From 9a85ac37bd93a13e08fcbe3b52187009903d9468 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 26 Jun 2026 16:19:05 +0100 Subject: [PATCH 1/2] chore(ci): upgrade GitHub Actions to latest major versions Align all workflows to the latest action majors for consistency and security improvements (closes #461): - actions/checkout v6 -> v7 (blocks unsafe fork-PR checkout by default) - astral-sh/setup-uv v7 -> v8 (pinned to v8.2.0; v8 drops floating major/minor tags, so only full-version or SHA refs resolve) - actions/setup-node v4 -> v6 (explicit `cache: pnpm` still supported; the v6 break only affects implicit cache auto-detection) - pnpm/action-setup v4 -> v6 - actions/cache v4 -> v6 setup-go, setup-python, golangci-lint-action, upload/download-artifact, and the docker/* actions were already on their latest majors. --- .github/workflows/ci-cli.yaml | 4 ++-- .github/workflows/ci-licenses.yaml | 2 +- .github/workflows/ci-prompts-sync.yaml | 2 +- .github/workflows/ci-schema.yaml | 12 +++++------ .github/workflows/ci-sdk-go.yaml | 8 ++++---- .github/workflows/ci-sdk-python.yaml | 12 +++++------ .github/workflows/ci-server-embeddings.yaml | 22 ++++++++++----------- .github/workflows/ci-server.yaml | 20 +++++++++---------- .github/workflows/docs.yaml | 4 ++-- .github/workflows/release-cli.yaml | 4 ++-- .github/workflows/release-schema.yaml | 4 ++-- .github/workflows/release-sdk-python.yaml | 4 ++-- .github/workflows/release-server-image.yaml | 2 +- .github/workflows/validate-cli-release.yaml | 2 +- 14 files changed, 51 insertions(+), 51 deletions(-) diff --git a/.github/workflows/ci-cli.yaml b/.github/workflows/ci-cli.yaml index f81392b5..c28760e1 100644 --- a/.github/workflows/ci-cli.yaml +++ b/.github/workflows/ci-cli.yaml @@ -23,7 +23,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: @@ -48,7 +48,7 @@ jobs: needs: [lint] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: diff --git a/.github/workflows/ci-licenses.yaml b/.github/workflows/ci-licenses.yaml index 29c8a038..aae3ccba 100644 --- a/.github/workflows/ci-licenses.yaml +++ b/.github/workflows/ci-licenses.yaml @@ -37,7 +37,7 @@ jobs: licenses: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: diff --git a/.github/workflows/ci-prompts-sync.yaml b/.github/workflows/ci-prompts-sync.yaml index 28176f44..300572c5 100644 --- a/.github/workflows/ci-prompts-sync.yaml +++ b/.github/workflows/ci-prompts-sync.yaml @@ -31,7 +31,7 @@ jobs: name: Check prompt copies match sources runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Verify SDK prompt copies match plugin sources run: | diff --git a/.github/workflows/ci-schema.yaml b/.github/workflows/ci-schema.yaml index fe5670eb..394a656e 100644 --- a/.github/workflows/ci-schema.yaml +++ b/.github/workflows/ci-schema.yaml @@ -21,9 +21,9 @@ jobs: name: Validate schemas and values file runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Validate fixtures and values against schemas run: make validate-schema @@ -32,7 +32,7 @@ jobs: name: Lint Go module runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: @@ -49,7 +49,7 @@ jobs: needs: [validate, lint-go] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: @@ -67,9 +67,9 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ci-sdk-go.yaml b/.github/workflows/ci-sdk-go.yaml index 2236957a..797cf2e6 100644 --- a/.github/workflows/ci-sdk-go.yaml +++ b/.github/workflows/ci-sdk-go.yaml @@ -23,9 +23,9 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -34,7 +34,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: @@ -59,7 +59,7 @@ jobs: needs: [schema, lint] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: diff --git a/.github/workflows/ci-sdk-python.yaml b/.github/workflows/ci-sdk-python.yaml index 8d6820c7..10c83039 100644 --- a/.github/workflows/ci-sdk-python.yaml +++ b/.github/workflows/ci-sdk-python.yaml @@ -22,9 +22,9 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -33,9 +33,9 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true @@ -50,9 +50,9 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ci-server-embeddings.yaml b/.github/workflows/ci-server-embeddings.yaml index dd3d9c7c..288d098c 100644 --- a/.github/workflows/ci-server-embeddings.yaml +++ b/.github/workflows/ci-server-embeddings.yaml @@ -22,11 +22,11 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -35,19 +35,19 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v6 with: version: 10 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: 22 cache: pnpm @@ -64,18 +64,18 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v6 with: version: 10 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: 22 cache: pnpm @@ -83,7 +83,7 @@ jobs: - name: Cache ModernBERT encoderfile id: cache-modernbert-encoderfile - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ github.workspace }}/.cache/encoderfiles key: ${{ runner.os }}-modernbert-encoderfile-v1 diff --git a/.github/workflows/ci-server.yaml b/.github/workflows/ci-server.yaml index 0f3bdae2..744972ec 100644 --- a/.github/workflows/ci-server.yaml +++ b/.github/workflows/ci-server.yaml @@ -22,9 +22,9 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -33,17 +33,17 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v6 with: version: 10 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: 22 cache: pnpm @@ -60,18 +60,18 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v6 with: version: 10 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: 22 cache: pnpm diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 8df06b33..e16951f1 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -31,7 +31,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: persist-credentials: false @@ -79,7 +79,7 @@ jobs: echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - name: Check out the repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ steps.tag.outputs.tag }} fetch-depth: 0 diff --git a/.github/workflows/release-cli.yaml b/.github/workflows/release-cli.yaml index d4db8967..f4d36376 100644 --- a/.github/workflows/release-cli.yaml +++ b/.github/workflows/release-cli.yaml @@ -65,7 +65,7 @@ jobs: echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ steps.tag.outputs.tag }} @@ -175,7 +175,7 @@ jobs: run: gh release upload "$TAG" dist/*.tar.gz dist/*.zip dist/checksums.txt --repo "$GITHUB_REPOSITORY" - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ steps.tag.outputs.tag }} sparse-checkout: build/brew diff --git a/.github/workflows/release-schema.yaml b/.github/workflows/release-schema.yaml index e65bc00d..ab6efb23 100644 --- a/.github/workflows/release-schema.yaml +++ b/.github/workflows/release-schema.yaml @@ -47,11 +47,11 @@ jobs: echo "version=${VERSION}" >> "$GITHUB_OUTPUT" echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ steps.tag.outputs.tag }} - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Sync canonical schemas into the package run: make sync-schema diff --git a/.github/workflows/release-sdk-python.yaml b/.github/workflows/release-sdk-python.yaml index 4dd769bf..052d89f4 100644 --- a/.github/workflows/release-sdk-python.yaml +++ b/.github/workflows/release-sdk-python.yaml @@ -44,11 +44,11 @@ jobs: echo "version=${VERSION}" >> "$GITHUB_OUTPUT" echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ steps.tag.outputs.tag }} - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@v8.2.0 - name: Set package version working-directory: sdk/python diff --git a/.github/workflows/release-server-image.yaml b/.github/workflows/release-server-image.yaml index 2c7f95d4..ee2d2641 100644 --- a/.github/workflows/release-server-image.yaml +++ b/.github/workflows/release-server-image.yaml @@ -64,7 +64,7 @@ jobs: fi - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ github.event.release.tag_name || github.event.inputs.tag }} diff --git a/.github/workflows/validate-cli-release.yaml b/.github/workflows/validate-cli-release.yaml index 72dfc5fe..5be6e4c5 100644 --- a/.github/workflows/validate-cli-release.yaml +++ b/.github/workflows/validate-cli-release.yaml @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Go uses: actions/setup-go@v6 From e8b865fd303bafdc841ceea9555bda54f4d95776 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 26 Jun 2026 16:20:59 +0100 Subject: [PATCH 2/2] ci: pin GitHub Actions to commit SHAs and disable credential persistence Replace every floating action tag (mutable git refs that a compromised maintainer can silently retarget) with the full 40-char commit SHA, keeping the human-readable version in a trailing comment so Dependabot can still bump them. Add persist-credentials: false to every checkout step so the GITHUB_TOKEN is not written to the runner's git config, shrinking the blast radius if a later step is compromised (closes #467). No checkout relies on the persisted credentials: the only git push runs against a separately cloned repo using an explicit token. --- .github/workflows/ci-cli.yaml | 14 +++++++---- .github/workflows/ci-licenses.yaml | 6 +++-- .github/workflows/ci-prompts-sync.yaml | 4 +++- .github/workflows/ci-schema.yaml | 26 ++++++++++++++------- .github/workflows/ci-sdk-go-postgres.yaml | 14 +++++++---- .github/workflows/ci-sdk-go.yaml | 20 ++++++++++------ .github/workflows/ci-sdk-python.yaml | 18 +++++++++----- .github/workflows/ci-server-embeddings.yaml | 24 ++++++++++--------- .github/workflows/ci-server.yaml | 26 +++++++++++++-------- .github/workflows/docs.yaml | 9 +++---- .github/workflows/release-cli.yaml | 14 ++++++----- .github/workflows/release-schema.yaml | 7 +++--- .github/workflows/release-sdk-python.yaml | 7 +++--- .github/workflows/release-server-image.yaml | 13 ++++++----- .github/workflows/validate-cli-release.yaml | 6 +++-- 15 files changed, 128 insertions(+), 80 deletions(-) diff --git a/.github/workflows/ci-cli.yaml b/.github/workflows/ci-cli.yaml index c28760e1..bf3be346 100644 --- a/.github/workflows/ci-cli.yaml +++ b/.github/workflows/ci-cli.yaml @@ -23,14 +23,16 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: cli/go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 with: version: v2.10.1 working-directory: cli @@ -48,9 +50,11 @@ jobs: needs: [lint] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: cli/go.mod diff --git a/.github/workflows/ci-licenses.yaml b/.github/workflows/ci-licenses.yaml index aae3ccba..343e09d1 100644 --- a/.github/workflows/ci-licenses.yaml +++ b/.github/workflows/ci-licenses.yaml @@ -37,9 +37,11 @@ jobs: licenses: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: cli/go.mod diff --git a/.github/workflows/ci-prompts-sync.yaml b/.github/workflows/ci-prompts-sync.yaml index 300572c5..2001a292 100644 --- a/.github/workflows/ci-prompts-sync.yaml +++ b/.github/workflows/ci-prompts-sync.yaml @@ -31,7 +31,9 @@ jobs: name: Check prompt copies match sources runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Verify SDK prompt copies match plugin sources run: | diff --git a/.github/workflows/ci-schema.yaml b/.github/workflows/ci-schema.yaml index 394a656e..df2d80ca 100644 --- a/.github/workflows/ci-schema.yaml +++ b/.github/workflows/ci-schema.yaml @@ -21,9 +21,11 @@ jobs: name: Validate schemas and values file runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Validate fixtures and values against schemas run: make validate-schema @@ -32,14 +34,16 @@ jobs: name: Lint Go module runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: schema/go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 with: version: v2.10.1 working-directory: schema @@ -49,9 +53,11 @@ jobs: needs: [validate, lint-go] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: schema/go.mod @@ -67,9 +73,11 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ci-sdk-go-postgres.yaml b/.github/workflows/ci-sdk-go-postgres.yaml index 514e0bc2..cab19ec7 100644 --- a/.github/workflows/ci-sdk-go-postgres.yaml +++ b/.github/workflows/ci-sdk-go-postgres.yaml @@ -25,14 +25,16 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: sdk/go/stores/postgres/go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 with: version: v2.10.1 working-directory: sdk/go/stores/postgres @@ -50,9 +52,11 @@ jobs: needs: [lint] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: sdk/go/stores/postgres/go.mod diff --git a/.github/workflows/ci-sdk-go.yaml b/.github/workflows/ci-sdk-go.yaml index 797cf2e6..43b3e281 100644 --- a/.github/workflows/ci-sdk-go.yaml +++ b/.github/workflows/ci-sdk-go.yaml @@ -23,9 +23,11 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -34,14 +36,16 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: sdk/go/go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 with: version: v2.10.1 working-directory: sdk/go @@ -59,9 +63,11 @@ jobs: needs: [schema, lint] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: sdk/go/go.mod diff --git a/.github/workflows/ci-sdk-python.yaml b/.github/workflows/ci-sdk-python.yaml index 10c83039..d23e5821 100644 --- a/.github/workflows/ci-sdk-python.yaml +++ b/.github/workflows/ci-sdk-python.yaml @@ -22,9 +22,11 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -33,9 +35,11 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true @@ -50,9 +54,11 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ci-server-embeddings.yaml b/.github/workflows/ci-server-embeddings.yaml index 288d098c..30f65c79 100644 --- a/.github/workflows/ci-server-embeddings.yaml +++ b/.github/workflows/ci-server-embeddings.yaml @@ -22,11 +22,11 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -35,19 +35,19 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 10 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 cache: pnpm @@ -64,18 +64,20 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 10 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 cache: pnpm @@ -83,7 +85,7 @@ jobs: - name: Cache ModernBERT encoderfile id: cache-modernbert-encoderfile - uses: actions/cache@v6 + uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 with: path: ${{ github.workspace }}/.cache/encoderfiles key: ${{ runner.os }}-modernbert-encoderfile-v1 diff --git a/.github/workflows/ci-server.yaml b/.github/workflows/ci-server.yaml index 744972ec..6aa0198a 100644 --- a/.github/workflows/ci-server.yaml +++ b/.github/workflows/ci-server.yaml @@ -22,9 +22,11 @@ jobs: name: Validate schemas runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Validate fixtures against schemas run: make validate-schema @@ -33,17 +35,19 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 10 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 cache: pnpm @@ -60,18 +64,20 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: true python-version: ${{ matrix.python-version }} - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 10 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 cache: pnpm diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index e16951f1..7ce22048 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -31,11 +31,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.13" @@ -79,12 +79,13 @@ jobs: echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - name: Check out the repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false ref: ${{ steps.tag.outputs.tag }} fetch-depth: 0 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.13" diff --git a/.github/workflows/release-cli.yaml b/.github/workflows/release-cli.yaml index f4d36376..28892c75 100644 --- a/.github/workflows/release-cli.yaml +++ b/.github/workflows/release-cli.yaml @@ -65,12 +65,13 @@ jobs: echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false ref: ${{ steps.tag.outputs.tag }} - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: cli/go.mod @@ -122,7 +123,7 @@ jobs: run: sha256sum "${{ env.archive }}" > "${{ env.archive }}.sha256" - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: cq_${{ matrix.goos }}_${{ matrix.archive_arch }} path: | @@ -144,7 +145,7 @@ jobs: echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: dist merge-multiple: true @@ -175,14 +176,15 @@ jobs: run: gh release upload "$TAG" dist/*.tar.gz dist/*.zip dist/checksums.txt --repo "$GITHUB_REPOSITORY" - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false ref: ${{ steps.tag.outputs.tag }} sparse-checkout: build/brew path: repo - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: repo/build/brew/go.mod diff --git a/.github/workflows/release-schema.yaml b/.github/workflows/release-schema.yaml index ab6efb23..4bf71401 100644 --- a/.github/workflows/release-schema.yaml +++ b/.github/workflows/release-schema.yaml @@ -47,11 +47,12 @@ jobs: echo "version=${VERSION}" >> "$GITHUB_OUTPUT" echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false ref: ${{ steps.tag.outputs.tag }} - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Sync canonical schemas into the package run: make sync-schema @@ -67,6 +68,6 @@ jobs: run: uv build - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: packages-dir: schema/python/dist/ diff --git a/.github/workflows/release-sdk-python.yaml b/.github/workflows/release-sdk-python.yaml index 052d89f4..5ac60812 100644 --- a/.github/workflows/release-sdk-python.yaml +++ b/.github/workflows/release-sdk-python.yaml @@ -44,11 +44,12 @@ jobs: echo "version=${VERSION}" >> "$GITHUB_OUTPUT" echo "tag=${TAG}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false ref: ${{ steps.tag.outputs.tag }} - - uses: astral-sh/setup-uv@v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Set package version working-directory: sdk/python @@ -61,6 +62,6 @@ jobs: run: uv build - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: packages-dir: sdk/python/dist/ diff --git a/.github/workflows/release-server-image.yaml b/.github/workflows/release-server-image.yaml index ee2d2641..f8a1d939 100644 --- a/.github/workflows/release-server-image.yaml +++ b/.github/workflows/release-server-image.yaml @@ -64,19 +64,20 @@ jobs: fi - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false ref: ${{ github.event.release.tag_name || github.event.inputs.tag }} - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Log in to GHCR if: steps.publish.outputs.ghcr == 'true' - uses: docker/login-action@v4 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -84,7 +85,7 @@ jobs: - name: Log in to DockerHub if: steps.publish.outputs.dockerhub == 'true' - uses: docker/login-action@v4 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -108,7 +109,7 @@ jobs: echo "push=$([[ -n "$TAGS" ]] && echo true || echo false)" >> "$GITHUB_OUTPUT" - name: Build and push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 with: context: server push: ${{ steps.tags.outputs.push }} diff --git a/.github/workflows/validate-cli-release.yaml b/.github/workflows/validate-cli-release.yaml index 5be6e4c5..615097bc 100644 --- a/.github/workflows/validate-cli-release.yaml +++ b/.github/workflows/validate-cli-release.yaml @@ -27,10 +27,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: cli/go.mod