From b0821f13d1b99f71d650cdb3f81cd5bca7cb9d63 Mon Sep 17 00:00:00 2001 From: Salman Muin Kayser Chishti <13schishti@gmail.com> Date: Tue, 16 Dec 2025 12:16:20 +0000 Subject: [PATCH 1/2] Upgrade GitHub Actions to latest versions --- .github/workflows/pypi-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index dd63cc8..4d94d3b 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -32,4 +32,4 @@ jobs: run: | python -m build - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@v1 From ca534efb39030c390105942e361967efbfd33dc5 Mon Sep 17 00:00:00 2001 From: Salman Muin Kayser Chishti <13schishti@gmail.com> Date: Wed, 17 Dec 2025 10:25:46 +0000 Subject: [PATCH 2/2] Fix pypa/gh-action-pypi-publish to use SHA pinning Pin to release/v1.13 for security best practices. The v1 tag doesn't exist - only release/v1 branch exists. Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com> --- .github/workflows/pypi-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index 4d94d3b..1cd7bd5 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -32,4 +32,4 @@ jobs: run: | python -m build - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@v1 + uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13