From 3aedbcb5953cb82bae7368ca99aebc3337c7f0bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:04:01 +0200 Subject: [PATCH 1/2] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/_checks.yaml | 24 +++++++++---------- .github/workflows/manual_release_beta.yaml | 2 +- .github/workflows/manual_release_docs.yaml | 14 +++++------ .github/workflows/manual_release_stable.yaml | 4 ++-- .github/workflows/manual_version_docs.yaml | 8 +++---- .github/workflows/on_issue.yaml | 2 +- .github/workflows/on_schedule_tests.yaml | 10 ++++---- .../workflows/update_playwright_version.yaml | 4 ++-- 8 files changed, 34 insertions(+), 34 deletions(-) diff --git a/.github/workflows/_checks.yaml b/.github/workflows/_checks.yaml index 2b9a3c6493..1be14dd59e 100644 --- a/.github/workflows/_checks.yaml +++ b/.github/workflows/_checks.yaml @@ -24,18 +24,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run actionlint - uses: rhysd/actionlint@v1.7.12 + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 spell_check: name: Spell check runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check spelling with typos - uses: crate-ci/typos@v1 + uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0 lint_check: name: Lint check @@ -54,10 +54,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -75,10 +75,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -100,7 +100,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -108,7 +108,7 @@ jobs: # images in another format so they get converted via `pnpm opt:images` first. - name: Get changed unoptimized images id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: | docs/**/*.{png,jpg,jpeg,gif,bmp,tif,tiff,avif} @@ -146,10 +146,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: "3.14" diff --git a/.github/workflows/manual_release_beta.yaml b/.github/workflows/manual_release_beta.yaml index 1a179a5908..a7dbe130a3 100644 --- a/.github/workflows/manual_release_beta.yaml +++ b/.github/workflows/manual_release_beta.yaml @@ -95,7 +95,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 doc_release_post_publish: name: Doc release post publish diff --git a/.github/workflows/manual_release_docs.yaml b/.github/workflows/manual_release_docs.yaml index 2eca5ff136..e4bfb50a56 100644 --- a/.github/workflows/manual_release_docs.yaml +++ b/.github/workflows/manual_release_docs.yaml @@ -49,23 +49,23 @@ jobs: check-regexp: '^Checks' - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref }} token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} @@ -84,15 +84,15 @@ jobs: SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }} - name: Set up GitHub Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload GitHub Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: ./website/build - name: Deploy artifact to GitHub Pages - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Invalidate CloudFront cache run: | diff --git a/.github/workflows/manual_release_stable.yaml b/.github/workflows/manual_release_stable.yaml index a49ba14527..85439129c5 100644 --- a/.github/workflows/manual_release_stable.yaml +++ b/.github/workflows/manual_release_stable.yaml @@ -81,7 +81,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: GitHub release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ needs.release_prepare.outputs.tag_name }} name: ${{ needs.release_prepare.outputs.version_number }} @@ -128,7 +128,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 # TODO: add job for publish package to Conda # https://github.com/apify/crawlee-python/issues/104 diff --git a/.github/workflows/manual_version_docs.yaml b/.github/workflows/manual_version_docs.yaml index 3dcc35c65d..e89564958d 100644 --- a/.github/workflows/manual_version_docs.yaml +++ b/.github/workflows/manual_version_docs.yaml @@ -49,22 +49,22 @@ jobs: check-regexp: '^Checks' - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/on_issue.yaml b/.github/workflows/on_issue.yaml index 6799d73869..90079930aa 100644 --- a/.github/workflows/on_issue.yaml +++ b/.github/workflows/on_issue.yaml @@ -18,7 +18,7 @@ jobs: steps: # Add the "t-tooling" label to all new issues - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | github.rest.issues.addLabels({ diff --git a/.github/workflows/on_schedule_tests.yaml b/.github/workflows/on_schedule_tests.yaml index 00f9d28e67..5189c95506 100644 --- a/.github/workflows/on_schedule_tests.yaml +++ b/.github/workflows/on_schedule_tests.yaml @@ -50,10 +50,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -63,7 +63,7 @@ jobs: token: ${{ secrets.APIFY_TEST_USER_API_TOKEN }} - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -72,7 +72,7 @@ jobs: run: pipx install poetry - name: Set up uv package manager - uses: astral-sh/setup-uv@v10.0.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: python-version: ${{ env.PYTHON_VERSION }} @@ -183,7 +183,7 @@ jobs: }' > slack-payload.json - name: Send Slack notification - uses: slackapi/slack-github-action@v4.0.0 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: # Without this the action swallows every delivery error into a hidden debug log line and # reports success, so a rejected or undeliverable alert looks exactly like a sent one. diff --git a/.github/workflows/update_playwright_version.yaml b/.github/workflows/update_playwright_version.yaml index 4859ececde..3911c8b0dd 100644 --- a/.github/workflows/update_playwright_version.yaml +++ b/.github/workflows/update_playwright_version.yaml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} fetch-depth: 0 @@ -41,7 +41,7 @@ jobs: fi - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' From 6b43e388a4a7cdf4840ccc6da7d2828d2ab5d096 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:19:26 +0200 Subject: [PATCH 2/2] ci: pin branch-referenced actions to commit SHAs --- .github/workflows/manual_release_beta.yaml | 2 +- .github/workflows/manual_release_stable.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/manual_release_beta.yaml b/.github/workflows/manual_release_beta.yaml index a7dbe130a3..454ab4e0b8 100644 --- a/.github/workflows/manual_release_beta.yaml +++ b/.github/workflows/manual_release_beta.yaml @@ -95,7 +95,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 doc_release_post_publish: name: Doc release post publish diff --git a/.github/workflows/manual_release_stable.yaml b/.github/workflows/manual_release_stable.yaml index 85439129c5..c76d7231f7 100644 --- a/.github/workflows/manual_release_stable.yaml +++ b/.github/workflows/manual_release_stable.yaml @@ -128,7 +128,7 @@ jobs: # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication. - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@{"message":"Not # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 # TODO: add job for publish package to Conda # https://github.com/apify/crawlee-python/issues/104