From 78de4522df4115d098c9f3e73ecedc52c0ed1087 Mon Sep 17 00:00:00 2001 From: Nat Mote Date: Tue, 11 Aug 2026 13:01:14 -0700 Subject: [PATCH] Pin GitHub Actions to commit SHAs semgrep/ocaml enforces SHA-pinned actions, so every job on the 5.4 line fails at setup. Ports the pinning from trunk (945fc711a7), reusing its SHAs where the major version matches; actions/checkout stays on v4 (trunk moved to v5) and is pinned to what the v4 tag resolves to. --- .github/workflows/build-cross.yml | 26 +++++++++++++------------- .github/workflows/build-msvc.yml | 18 +++++++++--------- .github/workflows/build.yml | 14 +++++++------- .github/workflows/hygiene.yml | 2 +- .github/workflows/multicoretests.yml | 8 ++++---- .github/workflows/parsetree-change.yml | 4 ++-- .github/workflows/tsan.yml | 6 +++--- 7 files changed, 39 insertions(+), 39 deletions(-) diff --git a/.github/workflows/build-cross.yml b/.github/workflows/build-cross.yml index 6d2ba59e1360..5b38c0f1b482 100644 --- a/.github/workflows/build-cross.yml +++ b/.github/workflows/build-cross.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout OCaml - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Configure, build and install OCaml @@ -57,7 +57,7 @@ jobs: cd "$HOME" tar caf /tmp/ocaml.tar.zst .local - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: non-cross-ocaml path: /tmp/ocaml.tar.zst @@ -68,7 +68,7 @@ jobs: needs: non-cross steps: - name: Download Artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: non-cross-ocaml - name: Install non-cross OCaml and set up environment @@ -80,7 +80,7 @@ jobs: sudo apt-get update -y sudo apt-get install -y gcc-mingw-w64-x86-64 - name: Checkout OCaml - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true persist-credentials: false @@ -107,7 +107,7 @@ jobs: cat example.ml $HOME/cross/bin/ocamlopt.opt.exe -I $HOME/cross/lib/ocaml/compiler-libs/ ocamlcommon.cmxa ocamloptcomp.cmxa example.ml -o example.exe -verbose - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: windows-executable path: example.exe @@ -127,7 +127,7 @@ jobs: needs: cross-windows steps: - name: Download Artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: windows-executable - name: Run example program @@ -139,7 +139,7 @@ jobs: needs: non-cross steps: - name: Download Artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: non-cross-ocaml - name: Install non-cross OCaml and set up environment @@ -151,7 +151,7 @@ jobs: sudo apt-get update -y sudo apt-get install -y gcc-aarch64-linux-gnu qemu-user - name: Checkout OCaml - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true persist-credentials: false @@ -193,7 +193,7 @@ jobs: needs: non-cross steps: - name: Download Artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: non-cross-ocaml - name: Install non-cross OCaml @@ -203,7 +203,7 @@ jobs: rm -f ocaml.tar.zst echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Restore the Android NDK from cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 id: cache with: path: | @@ -219,14 +219,14 @@ jobs: rm android-ndk-r27b-linux.zip if: steps.cache.outputs.cache-hit != 'true' - name: Save the Android NDK to cache - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | /home/runner/android key: android-ndk if: steps.cache.outputs.cache-hit != 'true' - name: Checkout OCaml - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Configure, build and install Linux-to-Android OCaml @@ -263,7 +263,7 @@ jobs: $HOME/cross/bin/ocamlopt.opt example.ml -o example -verbose file example - name: Run example - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0 with: api-level: 21 arch: x86_64 diff --git a/.github/workflows/build-msvc.yml b/.github/workflows/build-msvc.yml index 5c689b8ef3f6..2b209bbb4eb9 100644 --- a/.github/workflows/build-msvc.yml +++ b/.github/workflows/build-msvc.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Compute matrix for the "build" job id: matrix - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | // # Always test cl and clang-cl @@ -58,7 +58,7 @@ jobs: return {config_arg: [''], arch: ['x86_64'], cc: compilers, include: include}; - name: Determine if the testsuite should be skipped id: skip - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | let skip_testsuite = false; @@ -88,32 +88,32 @@ jobs: steps: - name: Fetch OCaml - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true - name: Restore Cygwin cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | C:\cygwin-packages key: cygwin-packages - name: Install Cygwin - uses: cygwin/cygwin-install-action@v3 + uses: cygwin/cygwin-install-action@f5e0f048310c425e84bc789f493a828c6dc80a25 # v3 with: packages: make,${{ matrix.cc != 'gcc' && 'mingw64-x86_64-' || 'gcc-fortran,' }}gcc-core install-dir: 'D:\cygwin' - name: Save Cygwin cache - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | C:\cygwin-packages key: cygwin-packages - name: Set up MSVC - uses: ilammy/msvc-dev-cmd@v1 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 with: arch: ${{ matrix.arch == 'x86_64' && 'x64' || 'x86' }} if: matrix.cc != 'gcc' @@ -126,7 +126,7 @@ jobs: echo "key=${{ env.HOST }}-${{ matrix.cc }}-${{ hashFiles('configure') }}" >> $GITHUB_OUTPUT - name: Restore Autoconf cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | config.cache @@ -156,7 +156,7 @@ jobs: fi - name: Save Autoconf cache - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | config.cache diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4907c5c53e5c..a6ffa6488ee9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -39,7 +39,7 @@ jobs: manual_changed: ${{ steps.manual.outputs.manual_changed }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Check for manual changes @@ -66,7 +66,7 @@ jobs: - name: Prepare Artifact run: tar --zstd -cf /tmp/sources.tar.zstd . - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: compiler path: /tmp/sources.tar.zstd @@ -95,7 +95,7 @@ jobs: fail-fast: true steps: - name: Download Artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: compiler - name: Unpack Artifact @@ -153,7 +153,7 @@ jobs: steps: - name: Compute matrix for the "others" job id: jobs - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | // # Default jobs: Linux -O0, Linux arm64 & macOS @@ -186,7 +186,7 @@ jobs: return jobs; - name: Determine if the testsuite should be skipped id: skip - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | let skip_testsuite = false; @@ -208,7 +208,7 @@ jobs: fail-fast: true steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: macOS Dependencies @@ -257,7 +257,7 @@ jobs: adduser --disabled-password --gecos '' ocaml - name: Checkout # See https://github.com/actions/checkout/issues/334 - uses: actions/checkout@v1 + uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0 - name: configure tree run: | chown -R ocaml:ocaml . diff --git a/.github/workflows/hygiene.yml b/.github/workflows/hygiene.yml index 2e88979f453c..b49ff826e4fa 100644 --- a/.github/workflows/hygiene.yml +++ b/.github/workflows/hygiene.yml @@ -28,7 +28,7 @@ jobs: # context variable. if: failure() - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 50 persist-credentials: false diff --git a/.github/workflows/multicoretests.yml b/.github/workflows/multicoretests.yml index 2bc8b4cc1e1f..26a9365ad16f 100644 --- a/.github/workflows/multicoretests.yml +++ b/.github/workflows/multicoretests.yml @@ -25,7 +25,7 @@ jobs: ocamlrunparam: b,s=4096 steps: - name: Checkout OCaml - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: path: ocaml persist-credentials: false @@ -33,21 +33,21 @@ jobs: run: | bash -xe ocaml/tools/ci/actions/multicoretests.sh ocaml - name: Checkout multicoretests - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: ocaml-multicore/multicoretests ref: 0.8 path: multicoretests persist-credentials: false - name: Checkout QCheck - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: c-cube/qcheck ref: v0.25 path: multicoretests/qcheck persist-credentials: false - name: Checkout dune - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: ocaml/dune ref: 3.18.0 diff --git a/.github/workflows/parsetree-change.yml b/.github/workflows/parsetree-change.yml index b953969cc511..e30132eef1a5 100644 --- a/.github/workflows/parsetree-change.yml +++ b/.github/workflows/parsetree-change.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Notify ppxlib maintainers - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | github.rest.issues.createComment({ @@ -28,7 +28,7 @@ jobs: body: 'CC @ocaml/ppxlib-dev' }) - name: Label PR - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | github.rest.issues.addLabels({ diff --git a/.github/workflows/tsan.yml b/.github/workflows/tsan.yml index 3327397723b6..e7a8d7d9fad7 100644 --- a/.github/workflows/tsan.yml +++ b/.github/workflows/tsan.yml @@ -29,7 +29,7 @@ jobs: manual_changed: ${{ steps.manual.outputs.manual_changed }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Install libunwind @@ -51,7 +51,7 @@ jobs: - name: Prepare Artifact run: tar --zstd -cf /tmp/sources.tar.zstd . - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: compiler path: /tmp/sources.tar.zstd @@ -77,7 +77,7 @@ jobs: dependencies: libunwind-dev steps: - name: Download Artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: compiler - name: Unpack Artifact