From 21f4c9ed2e3209d087f4a1d1fdf4d2c162b2fd71 Mon Sep 17 00:00:00 2001 From: Irfan Ahmad Date: Wed, 15 Jul 2026 16:33:17 +0500 Subject: [PATCH] fix: pin pypa/gh-action-pypi-publish to a commit SHA The dedicated SHA-pinning PR (#53) pinned every other action in this workflow (checkout, python-semantic-release, publish-action, upload-artifact, download-artifact, setup-node) but missed this one -- likely because @release/v1 looks like a branch name rather than the @vX version-tag pattern the other lines used, so it slipped past whatever tool/regex did that sweep. This isn't just a style nit: openedx/xblocks-core's real release just failed with "docker: manifest unknown" because @release/v1 resolved to a commit whose Docker image wasn't published on ghcr.io yet. Since this repo is the reference implementation every "modernize Python tooling" migration copies (openedx/public-engineering#506), the same unpinned ref propagates into every repo that follows this template. pypa/gh-action-pypi-publish's own README shows @release/v1 in its usage examples, but its own "pro tip" note recommends pinning to a tag or SHA rather than tracking a branch pointer -- there's no upstream guidance that this action is meant to be an exception to normal pinning practice. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 117df66..e932574 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -105,7 +105,7 @@ jobs: path: backend-plugin-sample/dist - name: Publish to PyPi - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: packages-dir: backend-plugin-sample/dist user: __token__ @@ -128,7 +128,7 @@ jobs: path: tutor-contrib-sample/dist - name: Publish to PyPi - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: packages-dir: tutor-contrib-sample/dist user: __token__