From a377a4a693665cf67e6d811e1a0dd09d7db9951d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 22 May 2026 21:31:44 +0000 Subject: [PATCH 1/3] Upgrade all third-party actions and pin them to immutable releases --- .github/workflows/R-CMD-check.yaml | 10 +++++----- .github/workflows/docs.yaml | 16 ++++++++-------- .github/workflows/pre-commit.yaml | 2 +- .github/workflows/pypi-publish.yaml | 8 ++++---- .github/workflows/python-build-and-test.yaml | 6 +++--- .github/workflows/test-coverage.yaml | 8 ++++---- 6 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 5295f41..ead79eb 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -22,25 +22,25 @@ jobs: R_KEEP_PKG_SOURCE: yes steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Setup pandoc - uses: r-lib/actions/setup-pandoc@v2 + uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e - name: Setup R - uses: r-lib/actions/setup-r@v2 + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: r-version: ${{ matrix.config.r }} http-user-agent: ${{ matrix.config.http-user-agent }} use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@v2 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: extra-packages: any::rcmdcheck needs: check - name: Check R package - uses: r-lib/actions/check-r-package@v2 + uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: upload-snapshots: true diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index c676a47..252ec5d 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -15,24 +15,24 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Setup pandoc - uses: r-lib/actions/setup-pandoc@v2 + uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e - name: Setup R - uses: r-lib/actions/setup-r@v2 + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@v2 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: extra-packages: any::pkgdown, local::. needs: website - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@v8.1.0 - name: Setup Python shell: bash @@ -54,10 +54,10 @@ jobs: shell: bash - name: Configure pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 with: path: 'docs' @@ -74,4 +74,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index f1b6fd2..9ebca9d 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Run pre-commit checks uses: ccao-data/actions/pre-commit@main diff --git a/.github/workflows/pypi-publish.yaml b/.github/workflows/pypi-publish.yaml index a4d4761..003cb88 100644 --- a/.github/workflows/pypi-publish.yaml +++ b/.github/workflows/pypi-publish.yaml @@ -29,10 +29,10 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@v8.1.0 - name: Build Python dist working-directory: python @@ -47,7 +47,7 @@ jobs: if: ${{ github.event.action == 'prereleased' || inputs.environment == 'test' }} env: url: https://test.pypi.org/legacy/p/ccao - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b with: repository-url: https://test.pypi.org/legacy/ # The build step builds the package distribution in the `python/` @@ -62,6 +62,6 @@ jobs: if: ${{ github.event.action == 'released' || inputs.environment == 'prod' }} env: url: https://pypi.org/p/ccao - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b with: packages-dir: python/dist/ diff --git a/.github/workflows/python-build-and-test.yaml b/.github/workflows/python-build-and-test.yaml index fd338ec..6e1cdcc 100644 --- a/.github/workflows/python-build-and-test.yaml +++ b/.github/workflows/python-build-and-test.yaml @@ -18,17 +18,17 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@v8.1.0 with: enable-cache: true cache-dependency-glob: python/pyproject.toml cache-suffix: ${{ matrix.python-version }}-test - name: Install Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/test-coverage.yaml b/.github/workflows/test-coverage.yaml index 648a503..665d29e 100644 --- a/.github/workflows/test-coverage.yaml +++ b/.github/workflows/test-coverage.yaml @@ -10,15 +10,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Setup R - uses: r-lib/actions/setup-r@v2 + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@v2 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e with: extra-packages: any::covr needs: coverage @@ -41,7 +41,7 @@ jobs: - name: Upload test results if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: coverage-test-failures path: ${{ runner.temp }}/package From 0386a42a8e87f6642d28dbfc95c73cd66bc39991 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 22 May 2026 22:19:44 +0000 Subject: [PATCH 2/3] Add version comments to commit-hash pinned actions --- .github/workflows/R-CMD-check.yaml | 10 +++++----- .github/workflows/docs.yaml | 14 +++++++------- .github/workflows/pre-commit.yaml | 2 +- .github/workflows/pypi-publish.yaml | 6 +++--- .github/workflows/python-build-and-test.yaml | 4 ++-- .github/workflows/test-coverage.yaml | 8 ++++---- 6 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index ead79eb..4aaa6d6 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -22,25 +22,25 @@ jobs: R_KEEP_PKG_SOURCE: yes steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup pandoc - uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: r-version: ${{ matrix.config.r }} http-user-agent: ${{ matrix.config.http-user-agent }} use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: extra-packages: any::rcmdcheck needs: check - name: Check R package - uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: upload-snapshots: true diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 252ec5d..6364334 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -15,18 +15,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup pandoc - uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: extra-packages: any::pkgdown, local::. needs: website @@ -54,10 +54,10 @@ jobs: shell: bash - name: Configure pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: 'docs' @@ -74,4 +74,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index 9ebca9d..705bf1d 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run pre-commit checks uses: ccao-data/actions/pre-commit@main diff --git a/.github/workflows/pypi-publish.yaml b/.github/workflows/pypi-publish.yaml index 003cb88..2fdeeb1 100644 --- a/.github/workflows/pypi-publish.yaml +++ b/.github/workflows/pypi-publish.yaml @@ -29,7 +29,7 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install uv uses: astral-sh/setup-uv@v8.1.0 @@ -47,7 +47,7 @@ jobs: if: ${{ github.event.action == 'prereleased' || inputs.environment == 'test' }} env: url: https://test.pypi.org/legacy/p/ccao - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: repository-url: https://test.pypi.org/legacy/ # The build step builds the package distribution in the `python/` @@ -62,6 +62,6 @@ jobs: if: ${{ github.event.action == 'released' || inputs.environment == 'prod' }} env: url: https://pypi.org/p/ccao - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: packages-dir: python/dist/ diff --git a/.github/workflows/python-build-and-test.yaml b/.github/workflows/python-build-and-test.yaml index 6e1cdcc..95de1de 100644 --- a/.github/workflows/python-build-and-test.yaml +++ b/.github/workflows/python-build-and-test.yaml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install uv uses: astral-sh/setup-uv@v8.1.0 @@ -28,7 +28,7 @@ jobs: cache-suffix: ${{ matrix.python-version }}-test - name: Install Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/test-coverage.yaml b/.github/workflows/test-coverage.yaml index 665d29e..8af82db 100644 --- a/.github/workflows/test-coverage.yaml +++ b/.github/workflows/test-coverage.yaml @@ -10,15 +10,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 with: extra-packages: any::covr needs: coverage @@ -41,7 +41,7 @@ jobs: - name: Upload test results if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-test-failures path: ${{ runner.temp }}/package From b518e0e3fb8688d478807227ee13154390fc98d7 Mon Sep 17 00:00:00 2001 From: Jean Cochrane Date: Thu, 28 May 2026 16:55:53 -0500 Subject: [PATCH 3/3] Specify full version string for `r-lib/actions` commit hashes in all workflows --- .github/workflows/R-CMD-check.yaml | 8 ++++---- .github/workflows/docs.yaml | 6 +++--- .github/workflows/test-coverage.yaml | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 4aaa6d6..4e64c17 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -25,22 +25,22 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup pandoc - uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: r-version: ${{ matrix.config.r }} http-user-agent: ${{ matrix.config.http-user-agent }} use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: extra-packages: any::rcmdcheck needs: check - name: Check R package - uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: upload-snapshots: true diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 6364334..049ec75 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -18,15 +18,15 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup pandoc - uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-pandoc@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: extra-packages: any::pkgdown, local::. needs: website diff --git a/.github/workflows/test-coverage.yaml b/.github/workflows/test-coverage.yaml index 8af82db..741bdde 100644 --- a/.github/workflows/test-coverage.yaml +++ b/.github/workflows/test-coverage.yaml @@ -13,12 +13,12 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: use-public-rspm: true - name: Setup R dependencies - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 with: extra-packages: any::covr needs: coverage