Skip to content

fix(actions): Explicitly reference dependency commits.#1020

Merged
tristpinsm merged 1 commit into
mainfrom
tpm/fix-actions
Jul 10, 2026
Merged

fix(actions): Explicitly reference dependency commits.#1020
tristpinsm merged 1 commit into
mainfrom
tpm/fix-actions

Conversation

@tristpinsm

Copy link
Copy Markdown
Collaborator

A recent change to the organization policies no longer allows referencing actions dependency versions using tags or branches.

A recent change to the organization policies no longer
allows referencing actions dependency versions using tags
or branches.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates GitHub Actions workflows to comply with an org policy that disallows referencing action dependencies via mutable tags/branches by pinning each uses: reference to an explicit commit SHA.

Changes:

  • Pin actions/checkout and actions/setup-python to commit SHAs across CI/test jobs.
  • Pin Docker-related actions (setup-buildx, login, build-push) to commit SHAs for build/publish jobs.
  • Pin packaging/publishing actions (cibuildwheel, artifact upload/download, PyPI publish, labeler) to commit SHAs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/test-or-deploy.yml Replaces tag/branch-based action references with pinned commit SHAs across test, build, and deploy jobs.
.github/workflows/labeler.yml Pins actions/checkout and actions/labeler to commit SHAs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@tristpinsm
tristpinsm merged commit c1070dc into main Jul 10, 2026
22 checks passed
@tristpinsm
tristpinsm deleted the tpm/fix-actions branch July 10, 2026 00:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants