ci: pin all GitHub Actions to SHA hashes and update versions#1681
Open
ZeliardM wants to merge 1 commit intopython-kasa:masterfrom
Open
ci: pin all GitHub Actions to SHA hashes and update versions#1681ZeliardM wants to merge 1 commit intopython-kasa:masterfrom
ZeliardM wants to merge 1 commit intopython-kasa:masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Pins GitHub Actions to full commit SHAs to harden the CI supply chain, while upgrading select actions (cache + Codecov) to newer major versions.
Changes:
- Pin all referenced GitHub Actions in workflows and the composite setup action to full commit SHAs (with version tags kept as comments).
- Upgrade
actions/cachefrom v4 → v5 (in the composite setup action). - Upgrade
codecov/codecov-actionfrom v5 → v6.0.0 (in CI workflow).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/ci.yml |
Pins actions/checkout and upgrades/pins Codecov action to a SHA. |
.github/workflows/codeql-analysis.yml |
Pins actions/checkout and CodeQL init/analyze actions to SHAs. |
.github/workflows/publish.yml |
Pins checkout, uv setup, python setup, and PyPI publish actions to SHAs. |
.github/workflows/stale.yml |
Pins actions/stale to a SHA in both stale policy steps. |
.github/actions/setup/action.yaml |
Pins uv/python setup actions and upgrades/pins actions/cache to v5 SHA. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1681 +/- ##
=======================================
Coverage 93.22% 93.22%
=======================================
Files 157 157
Lines 9815 9815
Branches 1003 1003
=======================================
Hits 9150 9150
Misses 472 472
Partials 193 193 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
5187fba to
94e06bb
Compare
- Pin all actions to full SHA commit hashes for supply chain security - Upgrade actions/cache from v4 to v5 - Upgrade codecov/codecov-action from v5 to v6.0.0 (node24 support) - Version tags preserved as inline comments for easy readability Actions pinned: actions/checkout@v6 (de0fac2) actions/setup-python@v6 (a309ff8) actions/cache@v5 (6682284) [upgraded from v4] actions/stale@v10 (b5d41d4) astral-sh/setup-uv@v7 (37802ad) codecov/[email protected] (57e3a13) [upgraded from v5] github/codeql-action@v4 (c10b806) pypa/gh-action-pypi-publish@release/v1 (ed0c539)
Contributor
Author
|
@rytilahti Here is the updated CI PR you asked for with SHA pinning and updated versions across the repository. |
This was referenced Apr 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin all GitHub Actions to full SHA commit hashes for improved supply chain security, following GitHub's recommendation. Version tags are preserved as inline comments for readability.
Version upgrades
SHA pinning (no version change)
actions/checkoutde0fac2eactions/setup-pythona309ff8bactions/cache66822842actions/staleb5d41d4eastral-sh/setup-uv37802adccodecov/codecov-action57e3a136github/codeql-actionc10b8064pypa/gh-action-pypi-published0c5393CodeQL enhancement
CODEQL_ACTION_FILE_COVERAGE_ON_PRS: trueto show file-level coverage info in PR checksFiles changed
.github/workflows/ci.yml.github/workflows/codeql-analysis.yml.github/workflows/publish.yml.github/workflows/stale.yml.github/actions/setup/action.yamlMerge order
This is PR 2 of 9 in the test modernization series. Independent of other PRs (no file overlaps).
Verification