From 1c3a6abf87398a583b4de88a98f8f3ae0b81c8fd Mon Sep 17 00:00:00 2001 From: Lyu Date: Thu, 16 Jul 2026 11:28:49 -0700 Subject: [PATCH 1/2] ci: pin Python release actions --- .github/workflows/publish.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2662385..b046cfe 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -19,9 +19,9 @@ jobs: outputs: stable: ${{ steps.version.outputs.stable }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.11" @@ -64,7 +64,7 @@ jobs: /tmp/insforge-wheel-test/bin/python -c 'import insforge; from importlib.metadata import version; print(version("insforge"))' - name: Upload distributions - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: python-package-distributions path: dist/ @@ -79,7 +79,7 @@ jobs: id-token: write steps: - name: Download distributions - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: python-package-distributions path: dist/ From 39974c34a808eacb6dc4494b41b7430a2b8e2999 Mon Sep 17 00:00:00 2001 From: Lyu Date: Thu, 16 Jul 2026 11:41:09 -0700 Subject: [PATCH 2/2] ci: enable Dependabot for actions --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5ace460 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly"