From 9dd3a79c15d2325ad03ce91b00b75453145799ef Mon Sep 17 00:00:00 2001 From: XananasX7 Date: Sun, 28 Jun 2026 02:20:14 +0000 Subject: [PATCH] fix(security): pin etils-actions and other Actions to commit SHAs Tag-pinned third-party actions in publish workflows can be redirected to malicious code. Pinning to SHAs prevents supply-chain attacks via PYPI_API_TOKEN. --- .github/workflows/pytest_and_autopublish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pytest_and_autopublish.yml b/.github/workflows/pytest_and_autopublish.yml index 3e09f46..9d5d2ff 100644 --- a/.github/workflows/pytest_and_autopublish.yml +++ b/.github/workflows/pytest_and_autopublish.yml @@ -27,10 +27,10 @@ jobs: cancel-in-progress: true steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 # Install deps - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" # Uncomment to cache of pip dependencies (if tests too slow) @@ -61,7 +61,7 @@ jobs: steps: # Publish the package (if local `__version__` > pip version) - - uses: etils-actions/pypi-auto-publish@v1 + - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1 with: pypi-token: ${{ secrets.PYPI_API_TOKEN }} gh-token: ${{ secrets.GITHUB_TOKEN }}