mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-09-02 05:08:44 +02:00
Mason DaughertyandGitHub
97320843fe
Every third-party GitHub Action in the workflows is now pinned to a full
commit SHA instead of a floating major tag, closing a supply-chain gap
where a mutable tag like `@v6` could be force-pushed to point at
malicious code. Seven actions were already SHA-pinned; this brings the
remaining first-party `actions/*` and `astral-sh/setup-uv` references in
line.
## Changes
- Pinned all previously tag-referenced actions to their current commit
SHA with the exact release as a trailing comment (the format Dependabot
reads and updates): `actions/checkout` → `v6.0.3`,
`actions/setup-python` → `v6.2.0`, `actions/github-script` → `v9.0.0`,
`actions/upload-artifact` → `v7.0.1`, `actions/download-artifact` →
`v8.0.1`, `actions/cache/{restore,save}` → `v5.0.5`,
`actions/configure-pages` → `v6.0.0`, `actions/deploy-pages` → `v5.0.0`,
`actions/upload-pages-artifact` → `v5.0.0`,
`actions/create-github-app-token` → `v3.2.0`, and `astral-sh/setup-uv` →
`v7.6.0`.
- Applied across all workflow files plus the `uv_setup` composite
action; local same-repo references (`./.github/workflows/_*.yml`,
`./.github/actions/uv_setup`) left as path refs since they resolve from
the same commit.
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
# Helper to set up Python and uv with caching
|
|
|
|
name: uv-install
|
|
description: Set up Python and uv with caching
|
|
|
|
inputs:
|
|
python-version:
|
|
description: Python version, supporting MAJOR.MINOR only
|
|
required: true
|
|
enable-cache:
|
|
description: Enable caching for uv dependencies
|
|
required: false
|
|
default: "true"
|
|
cache-suffix:
|
|
description: Custom cache key suffix for cache invalidation
|
|
required: false
|
|
default: ""
|
|
working-directory:
|
|
description: Working directory for cache glob scoping
|
|
required: false
|
|
default: "**"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install uv and set the python version
|
|
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
|
|
with:
|
|
python-version: ${{ inputs.python-version }}
|
|
enable-cache: ${{ inputs.enable-cache }}
|
|
cache-dependency-glob: |
|
|
${{ inputs.working-directory }}/pyproject.toml
|
|
${{ inputs.working-directory }}/uv.lock
|
|
${{ inputs.working-directory }}/requirements*.txt
|
|
cache-suffix: ${{ inputs.cache-suffix }}
|