diff --git a/.github/workflows/base_test_workflow.yml b/.github/workflows/base_test_workflow.yml index a3c4c7907..b859716a1 100644 --- a/.github/workflows/base_test_workflow.yml +++ b/.github/workflows/base_test_workflow.yml @@ -55,8 +55,8 @@ jobs: TOX_ARGS: ${{ inputs.tox_args }} PYTEST_ARGS: ${{ inputs.pytest_args }} steps: - - uses: actions/checkout@v6.0.2 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 name: Install Python ${{ inputs.python_version }} with: python-version: ${{ inputs.python_version }} diff --git a/.github/workflows/check_pr_title.yml b/.github/workflows/check_pr_title.yml index db49381c5..01f4f2018 100644 --- a/.github/workflows/check_pr_title.yml +++ b/.github/workflows/check_pr_title.yml @@ -1,7 +1,7 @@ name: Check PR title on: - pull_request_target: + pull_request: types: - opened - reopened @@ -9,7 +9,6 @@ on: - synchronize - labeled - unlabeled - pull_request: paths: - '.github/workflows/check_pr_title.yml' @@ -27,7 +26,7 @@ jobs: runs-on: ubuntu-slim if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip check PR title') }} steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.ref }} repository: ${{ github.event.pull_request.head.repo.full_name }} diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 86f66a9f0..b79f7033c 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -43,7 +43,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/make_release.yml b/.github/workflows/make_release.yml index 43e987fcd..f45476c58 100644 --- a/.github/workflows/make_release.yml +++ b/.github/workflows/make_release.yml @@ -15,7 +15,7 @@ jobs: attestations: write id-token: write steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: hynek/build-and-inspect-python-package@v2.18.0 @@ -31,8 +31,8 @@ jobs: os: ["ubuntu-22.04", "windows-2022", "macos-15-intel", "macos-15"] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6.0.2 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Setup headless display @@ -48,7 +48,7 @@ jobs: run: python build_utils/create_and_pack_executable.py - name: Publish PartSeg bundle - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: PartSeg_bundle_${{ matrix.os }} path: dist2 @@ -67,13 +67,13 @@ jobs: - build_pyinstaller_bundle runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: 'PartSeg_bundle_*' path: pyinstaller merge-multiple: true - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: Packages path: dist diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 8fa76a1fb..b124b0399 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -28,7 +28,7 @@ jobs: steps: # Fetch project source with GitHub Actions Checkout. - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Run the "semgrep ci" command on the command line of the docker image. - run: semgrep ci env: diff --git a/.github/workflows/test_napari_repo.yml b/.github/workflows/test_napari_repo.yml index 2d61d0c73..e216fb82c 100644 --- a/.github/workflows/test_napari_repo.yml +++ b/.github/workflows/test_napari_repo.yml @@ -16,11 +16,11 @@ jobs: name: Download test data runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - shell: bash run: bash build_utils/download_data.sh - name: Upload test data - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: test_data path: test_data @@ -37,10 +37,10 @@ jobs: python: ['3.11', '3.12', '3.13', '3.14'] napari_version: ['repo'] steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python }} - uses: actions/setup-python@v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python }} @@ -56,7 +56,7 @@ jobs: pip install setuptools tox tox-gh-actions - name: Download test data - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: test_data path: test_data diff --git a/.github/workflows/test_prereleases.yml b/.github/workflows/test_prereleases.yml index 9cf5d5ac9..1f154dad7 100644 --- a/.github/workflows/test_prereleases.yml +++ b/.github/workflows/test_prereleases.yml @@ -32,7 +32,7 @@ jobs: name: Download test data runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - shell: bash run: bash build_utils/download_data.sh - name: Upload test data @@ -53,10 +53,10 @@ jobs: platform: [windows-2022, macos-14, ubuntu-24.04] python: [3.12] steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python }} - uses: actions/setup-python@v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python }} cache: 'pip' @@ -121,7 +121,7 @@ jobs: name: "Test pyinstaller build" runs-on: "ubuntu-latest" steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install the latest version of uv uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 3a1d0f223..f3c67bdae 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -25,7 +25,7 @@ jobs: name: Action lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check workflow files run: | bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) @@ -36,11 +36,11 @@ jobs: name: Download test data runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - shell: bash run: bash build_utils/download_data.sh - name: Upload test data - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: test_data path: test_data @@ -144,8 +144,8 @@ jobs: runs-on: ubuntu-latest needs: [test_coverage, test_minimal] steps: - - uses: actions/checkout@v6.0.2 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.x" cache-dependency-path: pyproject.toml @@ -186,7 +186,7 @@ jobs: runs-on: ubuntu-24.04 needs: download_data steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Miniconda uses: conda-incubator/setup-miniconda@v4.0.1 with: @@ -245,7 +245,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: hynek/build-and-inspect-python-package@v2.18.0 diff --git a/.github/workflows/upgrade-dependencies.yml b/.github/workflows/upgrade-dependencies.yml index 9b0f3063f..9fceaf4fb 100644 --- a/.github/workflows/upgrade-dependencies.yml +++ b/.github/workflows/upgrade-dependencies.yml @@ -15,7 +15,7 @@ jobs: # It doesn't matter if it's deleted when merged, it'll be re-created BRANCH_NAME: auto-dependency-upgrades steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # with: # # [Optional] Use a separate key to automatically execute checks on the resulting PR # # https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs @@ -23,7 +23,7 @@ jobs: # START PYTHON DEPENDENCIES - - uses: actions/setup-python@v6 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" cache: pip