ci-tooling 2026-04-01
Pin all GitHub Actions to SHA digests with centralized version manifest
13 files · 302+ · 69-

SHA-pin all GitHub Action references

harden behavioral
11 files changed
  • python-ci.yml Pin checkout to v6.0.2 SHA, setup-python to v6.2.0 SHA, setup-uv to v8.0.0 SHA, codecov-action to v6.0.0 SHA, upload-artifact to v7.0.0 SHA across all job matrices.
  • python-release.yml Pin checkout, upload-artifact, and download-artifact to SHA digests
  • python-security.yml Pin checkout, setup-python, setup-uv, upload-artifact, gitleaks to SHAs
  • test-actions.yml Pin checkout to SHA in all four test jobs
  • test-minimal.yml Pin checkout to SHA
  • action.yml Pin setup-python and setup-uv to SHAs
  • action.yml Pin softprops/action-gh-release to v2.6.1 SHA
  • action.yml Pin setup-python, setup-uv, upload-artifact to SHAs
  • action.yml Pin checkout to SHA
  • action.yml Pin checkout to SHA
  • action.yml Pin setup-python, setup-uv, and actions/cache to SHAs
  • Every third-party action reference across 11 workflow and action files is now pinned to an immutable commit SHA, preventing supply chain attacks via mutable tag overwrites. Version comments are preserved for human readability. harden behavioral
    4 files
    • python-ci.yml
    • python-release.yml
    • python-security.yml
    • action.yml

Centralized version manifest and update script

instantiate architectural
2 files changed
  • action-versions.yml New YAML manifest defining canonical SHA pins for all GitHub Actions (checkout, setup-python, setup-uv, upload/download-artifact, codecov, gitleaks, gh-release, cache) and pre-commit hook versions.
  • update-action-versions.py New script that reads action-versions.yml and applies SHA-pinned versions to workflow files and pre-commit configs in any target repository, with --actions and --pre-commit flags.
  • The update script uses regex replacement to swap action refs across arbitrary repos, enabling one-command version bumps across the entire ecosystem from the ci-tooling source of truth. instantiate architectural
    2 files
    • update-action-versions.py
    • action-versions.yml
← 2026-03-30 ci-tooling changelog →