Skip to content

Commit 35bef09

Browse files
methanemethane
authored
Adopt GitHub Actions workflow dependency lockfile (#764)
1 parent c14af4b commit 35bef09

7 files changed

Lines changed: 115 additions & 16 deletions

File tree

‎.github/workflows/actions.lock‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.3'
5+
workflows:
6+
'.github/workflows/docs.yaml':
7+
- 'actions/checkout@v7.0.1'
8+
- 'actions/setup-python@v7.1.0'
9+
'.github/workflows/lint.yaml':
10+
- 'actions/checkout@v7.0.1'
11+
'.github/workflows/test.yml':
12+
- 'actions/checkout@v7.0.1'
13+
- 'actions/setup-python@v7.1.0'
14+
- 'actions/upload-artifact@v7.0.2'
15+
'.github/workflows/test_debug.yml':
16+
- 'actions/cache@v6.1.0'
17+
- 'actions/checkout@v7.0.1'
18+
'.github/workflows/wheel.yml':
19+
- 'actions/checkout@v7.0.1'
20+
- 'actions/download-artifact@v8.0.2'
21+
- 'actions/setup-python@v7.1.0'
22+
- 'actions/upload-artifact@v7.0.2'
23+
- 'docker/setup-qemu-action@v4.4.0'
24+
- 'pypa/cibuildwheel@v4.3.4'
25+
- 'pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086'
26+
dependencies:
27+
'actions/cache@v6.1.0':
28+
ref: 'v6.1.0'
29+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
30+
owner_id: 44036562
31+
repo_id: 215566462
32+
'actions/checkout@v7.0.1':
33+
ref: 'v7.0.1'
34+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
35+
owner_id: 44036562
36+
repo_id: 197814629
37+
'actions/download-artifact@v8.0.2':
38+
ref: 'v8.0.2'
39+
commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
40+
owner_id: 44036562
41+
repo_id: 192626254
42+
'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97':
43+
ref: 'v7.0.0'
44+
commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97'
45+
owner_id: 44036562
46+
repo_id: 192625525
47+
'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405':
48+
ref: 'v6.2.0'
49+
commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
50+
owner_id: 44036562
51+
repo_id: 192625525
52+
'actions/setup-python@v7.1.0':
53+
ref: 'v7.1.0'
54+
commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0'
55+
owner_id: 44036562
56+
repo_id: 192625525
57+
'actions/upload-artifact@v7.0.2':
58+
ref: 'v7.0.2'
59+
commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
60+
owner_id: 44036562
61+
repo_id: 192625955
62+
'docker/setup-qemu-action@v4.4.0':
63+
ref: 'v4.4.0'
64+
commit: 'sha1-99012661954931238ded8c8b007157a8430204e1'
65+
owner_id: 5429470
66+
repo_id: 288487894
67+
'pypa/cibuildwheel@v4.3.4':
68+
ref: 'v4.3.4'
69+
commit: 'sha1-b9e566a2b284570af229f6c2a33673410d0389a3'
70+
owner_id: 647025
71+
repo_id: 85508223
72+
uses:
73+
- 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97'
74+
'pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086':
75+
ref: 'v1.14.3'
76+
commit: 'sha1-7245906fb61fa33a13554f9d5fb856fe61758086'
77+
owner_id: 647025
78+
repo_id: 178055147
79+
uses:
80+
- 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405'

‎.github/workflows/docs.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ jobs:
1111
runs-on: ubuntu-latest
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
14+
uses: actions/checkout@v7.0.1
1515

1616
- name: Setup Python
17-
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
17+
uses: actions/setup-python@v7.1.0
1818
with:
1919
python-version: '3.x'
2020
cache: "pip"

‎.github/workflows/lint.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
runs-on: ubuntu-slim
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
14+
uses: actions/checkout@v7.0.1
1515

1616
- name: ruff check
1717
run: |

‎.github/workflows/test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626

2727
steps:
2828
- name: Checkout
29-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
29+
uses: actions/checkout@v7.0.1
3030

3131
- name: Set up Python
32-
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
32+
uses: actions/setup-python@v7.1.0
3333
with:
3434
python-version: ${{ matrix.py }}
3535
allow-prereleases: true
@@ -81,7 +81,7 @@ jobs:
8181
python -m build -nv
8282
8383
- name: upload packages
84-
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
84+
uses: actions/upload-artifact@v7.0.2
8585
with:
8686
name: dist-${{ matrix.os }}-${{ matrix.py }}
8787
path: dist

‎.github/workflows/test_debug.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ jobs:
1111
PYTHON_VERSION: 3.14.6
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
14+
uses: actions/checkout@v7.0.1
1515

16-
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
16+
- uses: actions/cache@v6.1.0
1717
with:
1818
path: /opt/python-debug
1919
key: python-debug-${{ runner.os }}-${{ env.PYTHON_VERSION }}

‎.github/workflows/wheel.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ jobs:
2929
name: Build wheels on ${{ matrix.os }}${{ matrix.name_suffix || '' }}
3030

3131
steps:
32-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
33-
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
32+
- uses: actions/checkout@v7.0.1
33+
- uses: actions/setup-python@v7.1.0
3434
with:
3535
python-version: "3.x"
3636
cache: "pip"
@@ -42,12 +42,12 @@ jobs:
4242
4343
- name: Set up QEMU for emulation
4444
if: matrix.cibw_archs == 'riscv64'
45-
uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
45+
uses: docker/setup-qemu-action@v4.4.0
4646
with:
4747
platforms: ${{ matrix.cibw_archs }}
4848

4949
- name: Build
50-
uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3 # v4.3.4
50+
uses: pypa/cibuildwheel@v4.3.4
5151
env:
5252
CIBW_TEST_REQUIRES: "pytest"
5353
CIBW_TEST_COMMAND: "pytest {package}/test"
@@ -62,7 +62,7 @@ jobs:
6262
python -m build -s -o wheelhouse
6363
6464
- name: Upload Wheels to artifact
65-
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
65+
uses: actions/upload-artifact@v7.0.2
6666
with:
6767
name: wheels-${{ matrix.os }}${{ matrix.name_suffix || '' }}
6868
path: wheelhouse
@@ -72,15 +72,15 @@ jobs:
7272
needs: [build_wheels]
7373
runs-on: ubuntu-latest
7474
steps:
75-
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
75+
- uses: actions/download-artifact@v8.0.2
7676
with:
7777
# unpacks all CIBW artifacts into dist/
7878
pattern: wheels-*
7979
path: dist
8080
merge-multiple: true
8181

8282
- name: Upload Wheels to artifact
83-
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
83+
uses: actions/upload-artifact@v7.0.2
8484
with:
8585
name: wheels-all
8686
path: dist
@@ -96,7 +96,7 @@ jobs:
9696
# or, alternatively, upload to PyPI on every tag starting with 'v' (remove on: release above to use this)
9797
# if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
9898
steps:
99-
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
99+
- uses: actions/download-artifact@v8.0.2
100100
with:
101101
# unpacks all CIBW artifacts into dist/
102102
pattern: wheels-*

‎DEVELOP.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,22 @@ Run test with following command:
1515
```
1616
$ make test
1717
```
18+
19+
### GitHub Actions dependencies
20+
21+
Workflow action versions are pinned in `.github/workflows/actions.lock`.
22+
After changing a `uses:` reference or adding a workflow, regenerate and verify
23+
the lockfile with the official GitHub CLI extension:
24+
25+
```
26+
$ gh extension install github/gh-actions-lock
27+
$ gh actions-lock --no-narrow
28+
$ gh actions-lock --verify --no-narrow
29+
```
30+
31+
Review and commit the workflow changes together with the generated lockfile.
32+
Do not edit the lockfile by hand. Dependabot updates the corresponding lockfile
33+
entries when it updates action versions in onboarded workflows.
34+
35+
Keep the PyPI publish action's SHA reference: it also uses the reference to
36+
select its Docker image. `--no-narrow` preserves this reference.

0 commit comments

Comments
 (0)