From 876805e51f8059e2e6f9dcd930dc094c050995fa Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 16:09:27 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 + .github/workflows/close-inactive-issues.yml | 2 +- .github/workflows/codeql-analysis.yml | 8 +-- .github/workflows/devflow-pr-review.yml | 8 +-- .github/workflows/dotnet-build-and-test.yml | 18 +++--- .github/workflows/dotnet-ci.yml | 12 ++-- .github/workflows/dotnet-format.yml | 4 +- .../workflows/dotnet-integration-tests.yml | 6 +- .github/workflows/label-issues.yml | 2 +- .github/workflows/label-pr.yml | 2 +- .github/workflows/label-title-prefix.yml | 2 +- .github/workflows/markdown-link-check.yml | 4 +- .github/workflows/merge-gatekeeper.yml | 2 +- .github/workflows/python-build.yml | 10 ++-- .../workflows/python-integration-tests.yml | 60 +++++++++---------- .github/workflows/python-lint.yml | 6 +- .github/workflows/python-manual-release.yml | 4 +- .../workflows/python-test-coverage-report.yml | 6 +- .github/workflows/python-test-coverage.yml | 6 +- .github/workflows/python-unit-tests.yml | 6 +- .github/workflows/typos.yaml | 6 +- 21 files changed, 89 insertions(+), 87 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 551ba7bd1e59..e4604987ea7a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -42,3 +42,5 @@ updates: schedule: interval: "weekly" day: "tuesday" + cooldown: + default-days: 7 diff --git a/.github/workflows/close-inactive-issues.yml b/.github/workflows/close-inactive-issues.yml index 4e6ebccef628..995e1abfcaf3 100644 --- a/.github/workflows/close-inactive-issues.yml +++ b/.github/workflows/close-inactive-issues.yml @@ -10,7 +10,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 with: days-before-issue-stale: 90 days-before-issue-close: 14 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index a077ef679501..34f37fa6a01c 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -32,13 +32,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -52,7 +52,7 @@ jobs: # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild if: ${{ matrix.language != 'java' }} - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -65,6 +65,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/devflow-pr-review.yml b/.github/workflows/devflow-pr-review.yml index 264f8f3c1c66..c5a915ad00ea 100644 --- a/.github/workflows/devflow-pr-review.yml +++ b/.github/workflows/devflow-pr-review.yml @@ -64,7 +64,7 @@ jobs: # Safe checkout: base repo only, not the untrusted PR head. - name: Checkout target repo base - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} fetch-depth: 0 @@ -73,7 +73,7 @@ jobs: # Private DevFlow checkout: the PAT/token grants access to this repo's code. - name: Checkout DevFlow - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: repository: ${{ env.DEVFLOW_REPOSITORY }} ref: ${{ env.DEVFLOW_REF }} @@ -83,12 +83,12 @@ jobs: path: devflow - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.13" - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true diff --git a/.github/workflows/dotnet-build-and-test.yml b/.github/workflows/dotnet-build-and-test.yml index 6395f6a0b9b8..72067f32122b 100644 --- a/.github/workflows/dotnet-build-and-test.yml +++ b/.github/workflows/dotnet-build-and-test.yml @@ -29,10 +29,10 @@ jobs: outputs: dotnetChanges: ${{ steps.filter.outputs.dotnet }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - - uses: dorny/paths-filter@v2 + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter with: filters: | @@ -69,12 +69,12 @@ jobs: runs-on: ${{ matrix.os }} environment: ${{ matrix.environment }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: Setup dotnet - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: global-json-file: ${{ github.workspace }}/dotnet/global.json @@ -126,7 +126,7 @@ jobs: - name: Azure CLI Login if: github.event_name != 'pull_request' && matrix.integration-tests - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -184,14 +184,14 @@ jobs: # Generate test reports and check coverage - name: Generate test reports - uses: danielpalme/ReportGenerator-GitHub-Action@5.4.15 + uses: danielpalme/ReportGenerator-GitHub-Action@18e0cd4c1bebd0c8b3978b380a6a4ea61c51178e # 5.4.15 with: reports: "./TestResults/Coverage/**/coverage.cobertura.xml" targetdir: "./TestResults/Reports" reporttypes: "HtmlInline;JsonSummary" - name: Upload coverage report artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: CoverageReport-${{ matrix.os }}-${{ matrix.dotnet }}-${{ matrix.configuration }} # Artifact name path: ./TestResults/Reports # Directory containing files to upload @@ -232,13 +232,13 @@ jobs: - name: Fail workflow if tests failed id: check_tests_failed if: contains(join(needs.*.result, ','), 'failure') - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: core.setFailed('Integration Tests Failed!') - name: Fail workflow if tests cancelled id: check_tests_cancelled if: contains(join(needs.*.result, ','), 'cancelled') - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: core.setFailed('Integration Tests Cancelled!') diff --git a/.github/workflows/dotnet-ci.yml b/.github/workflows/dotnet-ci.yml index da9665030c9a..2b5dc29cd05f 100644 --- a/.github/workflows/dotnet-ci.yml +++ b/.github/workflows/dotnet-ci.yml @@ -24,7 +24,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: clean: true persist-credentials: false @@ -55,7 +55,7 @@ jobs: done - name: Upload dotnet test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: dotnet-testresults-${{ matrix.configuration }} path: ./TestResults @@ -72,19 +72,19 @@ jobs: env: NUGET_CERT_REVOCATION_MODE: offline steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: clean: true persist-credentials: false - name: Setup .NET SDK ${{ matrix.dotnet-version }} - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: ${{ matrix.dotnet-version }} env: NUGET_AUTH_TOKEN: ${{ secrets.GPR_READ_TOKEN }} - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.nuget/packages # Look to see if there is a cache hit for the corresponding requirements file @@ -122,7 +122,7 @@ jobs: done - name: Upload dotnet test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: dotnet-testresults-${{ matrix.configuration }} path: ./TestResults diff --git a/.github/workflows/dotnet-format.yml b/.github/workflows/dotnet-format.yml index 1e0cd992e038..b304ac3db050 100644 --- a/.github/workflows/dotnet-format.yml +++ b/.github/workflows/dotnet-format.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 persist-credentials: false @@ -41,7 +41,7 @@ jobs: - name: Get changed files id: changed-files if: github.event_name == 'pull_request' - uses: jitterbit/get-changed-files@v1 + uses: jitterbit/get-changed-files@b17fbb00bdc0c0f63fcf166580804b4d2cdc2a42 # v1 continue-on-error: true - name: No C# files changed diff --git a/.github/workflows/dotnet-integration-tests.yml b/.github/workflows/dotnet-integration-tests.yml index 3993d31e5b84..545029176568 100644 --- a/.github/workflows/dotnet-integration-tests.yml +++ b/.github/workflows/dotnet-integration-tests.yml @@ -22,14 +22,14 @@ jobs: configuration: [Debug] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 if: ${{ github.event_name != 'pull_request' }} with: clean: true persist-credentials: false - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 if: ${{ github.event_name != 'pull_request' }} with: dotnet-version: 10.0.x @@ -60,7 +60,7 @@ jobs: done - name: Upload dotnet test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: dotnet-testresults-${{ matrix.configuration }} path: ./TestResults diff --git a/.github/workflows/label-issues.yml b/.github/workflows/label-issues.yml index cf901ade0cb3..94d763b63fbc 100644 --- a/.github/workflows/label-issues.yml +++ b/.github/workflows/label-issues.yml @@ -13,7 +13,7 @@ jobs: permissions: issues: write steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} script: | diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml index 4aea432e31c0..b50626e8bfd9 100644 --- a/.github/workflows/label-pr.yml +++ b/.github/workflows/label-pr.yml @@ -16,6 +16,6 @@ jobs: pull-requests: write steps: - - uses: actions/labeler@v6 + - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 with: repo-token: "${{ secrets.GH_ACTIONS_PR_WRITE }}" diff --git a/.github/workflows/label-title-prefix.yml b/.github/workflows/label-title-prefix.yml index 81369deedf25..4b1b44d33045 100644 --- a/.github/workflows/label-title-prefix.yml +++ b/.github/workflows/label-title-prefix.yml @@ -15,7 +15,7 @@ jobs: pull-requests: write steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 name: "Issue/PR: update title" with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/markdown-link-check.yml b/.github/workflows/markdown-link-check.yml index 22270a837748..6e93e89397e0 100644 --- a/.github/workflows/markdown-link-check.yml +++ b/.github/workflows/markdown-link-check.yml @@ -13,13 +13,13 @@ jobs: runs-on: ubuntu-22.04 # check out the latest version of the code steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false # Checks the status of hyperlinks in all files - name: Run linkspector - uses: umbrelladocs/action-linkspector@v1 + uses: umbrelladocs/action-linkspector@568ec8d29fa92b31fd9ea5381e155c51e922af83 # v1.5.5 with: reporter: local filter_mode: nofilter diff --git a/.github/workflows/merge-gatekeeper.yml b/.github/workflows/merge-gatekeeper.yml index 36a75ed2f842..7ae635f9a134 100644 --- a/.github/workflows/merge-gatekeeper.yml +++ b/.github/workflows/merge-gatekeeper.yml @@ -23,7 +23,7 @@ jobs: # NOTE: v1 is updated to reflect the latest v1.x.y. Please use any tag/branch that suits your needs: # https://github.com/upsidr/merge-gatekeeper/tags # https://github.com/upsidr/merge-gatekeeper/branches - uses: upsidr/merge-gatekeeper@v1 + uses: upsidr/merge-gatekeeper@09af7a82c1666d0e64d2bd8c01797a0bcfd3bb5d # v1.2.1 if: github.event_name == 'pull_request' with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/python-build.yml b/.github/workflows/python-build.yml index b366580b1911..88673e5ffd4b 100644 --- a/.github/workflows/python-build.yml +++ b/.github/workflows/python-build.yml @@ -17,9 +17,9 @@ jobs: env: UV_PYTHON: "3.10" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -31,18 +31,18 @@ jobs: - name: Build the package run: cd python && make build - name: Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: files: | python/dist/* - name: Azure Login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Start DevOps pipeline - uses: azure/cli@v2 + uses: azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 with: inlineScript: | az pipelines run --id ${{ vars.ADO_PYTHON_RELEASE_ID }} --org ${{ vars.ADO_ORG }} --project ${{ vars.ADO_PROJECT_NAME }} --parameters tag=${{ github.event.release.tag_name }} delay=0 diff --git a/.github/workflows/python-integration-tests.yml b/.github/workflows/python-integration-tests.yml index 6d08cafa2bcd..8f7737aff49e 100644 --- a/.github/workflows/python-integration-tests.yml +++ b/.github/workflows/python-integration-tests.yml @@ -84,8 +84,8 @@ jobs: outputs: pythonChanges: ${{ steps.filter.outputs.python}} steps: - - uses: actions/checkout@v5 - - uses: dorny/paths-filter@v2 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter with: filters: | @@ -119,9 +119,9 @@ jobs: UV_PYTHON: ${{ matrix.python-version }} COMPLETIONS_CONCEPT_SAMPLE: "true" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -131,21 +131,21 @@ jobs: run: | uv sync --all-extras --dev - name: Google auth - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: project_id: ${{ vars.VERTEX_AI_PROJECT_ID }} credentials_json: ${{ secrets.VERTEX_AI_SERVICE_ACCOUNT_KEY }} - name: Set up gcloud - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: ${{ vars.AWS_REGION }} - name: Azure CLI Login if: github.event_name != 'pull_request' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -174,9 +174,9 @@ jobs: env: UV_PYTHON: ${{ matrix.python-version }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -186,7 +186,7 @@ jobs: uv sync --all-extras --dev - name: Azure CLI Login if: github.event_name != 'pull_request' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -215,9 +215,9 @@ jobs: env: UV_PYTHON: ${{ matrix.python-version }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -226,14 +226,14 @@ jobs: run: | uv sync --all-extras --dev - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: ${{ vars.AWS_REGION }} - name: Azure CLI Login if: github.event_name != 'pull_request' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -264,9 +264,9 @@ jobs: UV_PYTHON: ${{ matrix.python-version }} COMPLETIONS_CONCEPT_SAMPLE: "true" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -329,9 +329,9 @@ jobs: - 8080:8080 - 50051:50051 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -342,7 +342,7 @@ jobs: uv sync --all-extras --dev - name: Azure CLI Login if: github.event_name != 'pull_request' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -387,9 +387,9 @@ jobs: - 8080:8080 - 50051:50051 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -415,14 +415,14 @@ jobs: ollama pull ${{ vars.OLLAMA_EMBEDDING_MODEL_ID }} ollama list - name: Google auth - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: project_id: ${{ vars.VERTEX_AI_PROJECT_ID }} credentials_json: ${{ secrets.VERTEX_AI_SERVICE_ACCOUNT_KEY }} - name: Set up gcloud - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} @@ -435,7 +435,7 @@ jobs: Start-CosmosDbEmulator - name: Azure CLI Login if: github.event_name != 'pull_request' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -534,19 +534,19 @@ jobs: - name: Fail workflow if tests failed id: check_tests_failed if: contains(join(needs.*.result, ','), 'failure') - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: core.setFailed('Integration Tests Failed!') - name: Fail workflow if tests cancelled id: check_tests_cancelled if: contains(join(needs.*.result, ','), 'cancelled') - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: core.setFailed('Integration Tests Cancelled!') - name: Microsoft Teams Notification - uses: skitionek/notify-microsoft-teams@v1.0.9 + uses: skitionek/notify-microsoft-teams@11e40c38c3a629ae65a985b582eca4897b01e79e # v1.0.9 if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' with: webhook_url: ${{ secrets.MSTEAMS_WEBHOOK }} @@ -556,7 +556,7 @@ jobs: title: "{title: ` ${{ env.run_type }}: ${{ env.date }} `, text: ` ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}`}" - name: Microsoft Teams Notification (Dry Run) - uses: skitionek/notify-microsoft-teams@v1.0.9 + uses: skitionek/notify-microsoft-teams@11e40c38c3a629ae65a985b582eca4897b01e79e # v1.0.9 if: github.ref != 'refs/heads/main' with: webhook_url: NONE diff --git a/.github/workflows/python-lint.yml b/.github/workflows/python-lint.yml index 26a0ac81a99b..133b0b1e6839 100644 --- a/.github/workflows/python-lint.yml +++ b/.github/workflows/python-lint.yml @@ -23,9 +23,9 @@ jobs: UV_CACHE_DIR: /tmp/.uv-cache UV_PYTHON: ${{ matrix.python-version }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -33,7 +33,7 @@ jobs: cache-dependency-glob: "**/uv.lock" - name: Install the project run: uv sync --all-extras --dev - - uses: pre-commit/action@v3.0.1 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 name: Run Pre-Commit Hooks with: extra_args: --config python/.pre-commit-config.yaml --all-files diff --git a/.github/workflows/python-manual-release.yml b/.github/workflows/python-manual-release.yml index 9e520824d667..2d251419602f 100644 --- a/.github/workflows/python-manual-release.yml +++ b/.github/workflows/python-manual-release.yml @@ -18,13 +18,13 @@ jobs: environment: "integration" steps: - name: Azure Login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Start DevOps pipeline - uses: azure/cli@v2 + uses: azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 with: inlineScript: | az pipelines run --id ${{ vars.ADO_PYTHON_RELEASE_ID }} --org ${{ vars.ADO_ORG }} --project ${{ vars.ADO_PROJECT_NAME }} --parameters tag=${{ inputs.tag }} delay=0 diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml index d170055d5f64..923f7a0902bd 100644 --- a/.github/workflows/python-test-coverage-report.yml +++ b/.github/workflows/python-test-coverage-report.yml @@ -20,9 +20,9 @@ jobs: run: working-directory: python steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Download coverage report - uses: actions/download-artifact@v5 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 with: github-token: ${{ github.token }} run-id: ${{ github.event.workflow_run.id }} @@ -44,7 +44,7 @@ jobs: echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV - name: Pytest coverage comment id: coverageComment - uses: MishaKav/pytest-coverage-comment@v1.1.57 + uses: MishaKav/pytest-coverage-comment@1bdbba85fb74a2fdc1ec66383acec1091610f82b # v1.1.57 with: github-token: ${{ github.token }} issue-number: ${{ env.PR_NUMBER }} diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml index 49b0e5392487..7f7e626f6015 100644 --- a/.github/workflows/python-test-coverage.yml +++ b/.github/workflows/python-test-coverage.yml @@ -20,14 +20,14 @@ jobs: env: UV_PYTHON: "3.10" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 # Save the PR number to a file since the workflow_run event # in the coverage report workflow does not have access to it - name: Save PR number run: | echo ${{ github.event.number }} > ./pr_number - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -38,7 +38,7 @@ jobs: - name: Test with pytest run: uv run --frozen pytest -q --junitxml=pytest.xml --cov=semantic_kernel --cov-report=term-missing:skip-covered --cov-report=xml:python-coverage.xml ./tests/unit --ignore=./tests/unit/processes/dapr_runtime - name: Upload coverage report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: path: | python/python-coverage.xml diff --git a/.github/workflows/python-unit-tests.yml b/.github/workflows/python-unit-tests.yml index c354c9550512..762d091f223e 100644 --- a/.github/workflows/python-unit-tests.yml +++ b/.github/workflows/python-unit-tests.yml @@ -39,9 +39,9 @@ jobs: run: working-directory: python steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 with: version: "0.5.x" enable-cache: true @@ -65,7 +65,7 @@ jobs: run: uv run --frozen pytest --junitxml=pytest-dapr.xml ./tests/unit/processes/dapr_runtime - name: Surface failing tests if: ${{ !matrix.experimental && matrix.test-suite == 'unit-all-except-dapr' }} - uses: pmeier/pytest-results-action@v0.7.2 + uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2 with: path: python/pytest.xml summary: true diff --git a/.github/workflows/typos.yaml b/.github/workflows/typos.yaml index 9a27ab8d5dd6..15da8d024841 100644 --- a/.github/workflows/typos.yaml +++ b/.github/workflows/typos.yaml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 persist-credentials: false @@ -28,11 +28,11 @@ jobs: - name: Get changed files id: changed-files if: github.event_name == 'pull_request' - uses: jitterbit/get-changed-files@v1 + uses: jitterbit/get-changed-files@b17fbb00bdc0c0f63fcf166580804b4d2cdc2a42 # v1 continue-on-error: true - name: Use custom config file - uses: crate-ci/typos@v1.44.0 + uses: crate-ci/typos@631208b7aac2daa8b707f55e7331f9112b0e062d # v1.44.0 with: files: ${{ github.event_name == 'pull_request' && steps.changed-files.outputs.added_modified || '.' }} config: .github/_typos.toml