From 6afadc6905d94b97d56f2b2e425f8c32d50b847f Mon Sep 17 00:00:00 2001 From: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Date: Thu, 6 Aug 2026 17:25:56 +0200 Subject: [PATCH] chore(ci): pin GitHub Actions to commit SHAs Pin all 68 external action references across the workflow files to full 40-character commit SHAs, each annotated with a `# vX.Y.Z` comment. No action versions change: every pin is the SHA the existing tag already resolved to. Three refs were previously resolving to mutable branches rather than tags -- changesets/action@v1, denoland/setup-deno@v2 and (before the pnpm 10 upgrade) pnpm/action-setup@v3 -- so a force-push upstream could have silently changed what ran in the release job. Keeping these pins current is handled by the shared e2b-dev/renovate config, which already extends helpers:pinGitHubActionDigestsToSemver. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build_prod_template.yml | 6 +- .github/workflows/build_test_template.yml | 6 +- .github/workflows/charts_tests.yml | 8 +-- .github/workflows/js_tests.yml | 12 ++-- .github/workflows/lint.yml | 12 ++-- .github/workflows/performance_tests.yml | 10 ++-- .github/workflows/python_tests.yml | 8 +-- .github/workflows/release.yml | 60 +++++++++---------- .github/workflows/release_candidates.yml | 12 ++-- .../workflows/validate-renovate-config.yaml | 4 +- 10 files changed, 69 insertions(+), 69 deletions(-) diff --git a/.github/workflows/build_prod_template.yml b/.github/workflows/build_prod_template.yml index da3424b0..ec9455b4 100644 --- a/.github/workflows/build_prod_template.yml +++ b/.github/workflows/build_prod_template.yml @@ -31,16 +31,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' diff --git a/.github/workflows/build_test_template.yml b/.github/workflows/build_test_template.yml index 348001e0..f91e38b9 100644 --- a/.github/workflows/build_test_template.yml +++ b/.github/workflows/build_test_template.yml @@ -25,10 +25,10 @@ jobs: template_id: ${{ steps.build-template.outputs.template_id }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' @@ -41,7 +41,7 @@ jobs: echo "Version: $VERSION" sed -i "s/e2b_charts/e2b_charts==${VERSION}/g" requirements.txt - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' diff --git a/.github/workflows/charts_tests.yml b/.github/workflows/charts_tests.yml index f2837786..a638f80c 100644 --- a/.github/workflows/charts_tests.yml +++ b/.github/workflows/charts_tests.yml @@ -15,22 +15,22 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: '${{ env.TOOL_VERSION_POETRY }}' virtualenvs-create: true diff --git a/.github/workflows/js_tests.yml b/.github/workflows/js_tests.yml index 31dac8c4..3c84e990 100644 --- a/.github/workflows/js_tests.yml +++ b/.github/workflows/js_tests.yml @@ -25,23 +25,23 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: '${{ env.TOOL_VERSION_NODE }}' registry-url: "https://registry.npmjs.org" @@ -67,7 +67,7 @@ jobs: E2B_TESTS_TEMPLATE: ${{ inputs.E2B_TESTS_TEMPLATE }} - name: Install Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: ${{ env.TOOL_VERSION_BUN }} @@ -79,7 +79,7 @@ jobs: E2B_TESTS_TEMPLATE: ${{ inputs.E2B_TESTS_TEMPLATE }} - name: Install Deno - uses: denoland/setup-deno@v2 + uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 with: deno-version: v2.x diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 99e83c9f..b0b0de3e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -13,21 +13,21 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node.js 20 - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '${{ env.TOOL_VERSION_NODE }}' cache: pnpm @@ -41,12 +41,12 @@ jobs: run: pnpm install --frozen-lockfile - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: '${{ env.TOOL_VERSION_POETRY }}' virtualenvs-create: true diff --git a/.github/workflows/performance_tests.yml b/.github/workflows/performance_tests.yml index a0f20aa5..23c2133c 100644 --- a/.github/workflows/performance_tests.yml +++ b/.github/workflows/performance_tests.yml @@ -29,22 +29,22 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: '${{ env.TOOL_VERSION_POETRY }}' virtualenvs-create: true @@ -62,7 +62,7 @@ jobs: E2B_TESTS_TEMPLATE: ${{ inputs.E2B_TESTS_TEMPLATE }} E2B_TESTS_BENCHMARK_ITERATIONS_COUNT: ${{ inputs.E2B_TESTS_BENCHMARK_ITERATIONS_COUNT }} - name: Upload performance plot artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: performance-plot-${{ github.run_number }} diff --git a/.github/workflows/python_tests.yml b/.github/workflows/python_tests.yml index 8149c91c..4d4a8e0a 100644 --- a/.github/workflows/python_tests.yml +++ b/.github/workflows/python_tests.yml @@ -25,22 +25,22 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: '${{ env.TOOL_VERSION_POETRY }}' virtualenvs-create: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c54b94ff..ad14097a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,23 +19,23 @@ jobs: release: ${{ steps.version.outputs.release }} steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '${{ env.TOOL_VERSION_NODE }}' registry-url: "https://registry.npmjs.org" @@ -68,23 +68,23 @@ jobs: template: ${{ steps.template.outputs.release }} steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '${{ env.TOOL_VERSION_NODE }}' registry-url: "https://registry.npmjs.org" @@ -132,28 +132,28 @@ jobs: version: ${{ steps.output_version.outputs.version }} steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: '${{ env.TOOL_VERSION_POETRY }}' virtualenvs-create: true @@ -199,20 +199,20 @@ jobs: (needs.changes.outputs.template == 'true' || needs.changes.outputs.charts == 'true') steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Log in to DockerHub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -229,7 +229,7 @@ jobs: sed -i "s/e2b_charts/e2b_charts==${VERSION}/g" requirements.txt - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' @@ -255,16 +255,16 @@ jobs: (needs.changes.outputs.template == 'true' || needs.changes.outputs.charts == 'true') steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' @@ -310,43 +310,43 @@ jobs: name: Release runs-on: ubuntu-latest steps: - - uses: actions/create-github-app-token@v1 + - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 id: app-token with: app-id: ${{ vars.VERSION_BUMPER_APPID }} private-key: ${{ secrets.VERSION_BUMPER_SECRET }} - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: token: ${{ steps.app-token.outputs.token }} - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: '${{ env.TOOL_VERSION_POETRY }}' virtualenvs-create: true virtualenvs-in-project: true installer-parallel: true - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node.js 24 - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24.x" registry-url: 'https://registry.npmjs.org' @@ -366,7 +366,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Release new versions - uses: changesets/action@v1 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 with: publish: pnpm run publish createGithubReleases: true @@ -394,7 +394,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Release Failed - Slack Notification - uses: rtCamp/action-slack-notify@v2 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: "#ff0000" SLACK_MESSAGE: ":here-we-go-again: :bob-the-destroyer: We need :fix-parrot: ASAP :pray:" diff --git a/.github/workflows/release_candidates.yml b/.github/workflows/release_candidates.yml index 389fd15c..d95434c3 100644 --- a/.github/workflows/release_candidates.yml +++ b/.github/workflows/release_candidates.yml @@ -13,24 +13,24 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.head_ref }} - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 if: ${{ contains( github.event.pull_request.labels.*.name, 'js-rc') }} with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node.js 20 - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 if: ${{ contains( github.event.pull_request.labels.*.name, 'js-rc') }} with: node-version: '${{ env.TOOL_VERSION_NODE }}' @@ -65,13 +65,13 @@ jobs: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 if: ${{ contains( github.event.pull_request.labels.*.name, 'python-rc') }} with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 if: ${{ contains( github.event.pull_request.labels.*.name, 'python-rc') }} with: version: '${{ env.TOOL_VERSION_POETRY }}' diff --git a/.github/workflows/validate-renovate-config.yaml b/.github/workflows/validate-renovate-config.yaml index a5feb8c6..db9fc089 100644 --- a/.github/workflows/validate-renovate-config.yaml +++ b/.github/workflows/validate-renovate-config.yaml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Validate Renovate config - uses: suzuki-shunsuke/github-action-renovate-config-validator@v2.0.0 + uses: suzuki-shunsuke/github-action-renovate-config-validator@ca480cb7ec89a9e1cd8c214ad33bda1617184027 # v2.0.0