From bf989861c64e31cf79cc905d90ac620de72f32c3 Mon Sep 17 00:00:00 2001 From: abrichr Date: Wed, 26 Aug 2026 10:58:16 -0400 Subject: [PATCH] fix(ci): use the complete lifecycle action pin --- .github/workflows/quickstart-lifecycle.yml | 2 +- tests/test_quickstart_lifecycle.py | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/quickstart-lifecycle.yml b/.github/workflows/quickstart-lifecycle.yml index 58a972a8d..e3943d5e1 100644 --- a/.github/workflows/quickstart-lifecycle.yml +++ b/.github/workflows/quickstart-lifecycle.yml @@ -43,7 +43,7 @@ jobs: - name: Upload lifecycle evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0 # v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: launcher-quickstart-ubuntu path: | diff --git a/tests/test_quickstart_lifecycle.py b/tests/test_quickstart_lifecycle.py index 476b79490..cc321509a 100644 --- a/tests/test_quickstart_lifecycle.py +++ b/tests/test_quickstart_lifecycle.py @@ -2,6 +2,7 @@ import importlib.util import json +import re import subprocess from pathlib import Path @@ -95,3 +96,11 @@ def test_workflow_runs_the_public_command_in_one_bounded_weekly_job(): run = next(step["run"] for step in steps if step.get("name", "").startswith("Run")) assert "scripts/quickstart_lifecycle.py" in run assert "--browser-with-deps" in run + + +def test_workflow_pins_actions_to_full_commit_shas(): + workflow = WORKFLOW.read_text(encoding="utf-8") + action_refs = re.findall(r"(?m)^\s*uses:\s+\S+@([^\s#]+)", workflow) + + assert action_refs + assert all(re.fullmatch(r"[0-9a-f]{40}", ref) for ref in action_refs)