Merge pull request #309 from finos/fix/broken-action-shas

ci: fix three unresolvable pinned action SHAs

Author: fgogolli

.github/actions/setup-uv-cached/action.yml

@@ -13,7 +13,7 @@ runs:
   using: 'composite'
   steps:
     - name: Install UV
-      uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9  # v7
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
     - name: Restore UV environment
       id: restore-cache

.github/actions/setup-uv-fresh/action.yml

@@ -21,7 +21,7 @@ runs:
         python-version: ${{ inputs.python-version }}
 
     - name: Install UV
-      uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9  # v7
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
       with:
         version: "0.9.6"
         enable-cache: true

.github/workflows/dev-pypi.yml

@@ -89,7 +89,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
 

.github/workflows/prod-release.yml

@@ -62,7 +62,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
 
@@ -114,7 +114,7 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/
@@ -228,7 +228,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/
@@ -324,7 +324,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/

.github/workflows/semantic-release.yml

@@ -113,7 +113,7 @@ jobs:
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
       - name: Setup Bun (for UI static bundle)
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage