adam/open-swe
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/open-swe.git synced 2026-10-03 17:53:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ci: SHA-pin third-party actions in workflow files (#1193)

Browse source 
Pin astral-sh/setup-uv and amannn/action-semantic-pull-request to
full commit SHAs to prevent supply chain attacks via tag hijacking.
This commit is contained in:
John Kennedy 2026-04-15 23:36:07 -07:00 • committed by GitHub
parent da11bcdf60
commit a94fb8b94c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
.github/workflows/ci.yml vendored
View file

@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v4 - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
- name: Install dependencies - name: Install dependencies
run: uv sync --locked --extra dev run: uv sync --locked --extra dev
- name: Run lint - name: Run lint
@ -30,7 +30,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v4 - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
- name: Install dependencies - name: Install dependencies
run: uv sync --locked --extra dev run: uv sync --locked --extra dev
- name: Run format check - name: Run format check
@ -41,7 +41,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v4 - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
- name: Install dependencies - name: Install dependencies
run: uv sync --locked --extra dev run: uv sync --locked --extra dev
- name: Run unit tests - name: Run unit tests

2
.github/workflows/pr_lint.yml vendored
View file

@ -12,7 +12,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Validate PR Title - name: Validate PR Title
uses: amannn/action-semantic-pull-request@v5 uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with: with: