From f0b963b478bbeed2c2f87dc2fa3c783fbbeead6f Mon Sep 17 00:00:00 2001 From: sadlilas <11658960+sadlilas@users.noreply.github.com> Date: Wed, 28 Oct 2026 22:04:03 -0700 Subject: [PATCH] ci: pin GitHub Actions to full-length commit SHAs Freeze existing action versions at immutable commit SHAs and retain their original refs in comments. Workflow triggers, permissions, action inputs, and runtime bundle refs remain unchanged. Generated with Amplifier Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com> --- .github/workflows/tests.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 98a47f3..36224af 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -18,11 +18,11 @@ jobs: matrix: python-version: ["3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: ${{ matrix.python-version }} - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6 - name: Create virtual environment run: uv venv --python "${{ matrix.python-version }}" .venv - name: Install current Amplifier sources and test runner dependencies