Skip to content

ci(py): pin Python workflow actions and drop default write access #623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
huangjeff5 wants to merge 1 commit into from
Closed

ci(py): pin Python workflow actions and drop default write access #623

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions .github/workflows/python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@

name: Python checks

permissions:
contents: read

on:
pull_request:

Expand All @@ -25,12 +28,13 @@ jobs:
outputs:
any_changed: ${{ steps.changed-files.outputs.any_changed }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
persist-credentials: false
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@v45
uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
with:
files: |
python/**
Expand All @@ -45,15 +49,15 @@ jobs:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
# Use the PR head ref to allow pushing back to the branch
ref: ${{ github.head_ref }}
# Use a token that can push to the branch (for release-please PRs)
token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}

- name: Install uv
uses: astral-sh/setup-uv@v5
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
with:
enable-cache: true

Expand Down Expand Up @@ -126,10 +130,12 @@ jobs:
fail-fast: false

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@v6
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
with:
go-version: stable

Expand All @@ -143,7 +149,7 @@ jobs:
python-version: pypy3.11-v7.3.23

- name: Install uv and setup Python version
uses: astral-sh/setup-uv@v5
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
with:
enable-cache: true
python-version: ${{ matrix.python-version }}
Expand Down
Loading