Merge pull request #313 from algorandfoundation/ci/harden-workflows-cleanup-alpha

ci: pin action SHAs to latest, fix devportal docs and retire alpha channel

Author: mrcointreau

.github/actions/publish-docs/action.yml

@@ -9,12 +9,12 @@ runs:
       with:
         install-algokit: "false"
 
-    - name: Set up Node.js 22
-      uses: actions/setup-node@v4
+    - name: Set up Node.js 24
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: "22"
+        node-version: "24.x"
 
-    - uses: pnpm/action-setup@v4
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
       with:
         package_json_file: docs/package.json
 

.github/workflows/build-python.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Python environment
         uses: algorandfoundation/algokit-shared-config/.github/actions/setup-algokit-python@main
@@ -90,15 +90,15 @@ jobs:
 
       - name: pytest coverage comment - using Python 3.10 on ubuntu-latest
         if: matrix.python == '3.10' && matrix.os == 'ubuntu-latest'
-        uses: MishaKav/pytest-coverage-comment@main
+        uses: MishaKav/pytest-coverage-comment@dd5b80bde6d16941f336518e92929e89069d8451 # v1.7.2
         continue-on-error: true # forks fail to add a comment, so continue any way
         with:
           pytest-coverage-path: ./pytest-coverage.txt
           junitxml-path: ./pytest-junit.xml
 
       - name: Upload test results and coverage artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: test-results-python-${{ matrix.python }}
           path: pytest-junit.xml

.github/workflows/cd.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - alpha
     paths-ignore:
       - ".github/**"
   workflow_dispatch:
@@ -45,13 +44,13 @@ jobs:
 
     steps:
       - name: Generate bot token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app_token
         with:
           app-id: ${{ secrets.BOT_ID }}
           private-key: ${{ secrets.BOT_SK }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # Fetch entire repository history so we can determine version number from it
           fetch-depth: 0
@@ -70,15 +69,6 @@ jobs:
       - name: Set Git user as GitHub actions
         run: git config --global user.email "179917785+engineering-ci[bot]@users.noreply.github.com" && git config --global user.name "engineering-ci[bot]"
 
-      - name: Create Continuous Deployment - Alpha
-        id: release-alpha
-        if: steps.get_branch.outputs.branch == 'alpha'
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          uv run semantic-release -v version --as-prerelease --prerelease-token alpha
-          uv run semantic-release publish
-
       - name: Create Continuous Deployment - Beta (non-prod)
         id: release-beta
         if: steps.get_branch.outputs.branch == 'main' && !inputs.production_release
@@ -99,10 +89,9 @@ jobs:
 
       - name: Publish package distributions to PyPI
         if: |
-          (steps.release-alpha.outputs.released == 'true') ||
           (steps.release-beta.outputs.released == 'true') ||
           (steps.release-prod.outputs.released == 'true')
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           verbose: true
 
@@ -123,16 +112,16 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Build documentation
         uses: ./.github/actions/publish-docs
 
       - name: Upload to GitHub Pages
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: docs/dist
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/check-docs.yaml

@@ -8,7 +8,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Python environment
         uses: algorandfoundation/algokit-shared-config/.github/actions/setup-algokit-python@main

.github/workflows/check-python.yaml

@@ -8,7 +8,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Python environment
         uses: algorandfoundation/algokit-shared-config/.github/actions/setup-algokit-python@main

.github/workflows/publish-devportal-docs.yml

@@ -3,7 +3,7 @@ name: Publish DevPortal Docs
 on:
   workflow_dispatch:
   push:
-    branches: [ci/add-publish-to-devportal-workflow] # change to decoupling, then main when ready
+    branches: [main]
     tags: ['v*']
 
 permissions:
@@ -13,13 +13,13 @@ jobs:
   publish-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 22
+          node-version: 24.x
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
         with:
           package_json_file: docs/package.json
 
@@ -32,6 +32,6 @@ jobs:
         run: uv run poe docs-api
 
       - name: Publish DevPortal Docs
-        uses: algorandfoundation/devportal/.github/actions/publish-devportal-docs@ci/update-publish-devportal-docs-workflow
+        uses: algorandfoundation/devportal/.github/actions/publish-devportal-docs@release/ak-v4
         with:
           docs-dir: docs

.github/workflows/verify-examples.yaml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Python environment
         uses: algorandfoundation/algokit-shared-config/.github/actions/setup-algokit-python@main

pyproject.toml

@@ -289,10 +289,6 @@ sequence = [
 ]
 help = "Preview current and next prerelease version"
 
-[tool.poe.tasks.release-dry-run-alpha]
-shell = "semantic-release --noop version --as-prerelease --prerelease-token alpha"
-help = "Dry-run alpha release (no changes made)"
-
 [tool.poe.tasks.release-dry-run-beta]
 shell = "semantic-release --noop version --as-prerelease --prerelease-token beta"
 help = "Dry-run beta release (no changes made)"
@@ -361,11 +357,6 @@ match = "main"
 prerelease_token = "beta"
 prerelease = false
 
-[tool.semantic_release.branches.alpha]
-match = "alpha"
-prerelease_token = "alpha"
-prerelease = true
-
 [tool.semantic_release.commit_parser_options]
 allowed_tags = [
   "build",