diff --git a/.github/workflows/cut-release-branch.yml b/.github/workflows/cut-release-branch.yml index 2f69e8bff2..937e71cac4 100644 --- a/.github/workflows/cut-release-branch.yml +++ b/.github/workflows/cut-release-branch.yml @@ -47,7 +47,7 @@ jobs: fetch-depth: 0 persist-credentials: true - name: Install uv and set the python version - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true - name: Install dependencies diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index 1dbb53e4f1..25361c2aa2 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -72,13 +72,13 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: "22" cache: "npm" @@ -152,7 +152,7 @@ jobs: - name: Upload quality report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: docstring-quality-report path: /tmp/quality_report.json @@ -160,7 +160,7 @@ jobs: - name: Upload built site artifact if: success() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: docs-site path: docs/build/ @@ -207,7 +207,7 @@ jobs: steps: - name: Download site artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: docs-site path: docs-site/ diff --git a/.github/workflows/notebooks.yml b/.github/workflows/notebooks.yml index b2687f3f81..c2b6076fcd 100644 --- a/.github/workflows/notebooks.yml +++ b/.github/workflows/notebooks.yml @@ -42,7 +42,7 @@ jobs: - name: Free disk space uses: ./.github/actions/free-disk-space - name: Install uv and set the python version - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: python-version: "3.12" enable-cache: true diff --git a/.github/workflows/publish-dev-from-main.yml b/.github/workflows/publish-dev-from-main.yml index e446ad58a3..ff0d94f61c 100644 --- a/.github/workflows/publish-dev-from-main.yml +++ b/.github/workflows/publish-dev-from-main.yml @@ -55,7 +55,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: Install uv and set the python version - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true - name: Install dependencies diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index f1cee10c1f..d135e065a4 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -75,7 +75,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: Install uv and set the python version - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true - name: Install dependencies @@ -123,7 +123,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: Install uv and set the python version - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true - name: Install dependencies @@ -176,11 +176,11 @@ jobs: token: ${{ steps.app-token.outputs.token }} fetch-depth: 0 - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: uv.lock - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' cache: 'npm' diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml index 1055fa78ed..2857d2441c 100644 --- a/.github/workflows/pypi.yml +++ b/.github/workflows/pypi.yml @@ -50,7 +50,7 @@ jobs: echo "skip=false" >> "$GITHUB_OUTPUT" - name: Install uv and set the python version if: steps.gate.outputs.skip != 'true' - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: python-version: ${{ matrix.python-version }} enable-cache: false diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index bba043b5db..f6461cf151 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -57,7 +57,7 @@ jobs: - name: Free disk space uses: ./.github/actions/free-disk-space - name: Install uv and set the python version - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: python-version: ${{ matrix.python-version }} enable-cache: true diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 8969bc76e9..a573d1bd47 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -19,6 +19,16 @@ repos: types_or: [python, shell, ts, tsx, javascript, css] exclude: ^docs/ + - repo: local + hooks: + # A SHA-pinned action's comment must name the exact release (`# v7.0.1`). A moving + # tag like `# v7` trips zizmor's ref-version-mismatch on every PR once upstream re-tags it. + - id: action-pin-full-version + name: Action pin comments name an exact release + entry: '@[0-9a-f]{40} +# v[0-9]+(\.[0-9]+)?\s*$' + language: pygrep + files: ^\.github/.*\.ya?ml$ + - repo: local hooks: # Moving ruff hooks to the local version allows for different behavior locally and in ci/cd pipelines. diff --git a/AGENTS.md b/AGENTS.md index e3e5161cde..05e60c0087 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -137,6 +137,7 @@ Use the tool's common name (e.g., GitHub Copilot, Cursor, etc.). | Telemetry import errors | Run `uv sync` to install OpenTelemetry deps | | Silent empty strings from async backends | Check for `asyncio.gather(..., return_exceptions=True)` — exceptions become values silently; use `return_exceptions=False` unless callers explicitly handle `BaseException` values | | GitHub Actions workflow injection warning | Never use `${{ expression }}` directly inside `run:` shell commands — always route through `env:` (`env: MY_VAR: ${{ expr }}` then `"$MY_VAR"` in the script). This rule applies only to `run:` steps; `${{ }}` in `if:` conditions and `with:` action inputs is fine. | +| zizmor `ref-version-mismatch` on a workflow your PR didn't touch | A SHA pin's comment names a moving tag (`# v7`) that upstream has re-pointed. Comment with the exact release the SHA is tagged as (`@ # v7.0.1`); the `action-pin-full-version` pre-commit hook enforces this. | ## 10. Self-Review (before notifying user) 1. `uv run pytest test/ -m "not qualitative"` passes?