From f93c4603bfd47eed8b80bf75fb85f619b523f2d9 Mon Sep 17 00:00:00 2001 From: "hf-security-analysis[bot]" <265538906+hf-security-analysis[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 11:04:10 +0000 Subject: [PATCH] fix(ci): pin actions in workflows flagged on #14789 --- .github/workflows/claude_review.yml | 2 +- .github/workflows/pypi_publish.yaml | 2 +- .github/workflows/trufflehog.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude_review.yml b/.github/workflows/claude_review.yml index 3ce50abcd9e7..04782bb46dbb 100644 --- a/.github/workflows/claude_review.yml +++ b/.github/workflows/claude_review.yml @@ -36,7 +36,7 @@ jobs: cancel-in-progress: false runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 diff --git a/.github/workflows/pypi_publish.yaml b/.github/workflows/pypi_publish.yaml index a63c8b618665..ca3611fc1dde 100644 --- a/.github/workflows/pypi_publish.yaml +++ b/.github/workflows/pypi_publish.yaml @@ -74,6 +74,6 @@ jobs: path: dist/ - name: Publish package distributions to TestPyPI - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: verbose: true diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml index bd54da2f0eda..d4217745a2e7 100644 --- a/.github/workflows/trufflehog.yml +++ b/.github/workflows/trufflehog.yml @@ -17,7 +17,7 @@ jobs: with: fetch-depth: 0 - name: Secret Scanning - uses: trufflesecurity/trufflehog@b2b0a92070f206ab7b5a1105d82a7f2f48d92341 # main + uses: trufflesecurity/trufflehog@b2b0a92070f206ab7b5a1105d82a7f2f48d92341 # v3.99.0 with: extra_args: --results=verified,unknown