Skip to content

Commit a92c0e0

Browse files
woodruffwwoodruffw
committed
[3.12] gh-146488: hash-pin all action references (gh-146489)
This is like #146489, but recreated for 3.12 because of CI drift. Signed-off-by: William Woodruff <william@yossarian.net>
1 parent 7f2d89a commit a92c0e0

18 files changed

+57
-57
lines changed

‎.github/workflows/build.yml‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ jobs:
4949
needs: build-context
5050
if: needs.build-context.outputs.run-tests == 'true'
5151
steps:
52-
- uses: actions/checkout@v6
52+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5353
with:
5454
persist-credentials: false
55-
- uses: actions/setup-python@v6
55+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5656
- name: Install dependencies
5757
run: |
5858
sudo ./.github/workflows/posix-deps-apt.sh
@@ -81,7 +81,7 @@ jobs:
8181
if: ${{ failure() && steps.check.conclusion == 'failure' }}
8282
run: |
8383
make regen-abidump
84-
- uses: actions/upload-artifact@v6
84+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
8585
name: Publish updated ABI files
8686
if: ${{ failure() && steps.check.conclusion == 'failure' }}
8787
with:
@@ -103,7 +103,7 @@ jobs:
103103
run: |
104104
apt update && apt install git -yq
105105
git config --global --add safe.directory "$GITHUB_WORKSPACE"
106-
- uses: actions/checkout@v6
106+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
107107
with:
108108
fetch-depth: 1
109109
persist-credentials: false
@@ -140,16 +140,16 @@ jobs:
140140
needs: build-context
141141
if: needs.build-context.outputs.run-tests == 'true'
142142
steps:
143-
- uses: actions/checkout@v6
143+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
144144
with:
145145
persist-credentials: false
146-
- uses: actions/setup-python@v6
146+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
147147
with:
148148
python-version: '3.x'
149149
- name: Runner image version
150150
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
151151
- name: Restore config.cache
152-
uses: actions/cache@v5
152+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
153153
with:
154154
path: config.cache
155155
# Include env.pythonLocation in key to avoid changes in environment when setup-python updates Python
@@ -159,7 +159,7 @@ jobs:
159159
- name: Add ccache to PATH
160160
run: echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
161161
- name: Configure ccache action
162-
uses: hendrikmuhs/ccache-action@v1.2
162+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
163163
with:
164164
save: false
165165
- name: Configure CPython
@@ -291,13 +291,13 @@ jobs:
291291
OPENSSL_DIR: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}
292292
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib
293293
steps:
294-
- uses: actions/checkout@v6
294+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
295295
with:
296296
persist-credentials: false
297297
- name: Runner image version
298298
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
299299
- name: Restore config.cache
300-
uses: actions/cache@v5
300+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
301301
with:
302302
path: config.cache
303303
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
@@ -312,7 +312,7 @@ jobs:
312312
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
313313
- name: 'Restore OpenSSL build'
314314
id: cache-openssl
315-
uses: actions/cache@v5
315+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
316316
with:
317317
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
318318
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -323,7 +323,7 @@ jobs:
323323
run: |
324324
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
325325
- name: Configure ccache action
326-
uses: hendrikmuhs/ccache-action@v1.2
326+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
327327
with:
328328
save: false
329329
- name: Configure CPython
@@ -345,7 +345,7 @@ jobs:
345345
OPENSSL_VER: 3.0.15
346346
PYTHONSTRICTEXTENSIONBUILD: 1
347347
steps:
348-
- uses: actions/checkout@v6
348+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
349349
with:
350350
persist-credentials: false
351351
- name: Register gcc problem matcher
@@ -359,7 +359,7 @@ jobs:
359359
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
360360
- name: 'Restore OpenSSL build'
361361
id: cache-openssl
362-
uses: actions/cache@v5
362+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
363363
with:
364364
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
365365
key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -370,7 +370,7 @@ jobs:
370370
run: |
371371
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
372372
- name: Configure ccache action
373-
uses: hendrikmuhs/ccache-action@v1.2
373+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
374374
with:
375375
save: false
376376
- name: Setup directory envs for out-of-tree builds
@@ -384,7 +384,7 @@ jobs:
384384
- name: Runner image version
385385
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
386386
- name: Restore config.cache
387-
uses: actions/cache@v5
387+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
388388
with:
389389
path: ${{ env.CPYTHON_BUILDDIR }}/config.cache
390390
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
@@ -417,7 +417,7 @@ jobs:
417417
./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt"
418418
- name: 'Restore Hypothesis database'
419419
id: cache-hypothesis-database
420-
uses: actions/cache@v5
420+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
421421
with:
422422
path: ./hypothesis
423423
key: hypothesis-database-${{ github.head_ref || github.run_id }}
@@ -443,7 +443,7 @@ jobs:
443443
-x test_subprocess \
444444
-x test_signal \
445445
-x test_sysconfig
446-
- uses: actions/upload-artifact@v6
446+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
447447
if: always()
448448
with:
449449
name: hypothesis-example-db
@@ -464,13 +464,13 @@ jobs:
464464
PYTHONSTRICTEXTENSIONBUILD: 1
465465
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
466466
steps:
467-
- uses: actions/checkout@v6
467+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
468468
with:
469469
persist-credentials: false
470470
- name: Runner image version
471471
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
472472
- name: Restore config.cache
473-
uses: actions/cache@v5
473+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
474474
with:
475475
path: config.cache
476476
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{ needs.build-context.outputs.config-hash }}
@@ -479,7 +479,7 @@ jobs:
479479
- name: Install dependencies
480480
run: sudo ./.github/workflows/posix-deps-apt.sh
481481
- name: Set up GCC-10 for ASAN
482-
uses: egor-tensin/setup-gcc@v2
482+
uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
483483
with:
484484
version: 10
485485
- name: Configure OpenSSL env vars
@@ -489,7 +489,7 @@ jobs:
489489
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
490490
- name: 'Restore OpenSSL build'
491491
id: cache-openssl
492-
uses: actions/cache@v5
492+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
493493
with:
494494
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
495495
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -500,7 +500,7 @@ jobs:
500500
run: |
501501
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
502502
- name: Configure ccache action
503-
uses: hendrikmuhs/ccache-action@v1.2
503+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
504504
with:
505505
save: ${{ github.event_name == 'push' }}
506506
max-size: "200M"

‎.github/workflows/documentation-links.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
timeout-minutes: 5
2323

2424
steps:
25-
- uses: readthedocs/actions/preview@v1
25+
- uses: readthedocs/actions/preview@b8bba1484329bda1a3abe986df7ebc80a8950333 # v1.5
2626
with:
2727
project-slug: "cpython-previews"
2828
single-version: "true"

‎.github/workflows/lint.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
timeout-minutes: 10
2020

2121
steps:
22-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2323
with:
2424
persist-credentials: false
25-
- uses: actions/setup-python@v6
25+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2626
with:
2727
python-version: "3.x"
28-
- uses: pre-commit/action@v3.0.1
28+
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

‎.github/workflows/mypy.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,10 @@ jobs:
3030
runs-on: ubuntu-latest
3131
timeout-minutes: 10
3232
steps:
33-
- uses: actions/checkout@v6
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3434
with:
3535
persist-credentials: false
36-
- uses: actions/setup-python@v6
36+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3737
with:
3838
python-version: "3.x"
3939
cache: pip

‎.github/workflows/new-bugs-announce-notifier.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ jobs:
1313
runs-on: ubuntu-latest
1414
timeout-minutes: 10
1515
steps:
16-
- uses: actions/setup-node@v6
16+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1717
with:
1818
node-version: 14
1919
- run: npm install mailgun.js form-data
2020
- name: Send notification
21-
uses: actions/github-script@v8
21+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
2222
env:
2323
MAILGUN_API_KEY: ${{ secrets.MAILGUN_PYTHON_ORG_MAILGUN_KEY }}
2424
with:

‎.github/workflows/project-updater.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
- { project: 32, label: sprint }
2525

2626
steps:
27-
- uses: actions/add-to-project@v1.0.2
27+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
2828
with:
2929
project-url: https://github.com/orgs/python/projects/${{ matrix.project }}
3030
github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

‎.github/workflows/require-pr-label.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
timeout-minutes: 10
1515

1616
steps:
17-
- uses: mheap/github-action-required-labels@v5
17+
- uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5.5.2
1818
with:
1919
mode: exactly
2020
count: 0

‎.github/workflows/reusable-change-detection.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
steps:
6161
- run: >-
6262
echo '${{ github.event_name }}'
63-
- uses: actions/checkout@v6
63+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6464
with:
6565
persist-credentials: false
6666
- name: Check for source changes
@@ -118,7 +118,7 @@ jobs:
118118
- name: Get a list of the changed documentation-related files
119119
if: github.event_name == 'pull_request'
120120
id: changed-docs-files
121-
uses: Ana06/get-changed-files@v2.3.0
121+
uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
122122
with:
123123
filter: |
124124
Doc/**
@@ -139,7 +139,7 @@ jobs:
139139
- name: Get a list of the MSI installer-related files
140140
if: github.event_name == 'pull_request'
141141
id: changed-win-msi-files
142-
uses: Ana06/get-changed-files@v2.3.0
142+
uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
143143
with:
144144
filter: |
145145
Tools/msi/**

‎.github/workflows/reusable-context.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,14 @@ jobs:
5050
run-windows-tests: ${{ steps.changes.outputs.run-windows-tests }}
5151
steps:
5252
- name: Set up Python
53-
uses: actions/setup-python@v6
53+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5454
with:
5555
python-version: "3"
5656

5757
- run: >-
5858
echo '${{ github.event_name }}'
5959
60-
- uses: actions/checkout@v6
60+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6161
with:
6262
persist-credentials: false
6363
ref: >-

‎.github/workflows/reusable-docs.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
refspec_pr: '+${{ github.event.pull_request.head.sha }}:remotes/origin/${{ github.event.pull_request.head.ref }}'
2525
steps:
2626
- name: 'Check out latest PR branch commit'
27-
uses: actions/checkout@v6
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828
with:
2929
persist-credentials: false
3030
ref: >-
@@ -49,7 +49,7 @@ jobs:
4949
git fetch origin "${refspec_base}" --shallow-since="${DATE}" \
5050
--no-tags --prune --no-recurse-submodules
5151
- name: 'Set up Python'
52-
uses: actions/setup-python@v6
52+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5353
with:
5454
python-version: '3'
5555
cache: 'pip'
@@ -91,10 +91,10 @@ jobs:
9191
runs-on: ubuntu-24.04
9292
timeout-minutes: 60
9393
steps:
94-
- uses: actions/checkout@v6
94+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9595
with:
9696
persist-credentials: false
97-
- uses: actions/cache@v5
97+
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
9898
with:
9999
path: ~/.cache/pip
100100
key: ubuntu-doc-${{ hashFiles('Doc/requirements.txt') }}

0 commit comments

Comments
 (0)