Skip to content

Commit 2ee2a83

Browse files
hugovkhugovk
authored
Lock GitHub Actions workflows (#513)
1 parent 16a4a16 commit 2ee2a83

13 files changed

Lines changed: 208 additions & 40 deletions

‎.github/workflows/actions.lock‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.3'
5+
workflows:
6+
'.github/workflows/benchmark.yml':
7+
- 'actions/checkout@v7.0.1'
8+
- 'actions/setup-python@v7.1.0'
9+
- 'codspeedhq/action@v5.6.0'
10+
'.github/workflows/docs.yml':
11+
- 'actions/checkout@v7.0.1'
12+
- 'actions/setup-python@v7.1.0'
13+
- 'astral-sh/setup-uv@v10.3.2'
14+
'.github/workflows/labels.yml':
15+
- 'actions/checkout@v7.0.1'
16+
- 'micnncim/action-label-syncer@v1.3.0'
17+
'.github/workflows/lint.yml':
18+
- 'actions/checkout@v7.0.1'
19+
- 'actions/setup-python@v7.1.0'
20+
- 'astral-sh/setup-uv@v10.3.2'
21+
- 'j178/prek-action@v3.1.0'
22+
'.github/workflows/profile-issue-authors.yml':
23+
- 'astral-sh/setup-uv@v10.3.2'
24+
'.github/workflows/profile-pr-authors.yml':
25+
- 'astral-sh/setup-uv@v10.3.2'
26+
'.github/workflows/release-drafter.yml':
27+
- 'release-drafter/release-drafter@v7.10.0'
28+
'.github/workflows/release.yml':
29+
- 'actions/checkout@v7.0.1'
30+
- 'actions/download-artifact@v8.0.2'
31+
- 'hynek/build-and-inspect-python-package@v3.0.2'
32+
- 'pypa/gh-action-pypi-publish@v1.14.3'
33+
'.github/workflows/require-pr-label.yml':
34+
- 'mheap/github-action-required-labels@v5.6.0'
35+
'.github/workflows/test.yml':
36+
- 'actions/checkout@v7.0.1'
37+
- 'actions/setup-python@v7.1.0'
38+
- 'astral-sh/setup-uv@v10.3.2'
39+
- 'codecov/codecov-action@v7.1.1'
40+
dependencies:
41+
'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8':
42+
ref: 'v4.2.2'
43+
commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
44+
owner_id: 44036562
45+
repo_id: 760702757
46+
uses:
47+
- 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d'
48+
'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d':
49+
ref: 'v4.2.1'
50+
commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
51+
owner_id: 44036562
52+
repo_id: 760701061
53+
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
54+
ref: 'v6.1.0'
55+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
56+
owner_id: 44036562
57+
repo_id: 215566462
58+
'actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7':
59+
ref: 'v5.0.4'
60+
commit: 'sha1-668228422ae6a00e4ad889ee87cd7109ec5666a7'
61+
owner_id: 44036562
62+
repo_id: 215566462
63+
'actions/checkout@v7.0.1':
64+
ref: 'v7.0.1'
65+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
66+
owner_id: 44036562
67+
repo_id: 197814629
68+
'actions/download-artifact@v8.0.2':
69+
ref: 'v8.0.2'
70+
commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
71+
owner_id: 44036562
72+
repo_id: 192626254
73+
'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
74+
ref: 'v8.0.0'
75+
commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
76+
owner_id: 44036562
77+
repo_id: 205262760
78+
'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97':
79+
ref: 'v7.0.0'
80+
commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97'
81+
owner_id: 44036562
82+
repo_id: 192625525
83+
'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405':
84+
ref: 'v6.2.0'
85+
commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
86+
owner_id: 44036562
87+
repo_id: 192625525
88+
'actions/setup-python@v7.1.0':
89+
ref: 'v7.1.0'
90+
commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0'
91+
owner_id: 44036562
92+
repo_id: 192625525
93+
'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
94+
ref: 'v7.0.2'
95+
commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
96+
owner_id: 44036562
97+
repo_id: 192625955
98+
'astral-sh/setup-uv@v10.3.2':
99+
ref: 'v10.3.2'
100+
commit: 'sha1-07a047e608db84b3d8c06cd9a7c7dcc9c355c18e'
101+
owner_id: 115962839
102+
repo_id: 846733598
103+
'codecov/codecov-action@v7.1.1':
104+
ref: 'v7.1.1'
105+
commit: 'sha1-303a32d7a59b442fa8d48b6a1cc6825c09c847a5'
106+
owner_id: 8226205
107+
repo_id: 200299178
108+
uses:
109+
- 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
110+
'codspeedhq/action@v5.6.0':
111+
ref: 'v5.6.0'
112+
commit: 'sha1-78102a468f96d8e0ccb92d0ec49425753fc42062'
113+
owner_id: 116658140
114+
repo_id: 561699778
115+
uses:
116+
- 'actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7'
117+
- 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
118+
'hynek/build-and-inspect-python-package@v3.0.2':
119+
ref: 'v3.0.2'
120+
commit: 'sha1-67230f7b8410ae0052b39c1efc89d89fff43ff10'
121+
owner_id: 41240
122+
repo_id: 526525235
123+
uses:
124+
- 'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8'
125+
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
126+
- 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97'
127+
- 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
128+
'j178/prek-action@v3.1.0':
129+
ref: 'v3.1.0'
130+
commit: 'sha1-44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d'
131+
owner_id: 10510431
132+
repo_id: 1052387486
133+
'mheap/github-action-required-labels@v5.6.0':
134+
ref: 'v5.6.0'
135+
commit: 'sha1-23e10fde7e062233401931a0eece796cd9bf3177'
136+
owner_id: 59130
137+
repo_id: 272521528
138+
'micnncim/action-label-syncer@v1.3.0':
139+
ref: 'v1.3.0'
140+
commit: 'sha1-3abd5ab72fda571e69fffd97bd4e0033dd5f495c'
141+
owner_id: 21333876
142+
repo_id: 214834296
143+
'pypa/gh-action-pypi-publish@v1.14.3':
144+
ref: 'v1.14.3'
145+
commit: 'sha1-7245906fb61fa33a13554f9d5fb856fe61758086'
146+
owner_id: 647025
147+
repo_id: 178055147
148+
uses:
149+
- 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405'
150+
'release-drafter/release-drafter@v7.10.0':
151+
ref: 'v7.10.0'
152+
commit: 'sha1-978bb0b30c5ee8cdd332ced253758157150d43f0'
153+
owner_id: 58292376
154+
repo_id: 139022359

‎.github/workflows/benchmark.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@ jobs:
1212
benchmarks:
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
15+
- uses: actions/checkout@v7.0.1
1616
with:
1717
persist-credentials: false
1818

1919
- name: Set up Python
20-
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
20+
uses: actions/setup-python@v7.1.0
2121
with:
2222
python-version: "3.15"
2323
allow-prereleases: true
@@ -34,7 +34,7 @@ jobs:
3434
run: pip install -e ".[tests]"
3535

3636
- name: Run benchmarks
37-
uses: CodSpeedHQ/action@78102a468f96d8e0ccb92d0ec49425753fc42062 # v5.6.0
37+
uses: CodSpeedHQ/action@v5.6.0
3838
with:
3939
mode: simulation
4040
run: pytest tests/test_benchmarks.py --codspeed

‎.github/workflows/docs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,17 @@ jobs:
1212
runs-on: ubuntu-latest
1313

1414
steps:
15-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
15+
- uses: actions/checkout@v7.0.1
1616
with:
1717
persist-credentials: false
1818

1919
- name: Set up Python
20-
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
20+
uses: actions/setup-python@v7.1.0
2121
with:
2222
python-version: "3.x"
2323

2424
- name: Install uv
25-
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
25+
uses: astral-sh/setup-uv@v10.3.2
2626

2727
- name: Docs
2828
run: |

‎.github/workflows/labels.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ jobs:
1414
pull-requests: write
1515
runs-on: ubuntu-slim
1616
steps:
17-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
17+
- uses: actions/checkout@v7.0.1
1818
with:
1919
persist-credentials: false
20-
- uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
20+
- uses: micnncim/action-label-syncer@v1.3.0
2121
with:
2222
prune: false
2323
env:

‎.github/workflows/lint.yml‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,36 @@ jobs:
1313
runs-on: ubuntu-latest
1414

1515
steps:
16-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
16+
- uses: actions/checkout@v7.0.1
1717
with:
1818
persist-credentials: false
19-
- uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d # v3.1.0
19+
- uses: j178/prek-action@v3.1.0
2020

2121
mypy:
2222
runs-on: ubuntu-latest
2323

2424
steps:
25-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
25+
- uses: actions/checkout@v7.0.1
2626
with:
2727
persist-credentials: false
28-
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
28+
- uses: actions/setup-python@v7.1.0
2929
with:
3030
python-version: "3.x"
3131
- name: Install uv
32-
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
32+
uses: astral-sh/setup-uv@v10.3.2
3333
- name: Mypy
3434
run: uvx --with tox-uv tox -e mypy
35+
36+
# Fails when .github/workflows/actions.lock is out of sync with the
37+
# workflows or a locked pin no longer verifies upstream.
38+
lockfile:
39+
runs-on: ubuntu-slim
40+
env:
41+
GH_TOKEN: ${{ github.token }}
42+
43+
steps:
44+
- uses: actions/checkout@v7.0.1
45+
with:
46+
persist-credentials: false
47+
- run: gh extension install github/gh-actions-lock --pin v0.4.1
48+
- run: gh actions-lock --verify

‎.github/workflows/profile-issue-authors.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: ubuntu-latest
2020

2121
steps:
22-
- uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
22+
- uses: astral-sh/setup-uv@v10.3.2
2323
with:
2424
enable-cache: false
2525
ignore-empty-workdir: true

‎.github/workflows/profile-pr-authors.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121

2222
steps:
23-
- uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
23+
- uses: astral-sh/setup-uv@v10.3.2
2424
with:
2525
enable-cache: false
2626
ignore-empty-workdir: true

‎.github/workflows/release-drafter.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
runs-on: ubuntu-slim
2626
steps:
2727
# Drafts your next release notes as pull requests are merged into "main"
28-
- uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
28+
- uses: release-drafter/release-drafter@v7.10.0
2929

3030
autolabeler:
3131
if: |
@@ -36,4 +36,4 @@ jobs:
3636
pull-requests: write
3737
runs-on: ubuntu-slim
3838
steps:
39-
- uses: release-drafter/release-drafter/autolabeler@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
39+
- uses: release-drafter/release-drafter/autolabeler@v7.10.0

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on: ubuntu-latest
2424

2525
steps:
26-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26+
- uses: actions/checkout@v7.0.1
2727
with:
2828
fetch-depth: 0
2929
persist-credentials: false
@@ -36,7 +36,7 @@ jobs:
3636
run: |
3737
scripts/generate-translation-binaries.sh
3838
39-
- uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
39+
- uses: hynek/build-and-inspect-python-package@v3.0.2
4040

4141
# Upload to Test PyPI on every commit on main.
4242
release-test-pypi:
@@ -53,13 +53,13 @@ jobs:
5353

5454
steps:
5555
- name: Download packages built by build-and-inspect-python-package
56-
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
56+
uses: actions/download-artifact@v8.0.2
5757
with:
5858
name: Packages
5959
path: dist
6060

6161
- name: Upload package to Test PyPI
62-
uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
62+
uses: pypa/gh-action-pypi-publish@v1.14.3
6363
with:
6464
repository-url: https://test.pypi.org/legacy/
6565

@@ -77,10 +77,10 @@ jobs:
7777

7878
steps:
7979
- name: Download packages built by build-and-inspect-python-package
80-
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
80+
uses: actions/download-artifact@v8.0.2
8181
with:
8282
name: Packages
8383
path: dist
8484

8585
- name: Upload package to PyPI
86-
uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
86+
uses: pypa/gh-action-pypi-publish@v1.14.3

‎.github/workflows/require-pr-label.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
pull-requests: write
1414

1515
steps:
16-
- uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
16+
- uses: mheap/github-action-required-labels@v5.6.0
1717
with:
1818
mode: minimum
1919
count: 1

0 commit comments

Comments
 (0)