Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/discovery-catalog.yml
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
SOURCE_REPOSITORY: ${{ github.repository }}
SOURCE_OWNER: ${{ github.repository_owner }}
SOURCE_REVISION: ${{ github.sha }}
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SHA-pin convention correctly preserved here (matches the hardening from #1161). Verified: 043fb46d… corresponds to v7.0.1, and upload-artifact@v7 is compatible with the download-artifact@v8 used elsewhere in the release workflows (released together — v7 adds archive: false direct uploads, v8 handles non-ZIP downloads). No changes needed.

with:
name: openenv-catalog-${{ github.sha }}
path: openenv-catalog.json
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/publish-pypi.yml
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ jobs:
openenv --help

- name: Upload release distribution artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@v7.0.1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional supply-chain hardening (non-blocking). This is a movable tag. The sibling discovery-catalog.yml pins the same action to an immutable SHA — a convention hf-security-analysis[bot] applied when hardening workflows in #1161. Since this workflow publishes distributions to PyPI, consider matching that SHA pin:

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

Not a regression — the base already used @v7, and Dependabot keeps tag refs as tags. This is a maintainer preference call.

with:
name: openenv-${{ steps.version.outputs.version }}-dist
path: dist/
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/publish-testpypi.yml
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ jobs:
openenv --help

- name: Upload TestPyPI distribution artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@v7.0.1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional supply-chain hardening (non-blocking). Same note as publish-pypi.yml: this is a movable tag, whereas discovery-catalog.yml SHA-pins the same action. For a workflow that publishes to TestPyPI, consider pinning to the immutable SHA for consistency and supply-chain safety:

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:
name: openenv-${{ steps.version.outputs.version }}-testpypi-dist
path: dist/
Expand Down
Loading