Skip to content

Commit 205a554

Browse files
paulinebmpaulinebm
authored
🔒 Pin GitHub Actions to commit SHAs (#424)
* 🔒 pin kernel_abi_python_release.yaml actions to commit SHAs * 🔒 pin test_kernels.yaml actions to commit SHAs * 🔒 pin build_kernel.yaml actions to commit SHAs * 🔒 pin lint.yml actions to commit SHAs * 🔒 pin build_documentation.yaml actions to commit SHAs * 🔒 pin build_pr_documentation.yaml actions to commit SHAs * 🔒 pin upload_pr_documentation.yaml actions to commit SHAs * 🔒 pin publish_kernels.yml actions to commit SHAs
1 parent 212621c commit 205a554

File tree

8 files changed

+51
-51
lines changed

8 files changed

+51
-51
lines changed

‎.github/workflows/build_documentation.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on:
1212

1313
jobs:
1414
build:
15-
uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@main
15+
uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 # main
1616
with:
1717
commit_sha: ${{ github.sha }}
1818
package_path: kernels/kernels/

‎.github/workflows/build_kernel.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on:
2424
group: ${{ matrix.runner }}
2525
steps:
26-
- uses: actions/checkout@v6
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727
- uses: DeterminateSystems/nix-installer-action@main
2828
with:
2929
extra-conf: |
@@ -45,7 +45,7 @@ jobs:
4545
run: cp -rL result/* .
4646

4747
- name: Upload kernel artifacts
48-
uses: actions/upload-artifact@v6
48+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
4949
with:
5050
name: built-kernels-${{ matrix.arch }}
5151
path: |
@@ -65,10 +65,10 @@ jobs:
6565
runs-on:
6666
group: aws-g6-12xlarge-plus
6767
steps:
68-
- uses: actions/checkout@v6
68+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6969

7070
- name: Download kernel artifacts
71-
uses: actions/download-artifact@v7
71+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
7272
with:
7373
name: built-kernels-x86_64-linux
7474
path: .

‎.github/workflows/build_pr_documentation.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ concurrency:
1313

1414
jobs:
1515
build:
16-
uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@main
16+
uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 # main
1717
with:
1818
commit_sha: ${{ github.event.pull_request.head.sha }}
1919
pr_number: ${{ github.event.number }}

‎.github/workflows/kernel_abi_python_release.yaml‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -40,26 +40,26 @@ jobs:
4040
- runner: ubuntu-22.04
4141
target: ppc64le
4242
steps:
43-
- uses: actions/checkout@v6
44-
- uses: actions/setup-python@v6
43+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4545
with:
4646
python-version: 3.x
4747
- name: Build wheels
48-
uses: PyO3/maturin-action@v1
48+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
4949
with:
5050
target: ${{ matrix.platform.target }}
5151
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml
5252
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
5353
manylinux: auto
5454
- name: Build free-threaded wheels
55-
uses: PyO3/maturin-action@v1
55+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
5656
with:
5757
target: ${{ matrix.platform.target }}
5858
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml -i python3.13t
5959
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
6060
manylinux: auto
6161
- name: Upload wheels
62-
uses: actions/upload-artifact@v6
62+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
6363
with:
6464
name: wheels-linux-${{ matrix.platform.target }}
6565
path: dist
@@ -78,26 +78,26 @@ jobs:
7878
- runner: ubuntu-22.04
7979
target: armv7
8080
steps:
81-
- uses: actions/checkout@v6
82-
- uses: actions/setup-python@v6
81+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
82+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
8383
with:
8484
python-version: 3.x
8585
- name: Build wheels
86-
uses: PyO3/maturin-action@v1
86+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
8787
with:
8888
target: ${{ matrix.platform.target }}
8989
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml
9090
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
9191
manylinux: musllinux_1_2
9292
- name: Build free-threaded wheels
93-
uses: PyO3/maturin-action@v1
93+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
9494
with:
9595
target: ${{ matrix.platform.target }}
9696
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml -i python3.13t
9797
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
9898
manylinux: musllinux_1_2
9999
- name: Upload wheels
100-
uses: actions/upload-artifact@v6
100+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
101101
with:
102102
name: wheels-musllinux-${{ matrix.platform.target }}
103103
path: dist
@@ -112,29 +112,29 @@ jobs:
112112
- runner: windows-latest
113113
target: x86
114114
steps:
115-
- uses: actions/checkout@v6
116-
- uses: actions/setup-python@v6
115+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
116+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
117117
with:
118118
python-version: 3.x
119119
architecture: ${{ matrix.platform.target }}
120120
- name: Build wheels
121-
uses: PyO3/maturin-action@v1
121+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
122122
with:
123123
target: ${{ matrix.platform.target }}
124124
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml
125125
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
126-
- uses: actions/setup-python@v6
126+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
127127
with:
128128
python-version: 3.13t
129129
architecture: ${{ matrix.platform.target }}
130130
- name: Build free-threaded wheels
131-
uses: PyO3/maturin-action@v1
131+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
132132
with:
133133
target: ${{ matrix.platform.target }}
134134
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml -i python3.13t
135135
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
136136
- name: Upload wheels
137-
uses: actions/upload-artifact@v6
137+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
138138
with:
139139
name: wheels-windows-${{ matrix.platform.target }}
140140
path: dist
@@ -147,39 +147,39 @@ jobs:
147147
- runner: macos-14
148148
target: aarch64
149149
steps:
150-
- uses: actions/checkout@v6
151-
- uses: actions/setup-python@v6
150+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
151+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
152152
with:
153153
python-version: 3.x
154154
- name: Build wheels
155-
uses: PyO3/maturin-action@v1
155+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
156156
with:
157157
target: ${{ matrix.platform.target }}
158158
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml
159159
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
160160
- name: Build free-threaded wheels
161-
uses: PyO3/maturin-action@v1
161+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
162162
with:
163163
target: ${{ matrix.platform.target }}
164164
args: --release --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml -i python3.13t
165165
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
166166
- name: Upload wheels
167-
uses: actions/upload-artifact@v6
167+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
168168
with:
169169
name: wheels-macos-${{ matrix.platform.target }}
170170
path: dist
171171

172172
sdist:
173173
runs-on: ubuntu-latest
174174
steps:
175-
- uses: actions/checkout@v6
175+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
176176
- name: Build sdist
177-
uses: PyO3/maturin-action@v1
177+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
178178
with:
179179
command: sdist
180180
args: --out dist --manifest-path kernel-abi-check/bindings/python/Cargo.toml
181181
- name: Upload sdist
182-
uses: actions/upload-artifact@v6
182+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
183183
with:
184184
name: wheels-sdist
185185
path: dist
@@ -200,14 +200,14 @@ jobs:
200200
# Used to generate artifact attestation
201201
attestations: write
202202
steps:
203-
- uses: actions/download-artifact@v7
203+
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
204204
- name: Generate artifact attestation
205-
uses: actions/attest-build-provenance@v3
205+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
206206
with:
207207
subject-path: "wheels-*/*"
208208
- name: Publish to PyPI
209209
if: ${{ startsWith(github.ref, 'refs/tags/') }}
210-
uses: PyO3/maturin-action@v1
210+
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
211211
with:
212212
command: upload
213213
args: --non-interactive --skip-existing wheels-*/*

‎.github/workflows/lint.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ jobs:
55
name: Run lints
66
runs-on: ubuntu-latest
77
steps:
8-
- uses: actions/checkout@v6
8+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
99
- name: Run ruff
10-
uses: astral-sh/ruff-action@v3
10+
uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
1111
src: >-
1212
kernels
1313
@@ -17,10 +17,10 @@ jobs:
1717
env:
1818
UV_PYTHON_PREFERENCE: only-managed
1919
steps:
20-
- uses: actions/checkout@v6
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2121

2222
- name: Install uv and set the python version
23-
uses: astral-sh/setup-uv@v7
23+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
2424
with:
2525
python-version: 3.12
2626

@@ -35,10 +35,10 @@ jobs:
3535
name: Validate python_depends.json
3636
runs-on: ubuntu-latest
3737
steps:
38-
- uses: actions/checkout@v6
38+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3939

4040
- name: Set up Python
41-
uses: actions/setup-python@v6
41+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4242
with:
4343
python-version: "3.12"
4444

‎.github/workflows/publish_kernels.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ jobs:
88
runs-on: ubuntu-latest
99

1010
steps:
11-
- uses: actions/checkout@v6
11+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1212
with:
1313
persist-credentials: false
1414
- name: Set up Python
15-
uses: actions/setup-python@v6
15+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
1616
with:
1717
python-version: "3.9"
1818
- name: Install pypa/build
@@ -24,7 +24,7 @@ jobs:
2424
- name: Build a binary wheel and a source tarball
2525
run: ( cd kernels && python3 -m build )
2626
- name: Store the distribution packages
27-
uses: actions/upload-artifact@v6
27+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
2828
with:
2929
name: python-package-distributions
3030
path: kernels/dist/
@@ -44,12 +44,12 @@ jobs:
4444

4545
steps:
4646
- name: Download all the dists
47-
uses: actions/download-artifact@v7
47+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
4848
with:
4949
name: python-package-distributions
5050
path: dist/
5151
- name: Publish distribution 📦 to PyPI
52-
uses: pypa/gh-action-pypi-publish@release/v1
52+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
5353

5454
github-release:
5555
name: >-
@@ -65,12 +65,12 @@ jobs:
6565

6666
steps:
6767
- name: Download all the dists
68-
uses: actions/download-artifact@v7
68+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
6969
with:
7070
name: python-package-distributions
7171
path: dist/
7272
- name: Sign the dists with Sigstore
73-
uses: sigstore/gh-action-sigstore-python@v3.2.0
73+
uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d # v3.2.0
7474
with:
7575
inputs: >-
7676
./dist/*.tar.gz
@@ -109,12 +109,12 @@ jobs:
109109

110110
steps:
111111
- name: Download all the dists
112-
uses: actions/download-artifact@v7
112+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
113113
with:
114114
name: python-package-distributions
115115
path: dist/
116116
- name: Publish distribution 📦 to TestPyPI
117-
uses: pypa/gh-action-pypi-publish@release/v1
117+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
118118
with:
119119
repository-url: https://test.pypi.org/legacy/
120120
skip-existing: true # Only upload when the version is unique.

‎.github/workflows/test_kernels.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,10 @@ jobs:
3434

3535
steps:
3636
- name: Checkout code
37-
uses: actions/checkout@v6
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838

3939
- name: Install uv and set the python version
40-
uses: astral-sh/setup-uv@v7
40+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
4141
with:
4242
python-version: ${{ matrix.python-version }}
4343

‎.github/workflows/upload_pr_documentation.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88

99
jobs:
1010
build:
11-
uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@main
11+
uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 # main
1212
with:
1313
package_name: kernels
1414
secrets:

0 commit comments

Comments
 (0)