diff --git a/.github/actions/doc_preview/action.yml b/.github/actions/doc_preview/action.yml index a0c7f212297..4580dd810db 100644 --- a/.github/actions/doc_preview/action.yml +++ b/.github/actions/doc_preview/action.yml @@ -20,7 +20,7 @@ runs: steps: - name: Deploy doc preview if: ${{ startsWith(github.ref_name, 'pull-request/') }} - uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0 with: git-config-name: cuda-python-bot git-config-email: cuda-python-bot@users.noreply.github.com @@ -35,7 +35,7 @@ runs: - name: Leave a comment after deployment if: ${{ startsWith(github.ref_name, 'pull-request/') }} - uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff # v3.0.3 + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 with: header: pr-preview number: ${{ inputs.pr-number }} diff --git a/.github/actions/fetch_ctk/action.yml b/.github/actions/fetch_ctk/action.yml index 994e35924fc..e9b9e7321fd 100644 --- a/.github/actions/fetch_ctk/action.yml +++ b/.github/actions/fetch_ctk/action.yml @@ -51,7 +51,7 @@ runs: - name: Download CTK cache id: ctk-get-cache - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 continue-on-error: true with: key: ${{ env.CTK_CACHE_KEY }} @@ -137,7 +137,7 @@ runs: - name: Upload CTK cache if: ${{ !cancelled() && steps.ctk-get-cache.outputs.cache-hit != 'true' }} - uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: ${{ env.CTK_CACHE_KEY }} path: ./${{ env.CTK_CACHE_FILENAME }} diff --git a/.github/actions/griffe-api-check/action.yml b/.github/actions/griffe-api-check/action.yml index 6c090ddeb43..dd7dce91c16 100644 --- a/.github/actions/griffe-api-check/action.yml +++ b/.github/actions/griffe-api-check/action.yml @@ -25,7 +25,7 @@ runs: using: composite steps: - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 with: enable-cache: false diff --git a/.github/actions/lychee-links/action.yml b/.github/actions/lychee-links/action.yml index 4f345576d3d..c2c8f6a0616 100644 --- a/.github/actions/lychee-links/action.yml +++ b/.github/actions/lychee-links/action.yml @@ -138,7 +138,7 @@ runs: - name: Upload link-check reports if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: lychee-${{ inputs.kind }}-${{ runner.os }}-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/lychee-reports/ diff --git a/.github/actions/setup-pixi/action.yml b/.github/actions/setup-pixi/action.yml index fc43720878d..162e9e5b0fe 100644 --- a/.github/actions/setup-pixi/action.yml +++ b/.github/actions/setup-pixi/action.yml @@ -27,7 +27,7 @@ runs: - name: Setup pixi ${{ steps.version.outputs.pixi-version }} # Pinned to a commit SHA; install logic lives in the action and is # auditable/pinned (vs. a curl|bash of an unverified installer). - uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6 + uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2 with: pixi-version: ${{ steps.version.outputs.pixi-version }} run-install: false diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml index e414a2d7d3e..6a292cb13da 100644 --- a/.github/workflows/bandit.yml +++ b/.github/workflows/bandit.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install uv - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 with: enable-cache: false @@ -45,6 +45,6 @@ jobs: with: args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif" - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml index 9b2be767828..fa49373d145 100644 --- a/.github/workflows/build-wheel.yml +++ b/.github/workflows/build-wheel.yml @@ -91,7 +91,7 @@ jobs: # xref: https://github.com/orgs/community/discussions/42856#discussioncomment-7678867 - name: Adding addtional GHA cache-related env vars if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }} - uses: actions/github-script@v9 + uses: actions/github-script@v9.0.0 with: script: | core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on'); diff --git a/.github/workflows/runner-trust-probe.yml b/.github/workflows/runner-trust-probe.yml index 8b46e6e0f67..2a55975d4f0 100644 --- a/.github/workflows/runner-trust-probe.yml +++ b/.github/workflows/runner-trust-probe.yml @@ -140,7 +140,7 @@ jobs: - name: Probe Node 20 action runtime (informational) if: ${{ always() }} continue-on-error: true - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 (declares node20) + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7.0.1 (declares node20) with: script: | const probe = require(`${process.env.GITHUB_WORKSPACE}/ci/tools/runner_trust_probe_node.js`); @@ -194,7 +194,7 @@ jobs: - name: Probe Node 20 action runtime (informational) if: ${{ always() }} continue-on-error: true - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 (declares node20) + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7.0.1 (declares node20) with: script: | const probe = require(`${process.env.GITHUB_WORKSPACE}/ci/tools/runner_trust_probe_node.js`); diff --git a/.github/workflows/woa-transport-check.yml b/.github/workflows/woa-transport-check.yml index 34bfadd386e..c845c7839e7 100644 --- a/.github/workflows/woa-transport-check.yml +++ b/.github/workflows/woa-transport-check.yml @@ -62,7 +62,7 @@ jobs: steps: - name: Create private dispatch token id: private-app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }} private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }} diff --git a/.github/workflows/woa-validation-dispatch.yml b/.github/workflows/woa-validation-dispatch.yml index cead1752f24..e06dcfd21cf 100644 --- a/.github/workflows/woa-validation-dispatch.yml +++ b/.github/workflows/woa-validation-dispatch.yml @@ -94,7 +94,7 @@ jobs: steps: - name: Create private dispatch token id: private-app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }} private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}