mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-20 14:42:28 +02:00
John KennedyandGitHub
bcf3077267
## Summary - SHA-pins 7 distinct third-party actions across 10 workflow files to full commit SHAs - Prevents supply chain attacks via tag hijacking (mutable tags can be force-pushed by a compromised maintainer account) - Tag retained as an inline comment for readability | Action | Before | After | |--------|--------|-------| | `dorny/paths-filter` | `@v4` | `@fbd0ab8...` | | `Ana06/get-changed-files` | `@v2.3.0` | `@25f79e6...` | | `docker/login-action` | `@v4` | `@b45d80f...` | | `pypa/gh-action-pypi-publish` | `@release/v1` | `@ed0c539...` | | `ncipollo/release-action` | `@v1` | `@339a818...` | | `amannn/action-semantic-pull-request` | `@v6` | `@48f2562...` | | `peter-evans/create-pull-request` | `@v8` | `@c0f553f...` | ## Test plan - [x] CI passes on this PR - [x] Verify each pinned action still functions (no behaviour change, only ref format) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
44 lines
1.2 KiB
YAML
44 lines
1.2 KiB
YAML
name: UV Lock Upgrade
|
|
|
|
on:
|
|
schedule:
|
|
# run at midnight every Sunday
|
|
- cron: '0 0 * * 0'
|
|
# allow manual triggering
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
upgrade-dependencies:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up uv
|
|
uses: ./.github/actions/uv_setup
|
|
with:
|
|
python-version: "3.10"
|
|
cache-suffix: "uv-lock-upgrade"
|
|
|
|
- name: Run uv lock --upgrade in all Python packages
|
|
run: make lock-upgrade
|
|
|
|
- name: Create Pull Request
|
|
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
commit-message: "chore(deps): upgrade dependencies with `uv lock --upgrade`"
|
|
title: "chore(deps): upgrade dependencies with `uv lock --upgrade`"
|
|
body: |
|
|
This PR updates the dependencies in all Python packages using `uv lock --upgrade`.
|
|
|
|
This is an automated PR created by the UV Lock Upgrade workflow.
|
|
branch: deps/uv-lock-upgrade
|
|
delete-branch: true
|
|
labels: |
|
|
dependencies
|