From a9ebc9f38e8b7b75d1f4bb2beb13f14fcf669218 Mon Sep 17 00:00:00 2001 From: Ignacio Rodriguez Paez Date: Wed, 11 Nov 2026 10:21:19 +0000 Subject: [PATCH] Pin GitHub Actions to commit SHAs Sourcegraph-Batch-Change: https://sourcegraph.sourcegraph.com/batch-change-agents/1257 --- .github/workflows/build.yml | 12 ++++++------ .github/workflows/codeql.yml | 8 ++++---- .github/workflows/labeler.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/scip-docker.yml | 10 +++++----- .github/workflows/scip-release.yml | 10 +++++----- .github/workflows/scip-snapshot.yml | 6 +++--- .github/workflows/scip-style.yml | 4 ++-- .github/workflows/validation.yml | 24 ++++++++++++------------ 9 files changed, 41 insertions(+), 41 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 946b836e2..58aac4eaf 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,11 +17,11 @@ jobs: name: Build steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} @@ -30,7 +30,7 @@ jobs: run: | echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.npm-cache.outputs.dir }} key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} @@ -45,7 +45,7 @@ jobs: npm run package mv pyright-*.vsix ${{ env.VSIX_NAME }} - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.ARTIFACT_NAME_VSIX }} path: packages/vscode-pyright/${{ env.VSIX_NAME }} @@ -58,14 +58,14 @@ jobs: steps: - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts # TODO: If the release already exists (tag created via the GUI), reuse it. - name: Create release id: create_release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 36c991806..6f38d6088 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,11 +32,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 # Override language selection by uncommenting this and choosing your languages # with: # languages: go, javascript, csharp, python, cpp, java @@ -44,7 +44,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below). - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -58,4 +58,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 3c64e0729..8cb0aa0fa 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -11,7 +11,7 @@ jobs: triage: runs-on: ubuntu-latest steps: - - uses: github/issue-labeler@v3.5 + - uses: github/issue-labeler@ccca1e16fcb66762200e616fc29b57b940c1cb67 # v3.5 with: configuration-path: .github/labeler.yml enable-versioned-regex: 0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 37f2a28c7..7f725d627 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,16 +15,16 @@ jobs: name: Publish extension to marketplace steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} - run: npm install - name: Download VSIX - uses: i3h/download-release-asset@v1 + uses: i3h/download-release-asset@a987f9dc3559bd1024d7ed353b59c9d0bbb8ab61 # v1.3.3 with: owner: microsoft repo: pyright diff --git a/.github/workflows/scip-docker.yml b/.github/workflows/scip-docker.yml index 4c8306466..e36e8bf83 100644 --- a/.github/workflows/scip-docker.yml +++ b/.github/workflows/scip-docker.yml @@ -13,15 +13,15 @@ jobs: build-image: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install mise - uses: jdx/mise-action@v5.2.7 + uses: jdx/mise-action@b44d12e7d0d8ee7461bb893e1b1993500433185b # v5.2.7 with: version: 2026.10.25 - name: Get npm cache directory id: npm-cache run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.npm-cache.outputs.dir }} key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} @@ -30,10 +30,10 @@ jobs: - run: npm install # npm pack builds the package and creates the tarball Dockerfile.autoindex installs. - run: cd ./packages/pyright-scip/ && npm install && npm pack - - uses: docker/setup-buildx-action@v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Build Dockerfile id: docker_build_autoindex - uses: docker/build-push-action@v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: Dockerfile.autoindex diff --git a/.github/workflows/scip-release.yml b/.github/workflows/scip-release.yml index 21c6de433..fd352265b 100644 --- a/.github/workflows/scip-release.yml +++ b/.github/workflows/scip-release.yml @@ -12,9 +12,9 @@ jobs: contents: read id-token: write # npm trusted publishing (OIDC) steps: - - uses: actions/checkout@v7 - - uses: docker/setup-buildx-action@v4 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 26.13.0 - run: npm install @@ -22,13 +22,13 @@ jobs: - run: cd ./packages/pyright-scip/ && npm install && npm pack - run: cd ./packages/pyright-scip/ && npm publish --access public - name: Login to DockerHub - uses: docker/login-action@v4 + uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Build and push id: docker_build_autoindex - uses: docker/build-push-action@v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: Dockerfile.autoindex diff --git a/.github/workflows/scip-snapshot.yml b/.github/workflows/scip-snapshot.yml index f301fb5f1..f82afd172 100644 --- a/.github/workflows/scip-snapshot.yml +++ b/.github/workflows/scip-snapshot.yml @@ -14,15 +14,15 @@ jobs: os: [ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install mise - uses: jdx/mise-action@v5.2.7 + uses: jdx/mise-action@b44d12e7d0d8ee7461bb893e1b1993500433185b # v5.2.7 with: version: 2026.10.25 - name: Get npm cache directory id: npm-cache run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.npm-cache.outputs.dir }} key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} diff --git a/.github/workflows/scip-style.yml b/.github/workflows/scip-style.yml index 36ad05a5c..f6539330f 100644 --- a/.github/workflows/scip-style.yml +++ b/.github/workflows/scip-style.yml @@ -13,9 +13,9 @@ jobs: name: check steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@v5.2.7 + - uses: jdx/mise-action@b44d12e7d0d8ee7461bb893e1b1993500433185b # v5.2.7 with: version: 2026.10.25 diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml index 92a38592c..60d8cdb71 100644 --- a/.github/workflows/validation.yml +++ b/.github/workflows/validation.yml @@ -18,9 +18,9 @@ jobs: name: Typecheck steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} @@ -28,7 +28,7 @@ jobs: id: npm-cache run: | echo "::set-output name=dir::$(npm config get cache)" - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.npm-cache.outputs.dir }} key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} @@ -45,9 +45,9 @@ jobs: name: Style steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} @@ -55,7 +55,7 @@ jobs: id: npm-cache run: | echo "::set-output name=dir::$(npm config get cache)" - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.npm-cache.outputs.dir }} key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} @@ -80,9 +80,9 @@ jobs: needs: typecheck steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} @@ -93,7 +93,7 @@ jobs: id: npm-cache run: | echo "::set-output name=dir::$(npm config get cache)" - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: runner.os != 'Windows' with: path: ${{ steps.npm-cache.outputs.dir }} @@ -113,9 +113,9 @@ jobs: needs: typecheck steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ env.NODE_VERSION }} @@ -123,7 +123,7 @@ jobs: id: npm-cache run: | echo "::set-output name=dir::$(npm config get cache)" - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ steps.npm-cache.outputs.dir }} key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}