Repository navigation
Switch versions to SHA - #610
Merged
Merged
Conversation
Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
…}.jinja Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
After `persist-credentials: false` the `git ls-remote` would fail. This switches to using show-ref and using the local repositort Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The selected setup-uv and action-send-mail SHAs do not match the tags being replaced.
8 open findings
What changed in this PR
Pins GitHub Actions dependencies to immutable commit SHAs to improve workflow supply-chain security.
Changes:
- Pins actions in repository CI workflows.
- Applies equivalent pinning to generated project workflow templates.
- Covers testing, documentation, publishing, benchmarking, and notifications.
| File | Description |
|---|---|
.github/workflows/add-issue-to-project.yml |
Pins project automation. |
.github/workflows/pre-commit-ci.yml |
Pins pre-commit workflow actions. |
.github/workflows/smoke-test.yml |
Pins smoke-test actions. |
.github/workflows/testing-and-coverage.yml |
Pins test and coverage actions. |
python-project-template/.github/workflows/pre-commit-ci.yml.jinja |
Pins generated pre-commit actions. |
python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja |
Pins documentation actions. |
python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja |
Pins benchmark-comment actions. |
python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja |
Pins pull-request benchmark actions. |
python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja |
Pins nightly benchmark actions. |
python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja |
Pins benchmark deployment actions. |
python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja |
Pins generated testing actions. |
python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja |
Pins generated smoke-test actions. |
python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja |
Pins publishing prerequisites. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jeremykubica
marked this pull request as ready for review
October 12, 2026 13:42
hombit
approved these changes
Oct 12, 2026
hombit
left a comment
hombit
left a comment
Contributor
There was a problem hiding this comment.
Looks good. Should we do the same with the pre-commit hook versions?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #581
Changes to use SHA-tagging instead of version tags as recommended by github: https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions
Tested via: lincc-frameworks/citation-compass#56