From 0f28aaee005b32260f87f35fc057dafc2dccb84d Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 02:00:28 +0100
Subject: [PATCH 1/2] Pin setup-python action to a commit hash

---
 .github/workflows/cron-ci.yaml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cron-ci.yaml b/.github/workflows/cron-ci.yaml
index 68ef4dea47a..5da63c36428 100644
--- a/.github/workflows/cron-ci.yaml
+++ b/.github/workflows/cron-ci.yaml
@@ -30,9 +30,11 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
       - uses: taiki-e/install-action@cargo-llvm-cov
-      - uses: actions/setup-python@v6.2.0
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
+
       - run: sudo apt-get update && sudo apt-get -y install lcov
       - name: Run cargo-llvm-cov with Rust tests.
         run: cargo llvm-cov --no-report --workspace --exclude rustpython_wasm --exclude rustpython-compiler-source --exclude rustpython-venvlauncher --verbose --no-default-features --features stdlib,importlib,encodings,ssl-rustls,jit
@@ -48,7 +50,8 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
         uses: codecov/codecov-action@v5
         with:
-          file: ./codecov.lcov
+          files: |
+            ./codecov.lcov
 
   testdata:
     name: Collect regression test data
@@ -96,9 +99,11 @@ jobs:
           persist-credentials: true
 
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v6.2.0
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
+
       - name: build rustpython
         run: cargo build --release --verbose
       - name: Collect what is left data
@@ -157,9 +162,11 @@ jobs:
           persist-credentials: true
 
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v6.2.0
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
+
       - run: cargo install cargo-criterion
       - name: build benchmarks
         run: cargo build --release --benches

From d3f062e3d4b89bded5d29fb0a78b75921bea3d24 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 02:06:46 +0100
Subject: [PATCH 2/2] Fix param

---
 .github/workflows/cron-ci.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/cron-ci.yaml b/.github/workflows/cron-ci.yaml
index 5da63c36428..320c30c118d 100644
--- a/.github/workflows/cron-ci.yaml
+++ b/.github/workflows/cron-ci.yaml
@@ -50,8 +50,7 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
         uses: codecov/codecov-action@v5
         with:
-          files: |
-            ./codecov.lcov
+          files: ./codecov.lcov
 
   testdata:
     name: Collect regression test data