Skip to content

Hash pin GitHub Actions#307

Merged
hugovk merged 2 commits intopython:mainfrom
hugovk:hash-pin-gha
Apr 24, 2026
Merged

Hash pin GitHub Actions#307
hugovk merged 2 commits intopython:mainfrom
hugovk:hash-pin-gha

Conversation

@hugovk
Copy link
Copy Markdown
Member

@hugovk hugovk commented Apr 24, 2026

Yet another compromise via unpinned GitHub Actions: https://socket.dev/blog/bitwarden-cli-compromised

Let's hash-pin GHA for our PyPI packages.

Done via uvx gha-update.


📚 Documentation preview 📚: https://python-docs-theme-previews--307.org.readthedocs.build/

Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread .github/zizmor.yml Outdated
Co-authored-by: Stan Ulbrych <stan@python.org>
@hugovk hugovk merged commit 0855101 into python:main Apr 24, 2026
14 checks passed
@hugovk hugovk deleted the hash-pin-gha branch April 24, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants