Skip to content

Pin GitHub actions to specific hashes #4147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
je-cook merged 2 commits into from
Mar 27, 2026
Merged

Pin GitHub actions to specific hashes #4147

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
acce44a
Pin GitHub actions to specific hashes
timothy-nunn Mar 27, 2026
23597a7
Add hash pin to fppf actions
timothy-nunn Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 27 additions & 27 deletions .github/workflows/process.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ jobs:
os: [ubuntu-latest, macos-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
- name: Run unit tests with coverage report
run: |
hatch run test:tests-cov tests/unit
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
with:
Expand All @@ -39,9 +39,9 @@ jobs:
integration-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- name: Run integration tests
Expand All @@ -50,9 +50,9 @@ jobs:
example-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- name: Run example tests
Expand All @@ -68,11 +68,11 @@ jobs:
matrix:
tolerance: [0.2, 5]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
fetch-depth: 0
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- name: Run regression tests
Expand All @@ -82,32 +82,32 @@ jobs:
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- name: Run regression input files
run: hatch run python tracking/run_tracking_inputs.py run tests/regression/input_files
- name: Move other files
run: mv tests/regression/input_files/*.json tracking/
- name: Archive tracked MFILEs
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
with:
name: tracked-mfiles
path: tracking/*_MFILE.DAT
- name: Archive tracked SIG_TF.json
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
with:
name: sig-tfs
path: tracking/*.json

pre-commit-quality-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- name: Run pre-commit
Expand All @@ -123,19 +123,19 @@ jobs:
env:
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- name: Setup SSH identity
uses: webfactory/ssh-agent@v0.7.0
uses: webfactory/ssh-agent@836c84ec59a0e7bc0eabc79988384eb567561ee2
with:
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
- name: Download tracking data
run: git clone git@github.com:timothy-nunn/process-tracking-data.git process-tracking-data
- name: Download MFILEs
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
name: tracked-mfiles
path: tracking/
Expand All @@ -148,7 +148,7 @@ jobs:
- name: Create the tracking dashboard
run: hatch run python tracking/tracking_data.py plot process-tracking-data --out tracking.html
- name: Archive tracking dashboard
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
with:
name: tracking-html
path: tracking.html
Expand All @@ -171,21 +171,21 @@ jobs:
needs: tracking
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
fetch-depth: 0
- name: Setup python and hatch
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@main
uses: Fusion-Power-Plant-Framework/fppf-actions/setup-hatch@c6af22fc8d00be67cca53a61177301462f499fb2
with:
python-version: ${{ env.python-version }}
- run: git config --global --add safe.directory '*'
- name: Download STF_TF.json files
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
name: sig-tfs
path: tracking/
- name: Download MFILEs
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
name: tracked-mfiles
path: tracking/
Expand All @@ -196,14 +196,14 @@ jobs:
run: mv tracking/large_tokamak_nof_MFILE.DATSUMMARY.pdf documentation/source/images/plot_proc.pdf
- run: hatch run docs:build
- name: Download tracking html
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
name: tracking-html
- run: mv tracking.html site || cp site/404.html site/tracking.html
- name: Upload documentation page
uses: actions/upload-pages-artifact@v3
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b
with:
path: site/
- name: Deploy GitHub pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
Loading