From 679087d48b44af1891cbd1c6628b3852b1a98de0 Mon Sep 17 00:00:00 2001 From: danielhanchen Date: Tue, 25 Aug 2026 00:52:35 +0000 Subject: [PATCH] Pin the unsloth-sd-prebuilt actions to commit SHAs All 18 action references in unsloth-sd-prebuilt.yml resolved through a moving tag, including msvc-dev-cmd and cuda-toolkit, which run in the jobs that build and upload the prebuilt binaries. Each SHA is the commit the corresponding tag points at today, so nothing about what runs changes and no version is bumped. That includes the older majors this workflow pins deliberately, checkout v4, upload-artifact v4, download-artifact v4, setup-python v5 and cuda-toolkit v0.2.22, none of which are moved forward here. Upstream build.yml, close-inactive-issues.yml and stale-prs.yml are left alone so this costs nothing at the next upstream sync. --- .github/workflows/unsloth-sd-prebuilt.yml | 36 +++++++++++------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/unsloth-sd-prebuilt.yml b/.github/workflows/unsloth-sd-prebuilt.yml index e65b9b80d..8d623d526 100644 --- a/.github/workflows/unsloth-sd-prebuilt.yml +++ b/.github/workflows/unsloth-sd-prebuilt.yml @@ -94,7 +94,7 @@ jobs: GH_TOKEN: ${{ github.token }} steps: - name: Checkout this repository with full history, which the tag name is derived from - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.inputs.ref || 'master' }} fetch-depth: 0 @@ -243,7 +243,7 @@ jobs: - name: Upload source artifact if: ${{ steps.r.outputs.exists != 'true' || github.event_name == 'workflow_dispatch' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ steps.r.outputs.source_artifact }} path: ${{ runner.temp }}/sd-source-${{ steps.r.outputs.tag }}.tar.gz @@ -281,13 +281,13 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout mirror (tooling) - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: path: tooling fetch-depth: 1 - name: Download source @ ${{ needs.resolve.outputs.tag }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: ${{ needs.resolve.outputs.source_artifact }} path: srcpkg @@ -331,7 +331,7 @@ jobs: run: python3 tooling/scripts/unsloth/package_bundle.py - name: Upload bundle - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: sd-${{ needs.resolve.outputs.tag }}-bin-${{ matrix.label }} path: dist/sd-${{ needs.resolve.outputs.tag }}-bin-${{ matrix.label }}.zip @@ -362,7 +362,7 @@ jobs: CUDA_ARCHS: "75;80;86;89;90;100;120" steps: - name: Checkout mirror (tooling) - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: path: tooling fetch-depth: 1 @@ -376,7 +376,7 @@ jobs: df -h / - name: Download source @ ${{ needs.resolve.outputs.tag }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: ${{ needs.resolve.outputs.source_artifact }} path: srcpkg @@ -388,7 +388,7 @@ jobs: - name: Install CUDA toolkit id: cuda-toolkit - uses: Jimver/cuda-toolkit@v0.2.22 + uses: Jimver/cuda-toolkit@95b5a29a2823ef87666dcd45ec236fc4f82498d0 # v0.2.22 with: cuda: ${{ env.CUDA_VERSION }} method: "network" @@ -486,7 +486,7 @@ jobs: run: python3 tooling/scripts/unsloth/package_bundle.py - name: Upload bundle - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: sd-${{ needs.resolve.outputs.tag }}-bin-Linux-Ubuntu-22.04-x86_64-cuda12 path: dist/sd-${{ needs.resolve.outputs.tag }}-bin-Linux-Ubuntu-22.04-x86_64-cuda12.zip @@ -508,7 +508,7 @@ jobs: # takes the cancellation path, and that is the most expensive case to # lose (llama.cpp#81). if: ${{ always() }} - uses: actions/cache/save@v6 + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ github.workspace }}/.ccache # Trailing dash keeps this distinct from the key the ccache action @@ -522,13 +522,13 @@ jobs: runs-on: windows-2022 steps: - name: Checkout mirror (tooling) - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: path: tooling fetch-depth: 1 - name: Download source @ ${{ needs.resolve.outputs.tag }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: ${{ needs.resolve.outputs.source_artifact }} path: srcpkg @@ -540,13 +540,13 @@ jobs: mkdir -p src tar -xzf "srcpkg/sd-source-${{ needs.resolve.outputs.tag }}.tar.gz" -C src - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.11" - name: Install Ninja run: choco install ninja --no-progress - name: Setup MSVC - uses: ilammy/msvc-dev-cmd@v1 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 - name: Build sd-cli + sd-server shell: pwsh @@ -574,7 +574,7 @@ jobs: run: python tooling/scripts/unsloth/package_bundle.py - name: Upload bundle - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: sd-${{ needs.resolve.outputs.tag }}-bin-win-cpu-x64 path: dist/sd-${{ needs.resolve.outputs.tag }}-bin-win-cpu-x64.zip @@ -596,13 +596,13 @@ jobs: GH_TOKEN: ${{ github.token }} steps: - name: Checkout mirror (tooling) - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: path: tooling fetch-depth: 1 - name: Download bundles - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: path: dist pattern: sd-*-bin-* @@ -663,7 +663,7 @@ jobs: # human wants the rescue bundle. - name: Upload full set (artifact fallback) if: ${{ always() && !success() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: unsloth-sd-prebuilt-${{ needs.resolve.outputs.tag }} path: dist/*