From 37a613a0725dd2894e5ae9965a17abafc06ca344 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:04:33 +0200 Subject: [PATCH 1/2] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/_checks.yaml | 40 ++++++++++---------- .github/workflows/manual_release_beta.yaml | 2 +- .github/workflows/manual_release_docs.yaml | 14 +++---- .github/workflows/manual_release_stable.yaml | 4 +- .github/workflows/manual_version_docs.yaml | 8 ++-- .github/workflows/on_issue.yaml | 2 +- 6 files changed, 35 insertions(+), 35 deletions(-) diff --git a/.github/workflows/_checks.yaml b/.github/workflows/_checks.yaml index 8a3e3b5a..a962345e 100644 --- a/.github/workflows/_checks.yaml +++ b/.github/workflows/_checks.yaml @@ -24,18 +24,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run actionlint - uses: rhysd/actionlint@v1.7.12 + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 spell_check: name: Spell check runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check spelling with typos - uses: crate-ci/typos@v1 + uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0 lint_check: name: Lint check @@ -54,10 +54,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -75,10 +75,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -100,7 +100,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -108,7 +108,7 @@ jobs: # images in another format so they get converted via `pnpm opt:images` first. - name: Get changed unoptimized images id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: | docs/**/*.{png,jpg,jpeg,gif,bmp,tif,tiff,avif} @@ -165,15 +165,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ matrix.python-version }} @@ -193,7 +193,7 @@ jobs: matrix.python-version == '3.14' && env.CODECOV_TOKEN != '' }} - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -225,15 +225,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ matrix.python-version }} @@ -253,7 +253,7 @@ jobs: matrix.python-version == '3.14' && env.CODECOV_TOKEN != '' }} - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -266,10 +266,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: "3.14" diff --git a/.github/workflows/manual_release_beta.yaml b/.github/workflows/manual_release_beta.yaml index ea5530d4..7bad4761 100644 --- a/.github/workflows/manual_release_beta.yaml +++ b/.github/workflows/manual_release_beta.yaml @@ -87,7 +87,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 doc_release_post_publish: name: Doc release post publish diff --git a/.github/workflows/manual_release_docs.yaml b/.github/workflows/manual_release_docs.yaml index eca87684..ff442c5a 100644 --- a/.github/workflows/manual_release_docs.yaml +++ b/.github/workflows/manual_release_docs.yaml @@ -49,23 +49,23 @@ jobs: check-regexp: '^Checks' - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref }} token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} @@ -95,15 +95,15 @@ jobs: SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }} - name: Set up GitHub Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload GitHub Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: ./website/build - name: Deploy artifact to GitHub Pages - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Invalidate CloudFront cache run: | diff --git a/.github/workflows/manual_release_stable.yaml b/.github/workflows/manual_release_stable.yaml index 456eebad..7482625c 100644 --- a/.github/workflows/manual_release_stable.yaml +++ b/.github/workflows/manual_release_stable.yaml @@ -81,7 +81,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: GitHub release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ needs.release_prepare.outputs.tag_name }} name: ${{ needs.release_prepare.outputs.version_number }} @@ -120,7 +120,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 version_docs: name: Version docs diff --git a/.github/workflows/manual_version_docs.yaml b/.github/workflows/manual_version_docs.yaml index 303c2ba8..b7abc28d 100644 --- a/.github/workflows/manual_version_docs.yaml +++ b/.github/workflows/manual_version_docs.yaml @@ -53,22 +53,22 @@ jobs: check-regexp: '^Checks' - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/on_issue.yaml b/.github/workflows/on_issue.yaml index 6799d738..90079930 100644 --- a/.github/workflows/on_issue.yaml +++ b/.github/workflows/on_issue.yaml @@ -18,7 +18,7 @@ jobs: steps: # Add the "t-tooling" label to all new issues - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | github.rest.issues.addLabels({ From 83de02bc5d9f4a971b13f219e7c744db2214c387 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:19:22 +0200 Subject: [PATCH 2/2] ci: pin branch-referenced actions to commit SHAs --- .github/workflows/manual_release_beta.yaml | 2 +- .github/workflows/manual_release_stable.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/manual_release_beta.yaml b/.github/workflows/manual_release_beta.yaml index 7bad4761..3967ad81 100644 --- a/.github/workflows/manual_release_beta.yaml +++ b/.github/workflows/manual_release_beta.yaml @@ -87,7 +87,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 doc_release_post_publish: name: Doc release post publish diff --git a/.github/workflows/manual_release_stable.yaml b/.github/workflows/manual_release_stable.yaml index 7482625c..da3e5fed 100644 --- a/.github/workflows/manual_release_stable.yaml +++ b/.github/workflows/manual_release_stable.yaml @@ -120,7 +120,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 version_docs: name: Version docs