From 42f668ae3ba7ee9e6ef0f37b19146352e84e4892 Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:04 +0200 Subject: [PATCH 1/7] =?UTF-8?q?=F0=9F=94=92=20pin=20slow=5Ftests.yaml=20ac?= =?UTF-8?q?tions=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/slow_tests.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/slow_tests.yaml b/.github/workflows/slow_tests.yaml index 4394a73ce..9d33934da 100644 --- a/.github/workflows/slow_tests.yaml +++ b/.github/workflows/slow_tests.yaml @@ -25,12 +25,12 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: lfs: true - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 with: enable-cache: true @@ -42,7 +42,7 @@ jobs: - name: Cache CUDA Toolkit id: cache-cuda - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: /usr/local/cuda-12.8 key: cuda-toolkit-12-8-${{ runner.os }} From 8db3f0eb81881d47c73c078c6a191245f77acfbd Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:05 +0200 Subject: [PATCH 2/7] =?UTF-8?q?=F0=9F=94=92=20pin=20quality.yaml=20actions?= =?UTF-8?q?=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/quality.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/quality.yaml b/.github/workflows/quality.yaml index fa1490432..99f4fb64e 100644 --- a/.github/workflows/quality.yaml +++ b/.github/workflows/quality.yaml @@ -16,9 +16,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Python environment - uses: actions/setup-python@v2 + uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2 with: python-version: '3.10' - name: Install dependencies From 38eabe728b98a47fdeb4afe8bc66a8972d315960 Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:06 +0200 Subject: [PATCH 3/7] =?UTF-8?q?=F0=9F=94=92=20pin=20doc-build.yml=20action?= =?UTF-8?q?s=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/doc-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/doc-build.yml b/.github/workflows/doc-build.yml index cd345d3d3..b274750e0 100644 --- a/.github/workflows/doc-build.yml +++ b/.github/workflows/doc-build.yml @@ -9,7 +9,7 @@ on: jobs: build: - uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@main + uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 # main with: commit_sha: ${{ github.sha }} package: lighteval From 0f8290e684fc02016cf53fad52394bc45bfd6a50 Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:06 +0200 Subject: [PATCH 4/7] =?UTF-8?q?=F0=9F=94=92=20pin=20doc-pr-build.yml=20act?= =?UTF-8?q?ions=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/doc-pr-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/doc-pr-build.yml b/.github/workflows/doc-pr-build.yml index f96e20583..782ded1c8 100644 --- a/.github/workflows/doc-pr-build.yml +++ b/.github/workflows/doc-pr-build.yml @@ -9,7 +9,7 @@ concurrency: jobs: build: - uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@main + uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 # main with: commit_sha: ${{ github.event.pull_request.head.sha }} pr_number: ${{ github.event.number }} From 741fcc068de5794b67404d0bb61e560df424a571 Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:07 +0200 Subject: [PATCH 5/7] =?UTF-8?q?=F0=9F=94=92=20pin=20doc-pr-upload.yml=20ac?= =?UTF-8?q?tions=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/doc-pr-upload.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/doc-pr-upload.yml b/.github/workflows/doc-pr-upload.yml index b4304ca07..c4ab68a3b 100644 --- a/.github/workflows/doc-pr-upload.yml +++ b/.github/workflows/doc-pr-upload.yml @@ -8,7 +8,7 @@ on: jobs: build: - uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@main + uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 # main with: package_name: lighteval secrets: From a9336f41b2a9749d8f5a5a8e7e5ffba021783a2c Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:08 +0200 Subject: [PATCH 6/7] =?UTF-8?q?=F0=9F=94=92=20pin=20pr=5Fstyle=5Fbot.yaml?= =?UTF-8?q?=20actions=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/pr_style_bot.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_style_bot.yaml b/.github/workflows/pr_style_bot.yaml index e08643d83..4047148de 100644 --- a/.github/workflows/pr_style_bot.yaml +++ b/.github/workflows/pr_style_bot.yaml @@ -9,7 +9,7 @@ permissions: jobs: style: - uses: huggingface/huggingface_hub/.github/workflows/style-bot-action.yml@main + uses: huggingface/huggingface_hub/.github/workflows/style-bot-action.yml@e000c1c89c65aee188041723456ac3a479416d4c # main with: python_quality_dependencies: "[quality]" secrets: From d35b672ecaf0c841eb2251f779fdf94e712b9a2f Mon Sep 17 00:00:00 2001 From: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com> Date: Thu, 2 Apr 2026 11:38:09 +0200 Subject: [PATCH 7/7] =?UTF-8?q?=F0=9F=94=92=20pin=20trufflehog.yml=20actio?= =?UTF-8?q?ns=20to=20commit=20SHAs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/trufflehog.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml index 5deb937e5..e2259b57f 100644 --- a/.github/workflows/trufflehog.yml +++ b/.github/workflows/trufflehog.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - name: Secret Scanning - uses: trufflesecurity/trufflehog@main + uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b # main with: extra_args: --only-verified