Skip to content

Commit 1e7f306

Browse files
kevinjqliukevinjqliu
authored
chore(ci): pin actions in non-PR-triggered workflows (#3193)
## What changed - Pinned external GitHub Actions to full commit SHAs in non-PR-triggered workflows: - `.github/workflows/nightly-pypi-build.yml` - `.github/workflows/pypi-build-artifacts.yml` - `.github/workflows/python-release-docs.yml` - `.github/workflows/python-release.yml` - `.github/workflows/stale.yml` - `.github/workflows/svn-build-artifacts.yml` - Updated one command in `pypi-build-artifacts.yml` from expression interpolation to shell env usage: - `uv version "${{ env.VERSION }}"` -> `uv version "$VERSION"` ## Why - Fixes `zizmor` findings for `unpinned-uses` by replacing mutable refs with immutable SHAs. - Reduces supply-chain risk from tag/branch drift while preserving workflow behavior. - Fixes `template-injection` warning by avoiding direct expression expansion inside `run`. ## Verification - `uvx --from zizmor zizmor --offline .github/workflows/ --fix=all` - Result: `No findings to report.`
1 parent d87fdc7 commit 1e7f306

6 files changed

Lines changed: 39 additions & 23 deletions

File tree

‎.github/workflows/nightly-pypi-build.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@ jobs:
3434
outputs:
3535
VERSION: ${{ steps.set-version.outputs.VERSION }}
3636
steps:
37-
- uses: actions/checkout@v6
37+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3838
with:
3939
fetch-depth: 1
40+
persist-credentials: false
4041

41-
- uses: actions/setup-python@v6
42+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4243
with:
4344
python-version: 3.12
4445

@@ -53,7 +54,9 @@ jobs:
5354
echo "VERSION=${CURRENT_VERSION}.dev${TIMESTAMP}" >> "$GITHUB_OUTPUT"
5455
5556
- name: Debug version
56-
run: echo "Publishing version ${{ steps.set-version.outputs.VERSION }}"
57+
run: echo "Publishing version ${STEPS_SET_VERSION_OUTPUTS_VERSION}"
58+
env:
59+
STEPS_SET_VERSION_OUTPUTS_VERSION: ${{ steps.set-version.outputs.VERSION }}
5760

5861
nightly-build:
5962
needs: set-version
@@ -74,7 +77,7 @@ jobs:
7477

7578
steps:
7679
- name: Download all the artifacts
77-
uses: actions/download-artifact@v8
80+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
7881
with:
7982
merge-multiple: true
8083
path: dist/
@@ -83,7 +86,7 @@ jobs:
8386
- name: Publish to TestPyPI
8487
id: publish-testpypi
8588
continue-on-error: true
86-
uses: pypa/gh-action-pypi-publish@release/v1
89+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
8790
with:
8891
repository-url: https://test.pypi.org/legacy/
8992
skip-existing: true

‎.github/workflows/pypi-build-artifacts.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,12 @@ jobs:
3939
os: [ ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest ]
4040

4141
steps:
42-
- uses: actions/checkout@v6
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4343
with:
4444
fetch-depth: 1
45+
persist-credentials: false
4546

46-
- uses: actions/setup-python@v6
47+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4748
with:
4849
python-version: |
4950
3.10
@@ -57,7 +58,7 @@ jobs:
5758
- name: Set version with RC
5859
env:
5960
VERSION: ${{ inputs.VERSION }}
60-
run: uv version "${{ env.VERSION }}"
61+
run: uv version "$VERSION"
6162

6263
# Publish the source distribution with the version that's in
6364
# the repository, otherwise the tests will fail
@@ -86,7 +87,7 @@ jobs:
8687
if: matrix.os == 'ubuntu-latest'
8788
run: ls -lah dist/* && cp dist/* wheelhouse/
8889

89-
- uses: actions/upload-artifact@v4
90+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
9091
with:
9192
name: "pypi-release-candidate-${{ matrix.os }}"
9293
path: ./wheelhouse/*
@@ -97,7 +98,7 @@ jobs:
9798
- pypi-build-artifacts
9899
steps:
99100
- name: Merge Artifacts
100-
uses: actions/upload-artifact/merge@v4
101+
uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
101102
with:
102103
name: "pypi-release-candidate-${{ inputs.VERSION }}"
103104
pattern: pypi-release-candidate*

‎.github/workflows/python-release-docs.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,10 @@ jobs:
3535
contents: write
3636

3737
steps:
38-
- uses: actions/checkout@v6
39-
- uses: actions/setup-python@v6
38+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
39+
with:
40+
persist-credentials: false
41+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4042
with:
4143
python-version: 3.12
4244
- name: Install UV

‎.github/workflows/python-release.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,8 @@ jobs:
6262
fi
6363
else
6464
echo "Workflow triggered manually via workflow_dispatch."
65-
VERSION="${{ github.event.inputs.version }}"
66-
RC="${{ github.event.inputs.rc }}"
65+
VERSION="${GITHUB_EVENT_INPUTS_VERSION}"
66+
RC="${GITHUB_EVENT_INPUTS_RC}"
6767
6868
# Validate version (e.g., 1.0.0)
6969
if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -81,27 +81,36 @@ jobs:
8181
# Export variables for future steps
8282
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
8383
echo "RC=$RC" >> $GITHUB_OUTPUT
84+
env:
85+
GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}
86+
GITHUB_EVENT_INPUTS_RC: ${{ github.event.inputs.rc }}
8487

8588
- name: Display Extracted Version and RC
8689
run: |
87-
echo "Using Version: ${{ steps.validate-inputs.outputs.VERSION }}"
88-
echo "Using RC: ${{ steps.validate-inputs.outputs.RC }}"
90+
echo "Using Version: ${STEPS_VALIDATE_INPUTS_OUTPUTS_VERSION}"
91+
echo "Using RC: ${STEPS_VALIDATE_INPUTS_OUTPUTS_RC}"
92+
env:
93+
STEPS_VALIDATE_INPUTS_OUTPUTS_VERSION: ${{ steps.validate-inputs.outputs.VERSION }}
94+
STEPS_VALIDATE_INPUTS_OUTPUTS_RC: ${{ steps.validate-inputs.outputs.RC }}
8995

9096
validate-library-version:
9197
runs-on: ubuntu-latest
9298
needs:
9399
- validate-inputs
94100
steps:
95-
- uses: actions/checkout@v6
101+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
96102
with:
97103
fetch-depth: 1
104+
persist-credentials: false
98105

99-
- uses: actions/setup-python@v6
106+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
100107
with:
101108
python-version: 3.12
102109

103110
- name: Install UV
104111
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
112+
with:
113+
enable-cache: false
105114

106115
- name: Validate current pyiceberg version
107116
env:

‎.github/workflows/stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
if: github.repository_owner == 'apache'
3333
runs-on: ubuntu-latest
3434
steps:
35-
- uses: actions/stale@v10.2.0
35+
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
3636
with:
3737
# stale issues
3838
stale-issue-label: 'stale,security'

‎.github/workflows/svn-build-artifacts.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,12 @@ jobs:
3939
os: [ ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest ]
4040

4141
steps:
42-
- uses: actions/checkout@v6
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4343
with:
4444
fetch-depth: 1
45+
persist-credentials: false
4546

46-
- uses: actions/setup-python@v6
47+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4748
with:
4849
python-version: |
4950
3.10
@@ -78,7 +79,7 @@ jobs:
7879
if: matrix.os == 'ubuntu-latest'
7980
run: ls -lah dist/* && cp dist/* wheelhouse/
8081

81-
- uses: actions/upload-artifact@v4
82+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
8283
with:
8384
name: "svn-release-candidate-${{ matrix.os }}"
8485
path: ./wheelhouse/*
@@ -89,7 +90,7 @@ jobs:
8990
- svn-build-artifacts
9091
steps:
9192
- name: Merge Artifacts
92-
uses: actions/upload-artifact/merge@v4
93+
uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
9394
with:
9495
name: "svn-release-candidate-${{ inputs.VERSION }}"
9596
pattern: svn-release-candidate*

0 commit comments

Comments
 (0)