From 0accaf8bfd322600fcc586da5d4061bbd87d4ffa Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Sat, 3 Oct 2026 04:33:55 -0400 Subject: [PATCH] Float first-party actions on their major; pin third-party to a release SHA Brings the workflow action references in line with the org rule: actions/*, github/* and docker/* float on the major tag of their latest release, and third-party actions are pinned to the commit SHA of their latest release with the version in a trailing comment. 3 reference(s): - release.yml: anchore/sbom-action v0 -> 66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - release.yml: pypa/gh-action-pypi-publish release/v1 -> dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 - release.yml: softprops/action-gh-release v3 -> efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 Pull-request CI does not run these workflows, so the checks below cannot vouch for these references; each was reviewed by hand: - release.yml: pypa/gh-action-pypi-publish release/v1 -> dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 pypi-publish: release/v1 is the v1 branch, so v1.14.2 is the same line pinned. --- .github/workflows/release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 67c6e96..b8399a5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: python -m pip install --upgrade pip build python -m build - name: Generate SBOM for the wheel - uses: anchore/sbom-action@v0 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: path: ./dist format: spdx-json @@ -110,7 +110,7 @@ jobs: cp dist/*.tar.gz dist-pypi/ ls -la dist-pypi/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: packages-dir: dist-pypi/ # We already attest provenance in the build job above. @@ -128,7 +128,7 @@ jobs: name: dist path: dist/ - name: Create release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: generate_release_notes: true files: |