From 78f55b96c341092d729b58c159d8f9ffde1fa12b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:04:59 +0200 Subject: [PATCH 1/2] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/_checks.yaml | 38 +++++++++---------- .github/workflows/manual_release_beta.yaml | 2 +- .github/workflows/manual_release_docs.yaml | 14 +++---- .github/workflows/manual_release_stable.yaml | 4 +- .github/workflows/manual_version_docs.yaml | 8 ++-- .github/workflows/on_issue.yaml | 2 +- .../on_schedule_regenerate_models.yaml | 6 +-- 7 files changed, 37 insertions(+), 37 deletions(-) diff --git a/.github/workflows/_checks.yaml b/.github/workflows/_checks.yaml index 116cf037..93905b59 100644 --- a/.github/workflows/_checks.yaml +++ b/.github/workflows/_checks.yaml @@ -25,18 +25,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run actionlint - uses: rhysd/actionlint@v1.7.12 + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 spell_check: name: Spell check runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check spelling with typos - uses: crate-ci/typos@v1 + uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0 lint_check: name: Lint check @@ -55,15 +55,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} @@ -78,10 +78,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -99,10 +99,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -124,7 +124,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -132,7 +132,7 @@ jobs: # images in another format so they get converted via `pnpm opt:images` first. - name: Get changed unoptimized images id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: | docs/**/*.{png,jpg,jpeg,gif,bmp,tif,tiff,avif} @@ -191,15 +191,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ matrix.python-version }} @@ -219,7 +219,7 @@ jobs: matrix.python-version == '3.14' && env.CODECOV_TOKEN != '' }} - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ env.CODECOV_TOKEN }} files: coverage-integration.xml @@ -230,10 +230,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: "3.14" diff --git a/.github/workflows/manual_release_beta.yaml b/.github/workflows/manual_release_beta.yaml index da5547da..c3095412 100644 --- a/.github/workflows/manual_release_beta.yaml +++ b/.github/workflows/manual_release_beta.yaml @@ -87,7 +87,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 doc_release_post_publish: name: Doc release post publish diff --git a/.github/workflows/manual_release_docs.yaml b/.github/workflows/manual_release_docs.yaml index eca87684..ff442c5a 100644 --- a/.github/workflows/manual_release_docs.yaml +++ b/.github/workflows/manual_release_docs.yaml @@ -49,23 +49,23 @@ jobs: check-regexp: '^Checks' - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref }} token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} @@ -95,15 +95,15 @@ jobs: SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }} - name: Set up GitHub Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload GitHub Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: ./website/build - name: Deploy artifact to GitHub Pages - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Invalidate CloudFront cache run: | diff --git a/.github/workflows/manual_release_stable.yaml b/.github/workflows/manual_release_stable.yaml index 292d136c..83e0b6fb 100644 --- a/.github/workflows/manual_release_stable.yaml +++ b/.github/workflows/manual_release_stable.yaml @@ -81,7 +81,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: GitHub release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ needs.release_prepare.outputs.tag_name }} name: ${{ needs.release_prepare.outputs.version_number }} @@ -120,7 +120,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 version_docs: name: Version docs diff --git a/.github/workflows/manual_version_docs.yaml b/.github/workflows/manual_version_docs.yaml index 3dcc35c6..e8956495 100644 --- a/.github/workflows/manual_version_docs.yaml +++ b/.github/workflows/manual_version_docs.yaml @@ -49,22 +49,22 @@ jobs: check-regexp: '^Checks' - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/on_issue.yaml b/.github/workflows/on_issue.yaml index 6799d738..90079930 100644 --- a/.github/workflows/on_issue.yaml +++ b/.github/workflows/on_issue.yaml @@ -18,7 +18,7 @@ jobs: steps: # Add the "t-tooling" label to all new issues - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | github.rest.issues.addLabels({ diff --git a/.github/workflows/on_schedule_regenerate_models.yaml b/.github/workflows/on_schedule_regenerate_models.yaml index 29506a7d..a72ce038 100644 --- a/.github/workflows/on_schedule_regenerate_models.yaml +++ b/.github/workflows/on_schedule_regenerate_models.yaml @@ -39,14 +39,14 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: master token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} fetch-depth: 0 - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} @@ -234,7 +234,7 @@ jobs: }' > slack-payload.json - name: Send Slack notification - uses: slackapi/slack-github-action@v4.0.0 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: webhook: ${{ secrets.SLACK_WEBHOOK_URL }} webhook-type: incoming-webhook From d525e7f11a6d67567c3d08a48b5b61cf372c555c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:19:14 +0200 Subject: [PATCH 2/2] ci: pin branch-referenced actions to commit SHAs --- .github/workflows/manual_release_beta.yaml | 2 +- .github/workflows/manual_release_stable.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/manual_release_beta.yaml b/.github/workflows/manual_release_beta.yaml index c3095412..cd30c964 100644 --- a/.github/workflows/manual_release_beta.yaml +++ b/.github/workflows/manual_release_beta.yaml @@ -87,7 +87,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 doc_release_post_publish: name: Doc release post publish diff --git a/.github/workflows/manual_release_stable.yaml b/.github/workflows/manual_release_stable.yaml index 83e0b6fb..72d0c3b5 100644 --- a/.github/workflows/manual_release_stable.yaml +++ b/.github/workflows/manual_release_stable.yaml @@ -120,7 +120,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 version_docs: name: Version docs