From b876a940e61c7e471a1fecb7dbcb76db80f81d7e Mon Sep 17 00:00:00 2001 From: Denis_Drobyshev Date: Fri, 18 Sep 2026 23:00:06 +0300 Subject: [PATCH] Pin every action to a commit, keeping the tag as a comment A tag is a label somebody else can move. `actions/checkout@v7` means whatever the owner of that repository decides v7 points at, at the moment the workflow runs, and these workflows run with a token that can write here. `pypa/gh-action-pypi-publish@release/v1` was worse: a branch, which moves by design, on the step that publishes to PyPI. Pinning fixes what runs. The tag stays on the line as a comment, so the file still reads, and Dependabot understands this form -- it raises the commit and rewrites the comment together, which is what keeps this from becoming a snapshot that rots. Every commit was resolved through the API rather than typed, and all twenty-three distinct references were checked against it again afterwards. The rewrite is idempotent: a second run reports nothing to do. --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 6 +++--- .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/external-links.yml | 6 +++--- .github/workflows/figures.yml | 6 +++--- .github/workflows/pages.yml | 8 ++++---- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d05f028..d91af43 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,9 +18,9 @@ jobs: name: Site checks runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.12" @@ -36,9 +36,9 @@ jobs: name: Social card is current runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.12" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e299c3a..1ec5d63 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,9 +23,9 @@ jobs: actions: read contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: # `assets/site.js` is the only executable thing on the site: 3 KB, no # dependencies, no build step. That is exactly the kind of file that @@ -34,6 +34,6 @@ jobs: languages: javascript-typescript queries: security-and-quality - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: category: "/language:javascript-typescript" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 6e6b0b4..8eef74e 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -37,7 +37,7 @@ jobs: # from the branch is checked out or executed, which is what makes # pull_request_target safe to use here. - id: metadata - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3 - id: verdict name: Decide whether this one can merge itself diff --git a/.github/workflows/external-links.yml b/.github/workflows/external-links.yml index 4473f67..cbadbf1 100644 --- a/.github/workflows/external-links.yml +++ b/.github/workflows/external-links.yml @@ -22,11 +22,11 @@ jobs: name: Check outbound links runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Run lychee id: lychee - uses: lycheeverse/lychee-action@v2 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2 with: # Pinned: an unpinned checker changes the meaning of a green run # without a commit. Moving it is a decision, so it is made here. @@ -68,7 +68,7 @@ jobs: - name: Report into the standing issue if: steps.lychee.outputs.exit_code != 0 - uses: peter-evans/create-issue-from-file@v6 + uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6 with: # One issue, rewritten in place. A new issue every Monday buried the # repository in copies of the same report and taught everyone to diff --git a/.github/workflows/figures.yml b/.github/workflows/figures.yml index d72d0f1..a7bcce8 100644 --- a/.github/workflows/figures.yml +++ b/.github/workflows/figures.yml @@ -25,9 +25,9 @@ jobs: name: Check the stated figures against their sources runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.12" @@ -68,7 +68,7 @@ jobs: - name: Report into the standing issue if: steps.figures.outputs.drifted != '0' - uses: peter-evans/create-issue-from-file@v6 + uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6 with: issue-number: ${{ steps.standing.outputs.number }} title: A figure on the site has drifted diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 1109ad2..ef0c13c 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -30,7 +30,7 @@ jobs: name: Assemble the site runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 # Named rather than globbed: a new top-level directory should have to be # added here deliberately, not published because it happened to exist. @@ -63,8 +63,8 @@ jobs: print(f" all {len(pages)} pages published") PY - - uses: actions/configure-pages@v6 - - uses: actions/upload-pages-artifact@v5 + - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6 + - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 with: path: _site @@ -77,4 +77,4 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5