mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-20 06:35:46 +02:00
John KennedyandGitHub
bcf3077267
## Summary - SHA-pins 7 distinct third-party actions across 10 workflow files to full commit SHAs - Prevents supply chain attacks via tag hijacking (mutable tags can be force-pushed by a compromised maintainer account) - Tag retained as an inline comment for readability | Action | Before | After | |--------|--------|-------| | `dorny/paths-filter` | `@v4` | `@fbd0ab8...` | | `Ana06/get-changed-files` | `@v2.3.0` | `@25f79e6...` | | `docker/login-action` | `@v4` | `@b45d80f...` | | `pypa/gh-action-pypi-publish` | `@release/v1` | `@ed0c539...` | | `ncipollo/release-action` | `@v1` | `@339a818...` | | `amannn/action-semantic-pull-request` | `@v6` | `@48f2562...` | | `peter-evans/create-pull-request` | `@v8` | `@c0f553f...` | ## Test plan - [x] CI passes on this PR - [x] Verify each pinned action still functions (no behaviour change, only ref format) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
47 lines
968 B
YAML
47 lines
968 B
YAML
name: PR Title Lint
|
|
|
|
permissions:
|
|
pull-requests: read
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, edited, synchronize]
|
|
|
|
jobs:
|
|
lint-pr-title:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Validate PR Title
|
|
uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
types: |
|
|
feat
|
|
fix
|
|
docs
|
|
style
|
|
refactor
|
|
perf
|
|
test
|
|
build
|
|
ci
|
|
chore
|
|
revert
|
|
release
|
|
scopes: |
|
|
checkpoint
|
|
checkpoint-postgres
|
|
checkpoint-sqlite
|
|
cli
|
|
langgraph
|
|
prebuilt
|
|
scheduler-kafka
|
|
sdk-py
|
|
docs
|
|
ci
|
|
deps
|
|
requireScope: false
|
|
ignoreLabels: |
|
|
ignore-lint-pr-title
|