Skip to content

Commit 13a22be

Browse files
mishushakovclaude
mishushakov
and
claude
authored
chore(ci): pin GitHub Actions to commit SHAs (#324)
Pin all 68 external action references across the workflow files to full 40-character commit SHAs, each annotated with a `# vX.Y.Z` comment. No action versions change: every pin is the SHA the existing tag already resolved to. Three refs were previously resolving to mutable branches rather than tags -- changesets/action@v1, denoland/setup-deno@v2 and (before the pnpm 10 upgrade) pnpm/action-setup@v3 -- so a force-push upstream could have silently changed what ran in the release job. Also add the `helpers:pinGitHubActionDigests` Renovate preset so future action updates stay pinned by digest instead of reintroducing floating tags. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 parent d01a605 commit 13a22be

10 files changed

Lines changed: 69 additions & 69 deletions

‎.github/workflows/build_prod_template.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,16 @@ jobs:
3131
runs-on: ubuntu-latest
3232
steps:
3333
- name: Checkout repository
34-
uses: actions/checkout@v4
34+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3535

3636
- name: Parse .tool-versions
37-
uses: wistia/parse-tool-versions@v2.1.1
37+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
3838
with:
3939
filename: '.tool-versions'
4040
uppercase: 'true'
4141
prefix: 'tool_version_'
4242

43-
- uses: actions/setup-python@v6
43+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4444
with:
4545
python-version: '${{ env.TOOL_VERSION_PYTHON }}'
4646

‎.github/workflows/build_test_template.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
template_id: ${{ steps.build-template.outputs.template_id }}
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
2929

3030
- name: Parse .tool-versions
31-
uses: wistia/parse-tool-versions@v2.1.1
31+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
3232
with:
3333
filename: '.tool-versions'
3434
uppercase: 'true'
@@ -41,7 +41,7 @@ jobs:
4141
echo "Version: $VERSION"
4242
sed -i "s/e2b_charts/e2b_charts==${VERSION}/g" requirements.txt
4343
44-
- uses: actions/setup-python@v6
44+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4545
with:
4646
python-version: '${{ env.TOOL_VERSION_PYTHON }}'
4747

‎.github/workflows/charts_tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,22 @@ jobs:
1515
runs-on: ubuntu-22.04
1616
steps:
1717
- name: Checkout repository
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
1919

2020
- name: Parse .tool-versions
21-
uses: wistia/parse-tool-versions@v2.1.1
21+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
2222
with:
2323
filename: '.tool-versions'
2424
uppercase: 'true'
2525
prefix: 'tool_version_'
2626

2727
- name: Set up Python
28-
uses: actions/setup-python@v6
28+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
2929
with:
3030
python-version: '${{ env.TOOL_VERSION_PYTHON }}'
3131

3232
- name: Install and configure Poetry
33-
uses: snok/install-poetry@v1
33+
uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
3434
with:
3535
version: '${{ env.TOOL_VERSION_POETRY }}'
3636
virtualenvs-create: true

‎.github/workflows/js_tests.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,23 @@ jobs:
2525
runs-on: ubuntu-22.04
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
2929

3030
- name: Parse .tool-versions
31-
uses: wistia/parse-tool-versions@v2.1.1
31+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
3232
with:
3333
filename: '.tool-versions'
3434
uppercase: 'true'
3535
prefix: 'tool_version_'
3636

3737
- name: Install pnpm
38-
uses: pnpm/action-setup@v4
38+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
3939
id: pnpm-install
4040
with:
4141
version: ${{ env.TOOL_VERSION_PNPM }}
4242

4343
- name: Setup Node
44-
uses: actions/setup-node@v3
44+
uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
4545
with:
4646
node-version: '${{ env.TOOL_VERSION_NODE }}'
4747
registry-url: "https://registry.npmjs.org"
@@ -67,7 +67,7 @@ jobs:
6767
E2B_TESTS_TEMPLATE: ${{ inputs.E2B_TESTS_TEMPLATE }}
6868

6969
- name: Install Bun
70-
uses: oven-sh/setup-bun@v2
70+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
7171
with:
7272
bun-version: ${{ env.TOOL_VERSION_BUN }}
7373

@@ -79,7 +79,7 @@ jobs:
7979
E2B_TESTS_TEMPLATE: ${{ inputs.E2B_TESTS_TEMPLATE }}
8080

8181
- name: Install Deno
82-
uses: denoland/setup-deno@v2
82+
uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
8383
with:
8484
deno-version: v2.x
8585

‎.github/workflows/lint.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,21 +13,21 @@ jobs:
1313

1414
steps:
1515
- name: Checkout Repo
16-
uses: actions/checkout@v4
16+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
1717

1818
- name: Parse .tool-versions
19-
uses: wistia/parse-tool-versions@v2.1.1
19+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
2020
with:
2121
filename: '.tool-versions'
2222
uppercase: 'true'
2323
prefix: 'tool_version_'
2424

25-
- uses: pnpm/action-setup@v4
25+
- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
2626
with:
2727
version: ${{ env.TOOL_VERSION_PNPM }}
2828

2929
- name: Setup Node.js 20
30-
uses: actions/setup-node@v4
30+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3131
with:
3232
node-version: '${{ env.TOOL_VERSION_NODE }}'
3333
cache: pnpm
@@ -41,12 +41,12 @@ jobs:
4141
run: pnpm install --frozen-lockfile
4242

4343
- name: Set up Python
44-
uses: actions/setup-python@v6
44+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4545
with:
4646
python-version: '${{ env.TOOL_VERSION_PYTHON }}'
4747

4848
- name: Install and configure Poetry
49-
uses: snok/install-poetry@v1
49+
uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
5050
with:
5151
version: '${{ env.TOOL_VERSION_POETRY }}'
5252
virtualenvs-create: true

‎.github/workflows/performance_tests.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,22 +29,22 @@ jobs:
2929
runs-on: ubuntu-22.04
3030
steps:
3131
- name: Checkout repository
32-
uses: actions/checkout@v4
32+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3333

3434
- name: Parse .tool-versions
35-
uses: wistia/parse-tool-versions@v2.1.1
35+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
3636
with:
3737
filename: '.tool-versions'
3838
uppercase: 'true'
3939
prefix: 'tool_version_'
4040

4141
- name: Set up Python
42-
uses: actions/setup-python@v6
42+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4343
with:
4444
python-version: '${{ env.TOOL_VERSION_PYTHON }}'
4545

4646
- name: Install and configure Poetry
47-
uses: snok/install-poetry@v1
47+
uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
4848
with:
4949
version: '${{ env.TOOL_VERSION_POETRY }}'
5050
virtualenvs-create: true
@@ -62,7 +62,7 @@ jobs:
6262
E2B_TESTS_TEMPLATE: ${{ inputs.E2B_TESTS_TEMPLATE }}
6363
E2B_TESTS_BENCHMARK_ITERATIONS_COUNT: ${{ inputs.E2B_TESTS_BENCHMARK_ITERATIONS_COUNT }}
6464
- name: Upload performance plot artifact
65-
uses: actions/upload-artifact@v4
65+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6666
if: always()
6767
with:
6868
name: performance-plot-${{ github.run_number }}

‎.github/workflows/python_tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,22 +25,22 @@ jobs:
2525
runs-on: ubuntu-22.04
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
2929

3030
- name: Parse .tool-versions
31-
uses: wistia/parse-tool-versions@v2.1.1
31+
uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
3232
with:
3333
filename: '.tool-versions'
3434
uppercase: 'true'
3535
prefix: 'tool_version_'
3636

3737
- name: Set up Python
38-
uses: actions/setup-python@v6
38+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
3939
with:
4040
python-version: '${{ env.TOOL_VERSION_PYTHON }}'
4141

4242
- name: Install and configure Poetry
43-
uses: snok/install-poetry@v1
43+
uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
4444
with:
4545
version: '${{ env.TOOL_VERSION_POETRY }}'
4646
virtualenvs-create: true

0 commit comments

Comments
 (0)