From 6763a078205eff538632e531dc3ac7c29444ed73 Mon Sep 17 00:00:00 2001 From: John Bampton Date: Sat, 20 Jun 2026 22:11:21 +1000 Subject: [PATCH] [CI] Pin remaining actions to SHA for supply chain security Cleans up the zizmor.yml linter file. https://github.com/apache/infrastructure-actions/blob/25ab499ef9c241b64a56860245e57c195baddec6/approved_patterns.yml#L279 https://github.com/r-lib/actions/commit/a51a8012b0aab7c32ef9d19bf54da93f3254335e --- .github/linters/zizmor.yml | 8 +------- .github/workflows/docs.yml | 4 ++-- .github/workflows/r.yml | 6 +++--- 3 files changed, 6 insertions(+), 12 deletions(-) diff --git a/.github/linters/zizmor.yml b/.github/linters/zizmor.yml index 9906661761e..dfb40750f0a 100644 --- a/.github/linters/zizmor.yml +++ b/.github/linters/zizmor.yml @@ -15,10 +15,4 @@ # specific language governing permissions and limitations # under the License. -rules: - unpinned-uses: - config: - policies: - r-lib/actions/check-r-package: any - r-lib/actions/setup-r: any - r-lib/actions/setup-r-dependencies: any +rules: {} diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 5b5c73abfd3..4b342434ced 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -75,12 +75,12 @@ jobs: - name: Sync doc environment run: uv sync --group docs - run: sudo apt update - - uses: r-lib/actions/setup-r@v2.12.0 + - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: r-version: release use-public-rspm: true - name: Query R dependencies - uses: r-lib/actions/setup-r-dependencies@v2.12.0 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: cache: true extra-packages: | diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml index d8561da4854..f106c62f4c9 100644 --- a/.github/workflows/r.yml +++ b/.github/workflows/r.yml @@ -89,12 +89,12 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: r-lib/actions/setup-r@v2.12.0 + - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: r-version: ${{ matrix.r }} use-public-rspm: true - name: Query R dependencies - uses: r-lib/actions/setup-r-dependencies@v2.12.0 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: cache: true extra-packages: | @@ -102,7 +102,7 @@ jobs: any::rcmdcheck working-directory: './R' - name: Build and check R package - uses: r-lib/actions/check-r-package@v2.12.0 + uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: build_args: 'c("--no-build-vignettes", "--no-manual")' args: 'c("--no-build-vignettes", "--no-manual", "--no-tests")'