From f96db5454fb4c12f55096181838e3bd81fca4e30 Mon Sep 17 00:00:00 2001 From: Inada Naoki Date: Fri, 30 Oct 2026 07:14:51 +0000 Subject: [PATCH] Adopt GitHub Actions workflow dependency lockfile --- .github/workflows/actions.lock | 80 ++++++++++++++++++++++++++++++++ .github/workflows/docs.yaml | 4 +- .github/workflows/lint.yaml | 2 +- .github/workflows/test.yml | 6 +-- .github/workflows/test_debug.yml | 4 +- .github/workflows/wheel.yml | 16 +++---- DEVELOP.md | 19 ++++++++ 7 files changed, 115 insertions(+), 16 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..ccb3598e --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,80 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/docs.yaml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-python@v7.1.0' + '.github/workflows/lint.yaml': + - 'actions/checkout@v7.0.1' + '.github/workflows/test.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-python@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + '.github/workflows/test_debug.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + '.github/workflows/wheel.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/setup-python@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + - 'docker/setup-qemu-action@v4.4.0' + - 'pypa/cibuildwheel@v4.3.4' + - 'pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086' +dependencies: + 'actions/cache@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 + 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97': + ref: 'v7.0.0' + commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97' + owner_id: 44036562 + repo_id: 192625525 + 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405': + ref: 'v6.2.0' + commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405' + owner_id: 44036562 + repo_id: 192625525 + 'actions/setup-python@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0' + owner_id: 44036562 + repo_id: 192625525 + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 + 'docker/setup-qemu-action@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-99012661954931238ded8c8b007157a8430204e1' + owner_id: 5429470 + repo_id: 288487894 + 'pypa/cibuildwheel@v4.3.4': + ref: 'v4.3.4' + commit: 'sha1-b9e566a2b284570af229f6c2a33673410d0389a3' + owner_id: 647025 + repo_id: 85508223 + uses: + - 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' + 'pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086': + ref: 'v1.14.3' + commit: 'sha1-7245906fb61fa33a13554f9d5fb856fe61758086' + owner_id: 647025 + repo_id: 178055147 + uses: + - 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405' diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index ee104d77..2e287bba 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Setup Python - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: '3.x' cache: "pip" diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 6e9c8c14..9f8a5372 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-slim steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ruff check run: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2f6e294f..bd593c93 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -26,10 +26,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: ${{ matrix.py }} allow-prereleases: true @@ -81,7 +81,7 @@ jobs: python -m build -nv - name: upload packages - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: dist-${{ matrix.os }}-${{ matrix.py }} path: dist diff --git a/.github/workflows/test_debug.yml b/.github/workflows/test_debug.yml index 5fbf185e..707ed20a 100644 --- a/.github/workflows/test_debug.yml +++ b/.github/workflows/test_debug.yml @@ -11,9 +11,9 @@ jobs: PYTHON_VERSION: 3.14.6 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + - uses: actions/cache@v6.1.0 with: path: /opt/python-debug key: python-debug-${{ runner.os }}-${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/wheel.yml b/.github/workflows/wheel.yml index dc859ec4..714716b1 100644 --- a/.github/workflows/wheel.yml +++ b/.github/workflows/wheel.yml @@ -29,8 +29,8 @@ jobs: name: Build wheels on ${{ matrix.os }}${{ matrix.name_suffix || '' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + - uses: actions/checkout@v7.0.1 + - uses: actions/setup-python@v7.1.0 with: python-version: "3.x" cache: "pip" @@ -42,12 +42,12 @@ jobs: - name: Set up QEMU for emulation if: matrix.cibw_archs == 'riscv64' - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 + uses: docker/setup-qemu-action@v4.4.0 with: platforms: ${{ matrix.cibw_archs }} - name: Build - uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3 # v4.3.4 + uses: pypa/cibuildwheel@v4.3.4 env: CIBW_TEST_REQUIRES: "pytest" CIBW_TEST_COMMAND: "pytest {package}/test" @@ -62,7 +62,7 @@ jobs: python -m build -s -o wheelhouse - name: Upload Wheels to artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: wheels-${{ matrix.os }}${{ matrix.name_suffix || '' }} path: wheelhouse @@ -72,7 +72,7 @@ jobs: needs: [build_wheels] runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + - uses: actions/download-artifact@v8.0.2 with: # unpacks all CIBW artifacts into dist/ pattern: wheels-* @@ -80,7 +80,7 @@ jobs: merge-multiple: true - name: Upload Wheels to artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: wheels-all path: dist @@ -96,7 +96,7 @@ jobs: # or, alternatively, upload to PyPI on every tag starting with 'v' (remove on: release above to use this) # if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') steps: - - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + - uses: actions/download-artifact@v8.0.2 with: # unpacks all CIBW artifacts into dist/ pattern: wheels-* diff --git a/DEVELOP.md b/DEVELOP.md index 27adf8c0..252989b0 100644 --- a/DEVELOP.md +++ b/DEVELOP.md @@ -15,3 +15,22 @@ Run test with following command: ``` $ make test ``` + +### GitHub Actions dependencies + +Workflow action versions are pinned in `.github/workflows/actions.lock`. +After changing a `uses:` reference or adding a workflow, regenerate and verify +the lockfile with the official GitHub CLI extension: + +``` +$ gh extension install github/gh-actions-lock +$ gh actions-lock --no-narrow +$ gh actions-lock --verify --no-narrow +``` + +Review and commit the workflow changes together with the generated lockfile. +Do not edit the lockfile by hand. Dependabot updates the corresponding lockfile +entries when it updates action versions in onboarded workflows. + +Keep the PyPI publish action's SHA reference: it also uses the reference to +select its Docker image. `--no-narrow` preserves this reference.