ci: pin all GitHub Actions to SHA hashes and update versions#1681
Conversation
There was a problem hiding this comment.
Pull request overview
Pins GitHub Actions to full commit SHAs to harden the CI supply chain, while upgrading select actions (cache + Codecov) to newer major versions.
Changes:
- Pin all referenced GitHub Actions in workflows and the composite setup action to full commit SHAs (with version tags kept as comments).
- Upgrade
actions/cachefrom v4 → v5 (in the composite setup action). - Upgrade
codecov/codecov-actionfrom v5 → v6.0.0 (in CI workflow).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/ci.yml |
Pins actions/checkout and upgrades/pins Codecov action to a SHA. |
.github/workflows/codeql-analysis.yml |
Pins actions/checkout and CodeQL init/analyze actions to SHAs. |
.github/workflows/publish.yml |
Pins checkout, uv setup, python setup, and PyPI publish actions to SHAs. |
.github/workflows/stale.yml |
Pins actions/stale to a SHA in both stale policy steps. |
.github/actions/setup/action.yaml |
Pins uv/python setup actions and upgrades/pins actions/cache to v5 SHA. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1681 +/- ##
==========================================
+ Coverage 93.22% 93.25% +0.03%
==========================================
Files 157 157
Lines 9815 9815
Branches 1003 1003
==========================================
+ Hits 9150 9153 +3
+ Misses 472 470 -2
+ Partials 193 192 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
5187fba to
94e06bb
Compare
- Pin all actions to full SHA commit hashes for supply chain security - Upgrade actions/cache from v4 to v5 - Upgrade codecov/codecov-action from v5 to v6.0.0 (node24 support) - Version tags preserved as inline comments for easy readability Actions pinned: actions/checkout@v6 (de0fac2) actions/setup-python@v6 (a309ff8) actions/cache@v5 (6682284) [upgraded from v4] actions/stale@v10 (b5d41d4) astral-sh/setup-uv@v7 (37802ad) codecov/codecov-action@v6.0.0 (57e3a13) [upgraded from v5] github/codeql-action@v4 (c10b806) pypa/gh-action-pypi-publish@release/v1 (ed0c539)
|
@rytilahti Here is the updated CI PR you asked for with SHA pinning and updated versions across the repository. |
rytilahti
left a comment
rytilahti
left a comment
There was a problem hiding this comment.
LGTM, with a couple of nits. Let me know if you want to update the PR or if we should merge this as is, thank you!
| - name: Setup uv | ||
| id: setup-uv | ||
| uses: astral-sh/setup-uv@v7 | ||
| uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 |
There was a problem hiding this comment.
How about bumping to v8 https://github.com/astral-sh/setup-uv/releases/tag/v8.3.0 already? We can pin uv version in our uv.lock then, too :-)
rytilahti
left a comment
rytilahti
left a comment
There was a problem hiding this comment.
Nice work finding out the issue with parallel windows runs, let's merge!
Summary
Pin all GitHub Actions to full SHA commit hashes for improved supply chain security, following GitHub's recommendation. Version tags are preserved as inline comments for readability.
Version upgrades
SHA pinning (no version change)
actions/checkoutde0fac2eactions/setup-pythona309ff8bactions/cache66822842actions/staleb5d41d4eastral-sh/setup-uv37802adccodecov/codecov-action57e3a136github/codeql-actionc10b8064pypa/gh-action-pypi-published0c5393CodeQL enhancement
CODEQL_ACTION_FILE_COVERAGE_ON_PRS: trueto show file-level coverage info in PR checksFiles changed
.github/workflows/ci.yml.github/workflows/codeql-analysis.yml.github/workflows/publish.yml.github/workflows/stale.yml.github/actions/setup/action.yamlMerge order
This is PR 2 of 9 in the test modernization series. Independent of other PRs (no file overlaps).
Verification