Skip to content

chore: Pin GitHub actions by hash #578

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
effigies wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore: Pin GitHub actions by hash #578

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions .github/workflows/build_test_deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
attestations: write
id-token: write
steps:
- uses: actions/checkout@v6.0.1
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
persist-credentials: false
Expand All @@ -56,7 +56,7 @@ jobs:
# or https://github.com/hynek/build-and-inspect-python-package/issues/155
- name: Clean up baipp virtualenv path (main build)
run: rm -rf /tmp/baipp
- uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2
- uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
id: build-smriprep
with:
upload-name-suffix: -main
Expand All @@ -67,7 +67,7 @@ jobs:
DIST: ${{ steps.build-smriprep.outputs.dist }}
- name: Clean up baipp virtualenv path (wrapper build)
run: rm -rf /tmp/baipp
- uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2
- uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
id: build-wrapper
with:
path: wrapper
Expand Down Expand Up @@ -100,21 +100,21 @@ jobs:
DEPENDS: ${{ matrix.dependencies }}

steps:
- uses: actions/checkout@v6.0.1
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install the latest version of uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Display Python version
run: python -c "import sys; print(sys.version)"

- name: Restore cached templateflow
id: tf-cache-restore
uses: actions/cache@v5
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: /tmp/templateflow
key: templateflow-v0
Expand Down Expand Up @@ -153,7 +153,7 @@ jobs:

echo "Pre-release tox failed after 3 attempts."
exit 1
- uses: codecov/codecov-action@v5
- uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
fail_ci_if_error: ${{ github.event_name == 'push' }}
Expand All @@ -173,21 +173,21 @@ jobs:

steps:
- name: Download packages built by build-and-inspect-python-package
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: Packages-*
path: dist
- run: ls -lR

- name: Install the latest version of uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Restore cached templateflow
id: tf-cache-restore
uses: actions/cache@v5
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: /tmp/templateflow
key: templateflow-v0
Expand All @@ -210,7 +210,7 @@ jobs:
run: tox c
- name: Run tox
run: tox -v --exit-and-dump-after 1800
- uses: codecov/codecov-action@v5
- uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
fail_ci_if_error: ${{ github.event_name == 'push' }}
Expand All @@ -228,18 +228,18 @@ jobs:

steps:
- name: Download packages built by build-and-inspect-python-package
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: Packages-*
path: dist

- name: Upload package to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
with:
packages-dir: dist/Packages-main/

- name: Upload package to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
with:
packages-dir: dist/Packages-wrapper/

Expand All @@ -251,11 +251,11 @@ jobs:
check: ["style", "spellcheck"]

steps:
- uses: actions/checkout@v6.0.1
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install the latest version of uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
- name: Install tox
run: uv tool install tox --with=tox-uv
- name: Show tox config
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,21 +25,21 @@ jobs:
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 200
fetch-tags: true
ref: ${{ github.ref }}
persist-credentials: false

- name: Setup Docker buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
driver: docker

- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
Expand All @@ -63,7 +63,7 @@ jobs:

- name: Build base image
if: steps.base.outputs.build == 'true'
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
file: Dockerfile.base
load: true
Expand All @@ -78,12 +78,12 @@ jobs:

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

- name: Build and push Docker image
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
push: ${{ github.event_name != 'pull_request' }}
Expand Down
22 changes: 11 additions & 11 deletions .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
force_versioned: ${{ steps.resolve.outputs.force_versioned }}
steps:
- name: Checkout repository for ref and tag resolution
uses: actions/checkout@v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
fetch-tags: true
Expand Down Expand Up @@ -153,7 +153,7 @@ jobs:
has_versioned_docs: ${{ steps.has-versioned.outputs.has_versioned_docs }}
steps:
- name: Checkout source revision
uses: actions/checkout@v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
fetch-tags: true
Expand All @@ -166,7 +166,7 @@ jobs:
sudo apt -y install graphviz

- name: Set up Python 3.12
uses: actions/setup-python@v6
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"

Expand All @@ -180,7 +180,7 @@ jobs:
run: make -C docs NO_ET=1 SPHINXOPTS="-W" BUILDDIR="_build/no_version_html" html

- name: Upload unversioned docs artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: docs-unversioned-html
path: docs/_build/no_version_html/html
Expand Down Expand Up @@ -210,7 +210,7 @@ jobs:
- name: Restore versioned docs cache
if: steps.versioned.outputs.build_versioned == 'true'
id: docs-cache-restore
uses: actions/cache/restore@v5
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: docs/_build
key: docs-v2-${{ needs.resolve_context.outputs.source_ref_name }}-${{ needs.resolve_context.outputs.source_sha }}
Expand All @@ -227,14 +227,14 @@ jobs:

- name: Save versioned docs cache
if: steps.versioned.outputs.build_versioned == 'true' && steps.docs-cache-restore.outputs.cache-hit != 'true'
uses: actions/cache/save@v5
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: docs/_build
key: docs-v2-${{ needs.resolve_context.outputs.source_ref_name }}-${{ needs.resolve_context.outputs.source_sha }}

- name: Upload versioned docs artifact
if: steps.versioned.outputs.build_versioned == 'true'
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: docs-versioned-html
path: docs/_build/html
Expand All @@ -256,7 +256,7 @@ jobs:
contents: write
steps:
- name: Download versioned docs artifact
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: docs-versioned-html
path: /tmp/docs-site
Expand All @@ -273,7 +273,7 @@ jobs:
printf 'docs_root=%s\n' "$docs_root" >> "$GITHUB_OUTPUT"

- name: Checkout gh-pages branch
uses: actions/checkout@v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: gh-pages
fetch-depth: 0
Expand Down Expand Up @@ -309,7 +309,7 @@ jobs:
contents: write
steps:
- name: Download versioned docs artifact
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: docs-versioned-html
path: /tmp/docs-site
Expand All @@ -326,7 +326,7 @@ jobs:
printf 'docs_root=%s\n' "$docs_root" >> "$GITHUB_OUTPUT"

- name: Checkout gh-pages branch
uses: actions/checkout@v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: gh-pages
fetch-depth: 0
Expand Down
Loading