image version
0 commit comments