Skip to content

Commit f1ddb4f

Browse files
ShaharNavehShaharNaveh
authored
Pin checkout to commit. Don't persist creds if not needed (#7430)
1 parent 97790a8 commit f1ddb4f

File tree

6 files changed

+58
-18
lines changed

6 files changed

+58
-18
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,10 @@ jobs:
129129
os: [macos-latest, ubuntu-latest, windows-2025]
130130
fail-fast: false
131131
steps:
132-
- uses: actions/checkout@v6
132+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
133+
with:
134+
persist-credentials: false
135+
133136
- uses: dtolnay/rust-toolchain@stable
134137
with:
135138
components: clippy
@@ -271,7 +274,10 @@ jobs:
271274
- windows-2025
272275
fail-fast: false
273276
steps:
274-
- uses: actions/checkout@v6
277+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
278+
with:
279+
persist-credentials: false
280+
275281
- uses: dtolnay/rust-toolchain@stable
276282
- uses: Swatinem/rust-cache@v2
277283
- uses: actions/setup-python@v6.2.0
@@ -426,7 +432,10 @@ jobs:
426432
name: Lint Rust & Python code
427433
runs-on: ubuntu-latest
428434
steps:
429-
- uses: actions/checkout@v6
435+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
436+
with:
437+
persist-credentials: false
438+
430439
- uses: actions/setup-python@v6.2.0
431440
with:
432441
python-version: ${{ env.PYTHON_VERSION }}
@@ -484,7 +493,9 @@ jobs:
484493
env:
485494
NIGHTLY_CHANNEL: nightly
486495
steps:
487-
- uses: actions/checkout@v6
496+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
497+
with:
498+
persist-credentials: false
488499

489500
- uses: dtolnay/rust-toolchain@master
490501
with:
@@ -506,7 +517,10 @@ jobs:
506517
runs-on: ubuntu-latest
507518
timeout-minutes: 30
508519
steps:
509-
- uses: actions/checkout@v6
520+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
521+
with:
522+
persist-credentials: false
523+
510524
- uses: dtolnay/rust-toolchain@stable
511525

512526
- uses: Swatinem/rust-cache@v2
@@ -569,7 +583,10 @@ jobs:
569583
runs-on: ubuntu-latest
570584
timeout-minutes: 30
571585
steps:
572-
- uses: actions/checkout@v6
586+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
587+
with:
588+
persist-credentials: false
589+
573590
- uses: dtolnay/rust-toolchain@stable
574591
with:
575592
target: wasm32-wasip1

‎.github/workflows/cron-ci.yaml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,10 @@ jobs:
2424
# Disable this scheduled job when running on a fork.
2525
if: ${{ github.repository == 'RustPython/RustPython' || github.event_name != 'schedule' }}
2626
steps:
27-
- uses: actions/checkout@v6
27+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
28+
with:
29+
persist-credentials: false
30+
2831
- uses: dtolnay/rust-toolchain@stable
2932
- uses: taiki-e/install-action@cargo-llvm-cov
3033
- uses: actions/setup-python@v6.2.0
@@ -53,7 +56,10 @@ jobs:
5356
# Disable this scheduled job when running on a fork.
5457
if: ${{ github.repository == 'RustPython/RustPython' || github.event_name != 'schedule' }}
5558
steps:
56-
- uses: actions/checkout@v6
59+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
60+
with:
61+
persist-credentials: true
62+
5763
- uses: dtolnay/rust-toolchain@stable
5864
- name: build rustpython
5965
run: cargo build --release --verbose
@@ -85,7 +91,10 @@ jobs:
8591
# Disable this scheduled job when running on a fork.
8692
if: ${{ github.repository == 'RustPython/RustPython' || github.event_name != 'schedule' }}
8793
steps:
88-
- uses: actions/checkout@v6
94+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
95+
with:
96+
persist-credentials: true
97+
8998
- uses: dtolnay/rust-toolchain@stable
9099
- uses: actions/setup-python@v6.2.0
91100
with:
@@ -143,7 +152,10 @@ jobs:
143152
# Disable this scheduled job when running on a fork.
144153
if: ${{ github.repository == 'RustPython/RustPython' || github.event_name != 'schedule' }}
145154
steps:
146-
- uses: actions/checkout@v6
155+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
156+
with:
157+
persist-credentials: true
158+
147159
- uses: dtolnay/rust-toolchain@stable
148160
- uses: actions/setup-python@v6.2.0
149161
with:

‎.github/workflows/lib-deps-check.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,12 @@ jobs:
2121
timeout-minutes: 10
2222
steps:
2323
- name: Checkout base branch
24-
uses: actions/checkout@v6
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525
with:
2626
# Use base branch for scripts (security: don't run PR code with elevated permissions)
2727
ref: ${{ github.event.pull_request.base.ref }}
2828
fetch-depth: 0
29+
persist-credentials: false
2930

3031
- name: Fetch PR head
3132
run: |

‎.github/workflows/pr-format.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ jobs:
2121
runs-on: ubuntu-latest
2222
timeout-minutes: 60
2323
steps:
24-
- name: Checkout PR branch
25-
uses: actions/checkout@v6
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
persist-credentials: false
2627

2728
- name: Setup Rust
2829
uses: dtolnay/rust-toolchain@stable

‎.github/workflows/release.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,10 @@ jobs:
5252
# target: aarch64-pc-windows-msvc
5353
fail-fast: false
5454
steps:
55-
- uses: actions/checkout@v6
55+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
56+
with:
57+
persist-credentials: false
58+
5659
- uses: dtolnay/rust-toolchain@stable
5760
- uses: cargo-bins/cargo-binstall@main
5861

@@ -88,7 +91,10 @@ jobs:
8891
# Disable this scheduled job when running on a fork.
8992
if: ${{ github.repository == 'RustPython/RustPython' || github.event_name != 'schedule' }}
9093
steps:
91-
- uses: actions/checkout@v6
94+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
95+
with:
96+
persist-credentials: false
97+
9298
- uses: dtolnay/rust-toolchain@stable
9399
with:
94100
targets: wasm32-wasip1
@@ -139,7 +145,9 @@ jobs:
139145
if: ${{ github.repository == 'RustPython/RustPython' || github.event_name != 'schedule' }}
140146
needs: [build, build-wasm]
141147
steps:
142-
- uses: actions/checkout@v6
148+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
149+
with:
150+
persist-credentials: false
143151

144152
- name: Download Binary Artifacts
145153
uses: actions/download-artifact@v8.0.0

‎.github/workflows/update-doc-db.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
- windows-latest
3131
- macos-latest
3232
steps:
33-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3434
with:
3535
persist-credentials: false
3636
sparse-checkout: |
@@ -55,8 +55,9 @@ jobs:
5555
runs-on: ubuntu-latest
5656
needs: generate
5757
steps:
58-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
58+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5959
with:
60+
persist-credentials: true
6061
ref: ${{ inputs.base-ref }}
6162
token: ${{ secrets.AUTO_COMMIT_PAT }}
6263

0 commit comments

Comments
 (0)