DEVOPS-1133: Pin GitHub Actions to commit hashes - #211
Open
RomFloreani wants to merge 5 commits into
Open
Conversation
github-actions
Bot
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates this repository’s GitHub Actions workflows and composite actions to move from major-version tags (e.g., @v6) to patch-level semver tags (e.g., @v6.1.0) for third-party actions and internal reusable workflows/actions.
Changes:
- Expand multiple
uses:references from major tags to full semver tags across reusable workflows. - Update internal
MiraGeoscience/CI-toolsreusable workflows/actions references to@v3.9.1. - Refresh action references used by Python build/test/release and zizmor security scanning workflows.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/reusable-zizmor-security.yml | Updates checkout and internal zizmor-config action references to patch-level semver tags. |
| .github/workflows/reusable-zizmor-annotate.yml | Updates checkout and internal zizmor-config action references to patch-level semver tags. |
| .github/workflows/reusable-zizmor-advanced-security.yml | Updates checkout and internal zizmor-config action references to patch-level semver tags. |
| .github/workflows/reusable-version-check.yml | Updates setup-python and setup-uv to patch-level semver tags. |
| .github/workflows/reusable-python-static_analysis.yml | Updates checkout/setup-python and internal setup actions to patch-level semver tags. |
| .github/workflows/reusable-python-release_pypi_assets.yml | Updates internal release/artifactory publishing action references to patch-level semver tags. |
| .github/workflows/reusable-python-release_conda_assets.yml | Updates internal release/artifactory publishing action references to patch-level semver tags. |
| .github/workflows/reusable-python-pytest.yml | Updates checkout/setup-python, internal setup actions, and codecov action to patch-level semver tags. |
| .github/workflows/reusable-python-publish_rattler_package.yml | Updates checkout/setup-python, artifact actions, and internal reusable workflow/action references to patch-level semver tags. |
| .github/workflows/reusable-python-publish_pypi_package.yml | Updates internal reusable workflow/action references and download-artifact to patch-level semver tags. |
| .github/workflows/reusable-python-build_setuptools_package.yml | Updates checkout/setup-python and upload-artifact to patch-level semver tags. |
| .github/workflows/reusable-python-build_poetry_package.yml | Updates checkout/setup-python and upload-artifact to patch-level semver tags. |
| .github/workflows/reusable-pre_commit.yml | Updates checkout/setup-python/setup-uv/cache actions to patch-level semver tags. |
| .github/workflows/reusable-jira-issue_to_jira.yml | Updates create-or-update-comment action to a patch-level semver tag. |
| .github/workflows/move-major-minor-tags.yml | Updates checkout action to a patch-level semver tag. |
| .github/actions/reusable-python-setup_poetry/action.yml | Updates install-poetry and cache actions to patch-level semver tags. |
| .github/actions/reusable-python-setup_hatch/action.yml | Updates cache action to a patch-level semver tag. |
| .github/actions/reusable-python-setup_conda/action.yml | Updates checkout and setup-micromamba actions to patch-level semver tags. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "base-depth=$depth" | ||
| echo "base-depth=$depth" >> $GITHUB_OUTPUT | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v6.1.0 |
| using: composite | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@v5.1.0 |
…voids Windows glob bug)
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
.github/workflows/reusable-zizmor-annotate.yml:42
- The version comment repeats the commit SHA ("# 0dce…") rather than a tag/semver label. If the intent is to keep Dependabot-readable version hints consistent with other pinned actions in this PR, update the comment to the corresponding upstream release ref (e.g. "# vX.Y.Z") that points to this SHA.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-advanced-security.yml:42
- The version comment repeats the commit SHA ("# 0dce…") rather than a tag/semver label. For the Dependabot-readable hint described in the PR, this comment should reference the tag/release ref that resolves to this SHA (e.g. "# vX.Y.Z") to match the approach used for other actions here.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-security.yml:42
- The version comment repeats the commit SHA ("# 0dce…") rather than a tag/semver label. If the goal is a Dependabot-readable version hint (as described in the PR), this should be the action’s release ref (e.g. "# vX.Y.Z" or whatever tag points at this SHA); otherwise the comment is redundant and may not help automated updates.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
with:
for more information, see https://pre-commit.ci
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.
Suppressed comments (4)
.github/workflows/dependabot-auto-merge.yml:9
- The dependabot auto-merge workflow calls
MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061, but that reusable workflow file is not present in this repository checkout (and the ref is not pinned to a commit hash). This will fail at runtime and also contradicts the PR goal of pinninguses:refs to immutable SHAs.
call-workflow-dependabot-auto-merge:
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061
.github/workflows/reusable-zizmor-security.yml:42
- The version comment on the pinned
zizmorcore/zizmor-actionref repeats the commit SHA, which isn’t dependabot-readable and doesn’t match the PR description’s “version comment” convention. This commit corresponds to release tagv0.5.0, so the comment should reflect that version.
with:
.github/workflows/reusable-zizmor-annotate.yml:41
- The version comment on the pinned
zizmorcore/zizmor-actionref repeats the commit SHA, which isn’t dependabot-readable and doesn’t match the PR description’s “version comment” convention. This commit corresponds to release tagv0.5.0, so the comment should reflect that version.
- name: Run Zizmor Security Scan
.github/workflows/reusable-zizmor-advanced-security.yml:42
- The version comment on the pinned
zizmorcore/zizmor-actionref repeats the commit SHA, which isn’t dependabot-readable and doesn’t match the PR description’s “version comment” convention. This commit corresponds to release tagv0.5.0, so the comment should reflect that version.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.
Suppressed comments (4)
.github/workflows/dependabot-auto-merge.yml:9
- The PR description says all
uses:are pinned to commit hashes, but there are still GitHub Actions referenced by version tags elsewhere in the repo (e.g..github/actions/reusable-python-setup_pixi/action.ymlusesprefix-dev/setup-pixi@v0.9.6, and.github/actions/reusable-python-publish_to_artifactory/action.ymlusesjfrog/setup-jfrog-cli@v4.4.1). If the intent is truly repo-wide pinning, these should be updated too.
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061
.github/workflows/reusable-zizmor-security.yml:41
- The version comment for this pinned action is not Dependabot-friendly: repeating the full SHA in the comment doesn’t convey the corresponding release. This commit corresponds to tag
v0.5.0, so the comment should reflect that.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-annotate.yml:42
- The version comment for this pinned action is not Dependabot-friendly: repeating the full SHA in the comment doesn’t convey the corresponding release. This commit corresponds to tag
v0.5.0, so the comment should reflect that.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-advanced-security.yml:42
- The version comment for this pinned action is not Dependabot-friendly: repeating the full SHA in the comment doesn’t convey the corresponding release. This commit corresponds to tag
v0.5.0, so the comment should reflect that.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
|
|
||
| jobs: | ||
| call-workflow-dependabot-auto-merge: | ||
| uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061 |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.
Suppressed comments (4)
.github/workflows/dependabot-auto-merge.yml:10
- This reusable-workflow reference is pinned to a branch (
@DEVOPS-1061), which is mutable and undermines the goal of pinninguses:to an immutable commit SHA. Pin this to a specific commit (and ideally replace the comment with a real release tag once one exists) to keep the workflow supply-chain hardened.
call-workflow-dependabot-auto-merge:
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061
permissions:
.github/workflows/reusable-zizmor-security.yml:42
- The dependabot-readable version comment should be a tag/semver, but this comment just repeats the pinned SHA. Since
0dce2577…corresponds tov0.5.0inzizmorcore/zizmor-action, update the comment so Dependabot can track it.
with:
.github/workflows/reusable-zizmor-advanced-security.yml:42
- The dependabot-readable version comment should be a tag/semver, but this comment just repeats the pinned SHA. Since
0dce2577…corresponds tov0.5.0inzizmorcore/zizmor-action, update the comment so Dependabot can track it.
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
.github/workflows/reusable-zizmor-annotate.yml:41
- The dependabot-readable version comment should be a tag/semver, but this comment just repeats the pinned SHA. Since
0dce2577…corresponds tov0.5.0inzizmorcore/zizmor-action, update the comment so Dependabot can track it.
- name: Run Zizmor Security Scan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every
uses:to a commit hash with a dependabot-readable version comment.Tags expanded in this repo:
actions/checkout@v5 -> @v5.1.0mamba-org/setup-micromamba@v2 -> @v2.0.7mamba-org/setup-micromamba@v2 -> @v2.0.7actions/cache@v4 -> @v4.3.0snok/install-poetry@v1 -> @v1.4.2actions/cache@v4 -> @v4.3.0actions/checkout@v6 -> @v6.1.0peter-evans/create-or-update-comment@v5 -> @v5.0.0actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0astral-sh/setup-uv@v7 -> @v7.6.0actions/cache@v5 -> @v5.1.0actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0actions/upload-artifact@v7 -> @v7.0.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0actions/upload-artifact@v7 -> @v7.0.1MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_poetry_package.yml@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_setuptools_package.yml@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0actions/upload-artifact@v7 -> @v7.0.1MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1actions/download-artifact@v8 -> @v8.0.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@v3 -> @v3.9.1codecov/codecov-action@v6 -> @v6.0.2MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@v3 -> @v3.9.1actions/checkout@v6 -> @v6.1.0actions/setup-python@v6 -> @v6.3.0MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@v3 -> @v3.9.1MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@v3 -> @v3.9.1actions/setup-python@v6 -> @v6.3.0astral-sh/setup-uv@v7 -> @v7.6.0actions/checkout@v6 -> @v6.1.0MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@v3 -> @v3.9.1actions/checkout@v6 -> @v6.1.0MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@v3 -> @v3.9.1actions/checkout@v6 -> @v6.1.0MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@v3 -> @v3.9.1