Skip to content

ci: update external action pins #906

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rapids-bot merged 2 commits into from
Aug 26, 2026
Merged

ci: update external action pins #906

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d4809e8
ci: update external action pins
willkill07 Aug 26, 2026
6c058c3
ci: harden checkout credentials
willkill07 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,9 @@ jobs:
contents: write
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Download CLI distribution artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand Down Expand Up @@ -341,7 +343,7 @@ jobs:
)

- name: Upload CLI assets and checksums to draft GitHub Release
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
uses: softprops/action-gh-release@fe965f7af51af5f2602596916f38a38df2e33de0 # v3.0.2
with:
draft: true
prerelease: ${{ contains(github.ref_name, '-alpha.') || contains(github.ref_name, '-beta.') || contains(github.ref_name, '-rc.') }}
Expand All @@ -364,13 +366,15 @@ jobs:
UV_PYTHON_PREFERENCE: only-system
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand All @@ -396,7 +400,7 @@ jobs:

- name: Authenticate to crates.io with trusted publishing
id: crates-io-auth
uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

- name: Publish to crates.io with trusted publishing
working-directory: ${{ github.workspace }}
Expand Down Expand Up @@ -482,7 +486,7 @@ jobs:
fi

- name: Publish to PyPI with trusted publishing
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
with:
skip-existing: true

Expand All @@ -498,16 +502,19 @@ jobs:
environment: npm
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ steps.ci-config.outputs.node_version }}
registry-url: "https://registry.npmjs.org"
Comment thread
coderabbitai[bot] marked this conversation as resolved.
package-manager-cache: false

- name: Download split Node package artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/ci_changes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,10 @@ jobs:
steps:
- name: Checkout
if: ${{ ! inputs.full_ci }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
persist-credentials: false

- name: Resolve comparison base
id: comparison-base
Expand Down Expand Up @@ -121,7 +122,7 @@ jobs:
- name: Detect changed paths
id: filter
if: ${{ ! inputs.full_ci }}
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.01
uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
with:
base: ${{ steps.comparison-base.outputs.base }}
filters: .github/ci-path-filters.yml
11 changes: 6 additions & 5 deletions .github/workflows/ci_check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ jobs:
fi

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand Down Expand Up @@ -127,9 +127,10 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
coderabbitai[bot] marked this conversation as resolved.
with:
fetch-depth: 0
persist-credentials: false

- name: Load CI tool versions
id: ci-config
Expand All @@ -151,11 +152,11 @@ jobs:
with:
python-version: ${{ steps.ci-config.outputs.default_python_version }}

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ steps.ci-config.outputs.node_version }}

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand All @@ -180,7 +181,7 @@ jobs:
tool: cargo-about@${{ steps.ci-config.outputs.cargo_about_version }}

- name: Cache pre-commit environments
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ runner.temp }}/.cache/pre-commit
key: >-
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/ci_go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,15 @@ jobs:
fi

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand Down Expand Up @@ -87,7 +89,7 @@ jobs:
just --set ci true --set output_dir "${{ github.workspace }}" test-go

- name: Upload Go coverage to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
uses: codecov/codecov-action@e53489f4d376d79066609109e7a95a29eb3740b1 # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
disable_search: true
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/ci_license_diff.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

Expand All @@ -53,7 +53,7 @@ jobs:
with:
python-version: ${{ steps.ci-config.outputs.default_python_version }}

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand Down Expand Up @@ -147,7 +147,7 @@ jobs:

- name: Upsert PR comment
if: ${{ steps.comment.outputs.pr_number != '' }}
uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
with:
header: nemo-relay-license-diff
number: ${{ steps.comment.outputs.pr_number }}
Expand Down
30 changes: 18 additions & 12 deletions .github/workflows/ci_node.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,13 +86,15 @@ jobs:
fi

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand All @@ -109,7 +111,7 @@ jobs:
with:
tool: cargo-llvm-cov@${{ steps.ci-config.outputs.cargo_llvm_cov_version }},just@${{ steps.ci-config.outputs.just_version }}

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ steps.ci-config.outputs.node_version }}

Expand All @@ -123,7 +125,7 @@ jobs:
run: just --set ci true test-openclaw

- name: Upload Node coverage to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
uses: codecov/codecov-action@e53489f4d376d79066609109e7a95a29eb3740b1 # v7.0.0
if: ${{ !startsWith(matrix.platform, 'windows') }}
with:
token: ${{ secrets.CODECOV_TOKEN }}
Expand Down Expand Up @@ -175,13 +177,15 @@ jobs:
fi

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand All @@ -205,7 +209,7 @@ jobs:
enable-cache: true
cache-dependency-glob: ${{ env.NEMO_RELAY_CI_WORKSPACE }}/uv.lock

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ steps.ci-config.outputs.node_version }}

Expand Down Expand Up @@ -264,13 +268,15 @@ jobs:
contents: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand All @@ -283,7 +289,7 @@ jobs:
cache-bin: false
save-if: false

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ steps.ci-config.outputs.node_version }}

Expand Down Expand Up @@ -350,7 +356,7 @@ jobs:

- name: Checkout
if: ${{ !contains(matrix.platform, 'musl') }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -359,7 +365,7 @@ jobs:
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
if: ${{ !contains(matrix.platform, 'musl') }}
with:
node-version: ${{ steps.ci-config.outputs.node_version }}
Expand Down
18 changes: 11 additions & 7 deletions .github/workflows/ci_python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,13 +76,15 @@ jobs:
fi

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
cache: false
toolchain: ${{ steps.ci-config.outputs.rust_version }}
Expand Down Expand Up @@ -127,7 +129,7 @@ jobs:
run: just --set ci true --set output_dir "${{ github.workspace }}" test-python-langchain

- name: Upload Python coverage to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
uses: codecov/codecov-action@e53489f4d376d79066609109e7a95a29eb3740b1 # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
disable_search: true
Expand Down Expand Up @@ -178,13 +180,15 @@ jobs:
fi

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Load CI tool versions
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
if: ${{ !contains(matrix.platform, 'musl') }}
with:
cache: false
Expand Down Expand Up @@ -398,7 +402,7 @@ jobs:

- name: Checkout
if: ${{ !contains(matrix.platform, 'musl') }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -407,7 +411,7 @@ jobs:
id: ci-config
uses: ./.github/actions/load-ci-tool-versions

- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
- uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
if: ${{ matrix.platform == 'source-and-plugin' }}
with:
cache: false
Expand Down
Loading