Skip to content

ci: pin the GHA actions as best practice#192

Merged
tarilabs merged 1 commit into
containers:mainfrom
tarilabs:tarilabs-20260706-pinGHA
Jul 7, 2026
Merged

ci: pin the GHA actions as best practice#192
tarilabs merged 1 commit into
containers:mainfrom
tarilabs:tarilabs-20260706-pinGHA

Conversation

@tarilabs

@tarilabs tarilabs commented Jul 6, 2026

Copy link
Copy Markdown
Member

updated all the GHAs to Pin version according to the following table:

Action Previous Commit SHA New Version
actions/checkout v6 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 v7
actions/setup-python v6 ece7cb06caefa5fff74198d8649806c4678c61a1 v6
astral-sh/setup-uv v6 d31148d669074a8d0a63714ba94f3201e7020bc3 v8.3.0
oras-project/setup-oras v2 38de303aac69abb66f3e6255b7198bff35f323e3 v2
helm/kind-action v1 ef37e7f390d99f746eb8b610417061a60e82a6cc v1
actions/upload-artifact v7 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a v7
actions/download-artifact v8 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c v8
pypa/gh-action-pypi-publish release/v1 cef221092ed1bacb1cc03d23a2d87d1d172e277b release/v1
sigstore/gh-action-sigstore-python v3.3.0 5b79a39c381910c090341a2c9b0bf022c8b387e1 v3.4.0

I have manually verified the sha for these pins.

Signed-off-by: tarilabs <matteo.mortari@gmail.com>

@jonburdo jonburdo left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

@tarilabs tarilabs merged commit e5e1636 into containers:main Jul 7, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants