From 9e8ecf8c2b76e4b6e7fca7cf877b26251a3ce22d Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 23 Aug 2026 23:29:28 +0200 Subject: [PATCH] chore(github-actions): pin reqstool/.github references to 1.0.0 Replaces a mix of @main and @ # main with a single shape: @ # 1.0.0, against reqstool/.github's first tag. @main is mutable, so CodeQL's actions/unpinned-tag flags it and any change to the shared workflows reaches this repo with no review -- which bit twice this week while the PyPI publish path was being fixed. A bare tag would still be mutable; the sha-with-version-comment form satisfies the pinning audits while letting Renovate track the digest and rewrite the comment, so the pin does not rot. Implements reqstool/.github#25. Signed-off-by: Jimisola Laursen --- .github/workflows/check-semantic-pr.yml | 2 +- .github/workflows/publish_gh_pages.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-semantic-pr.yml b/.github/workflows/check-semantic-pr.yml index 81a00ea..5bbce14 100644 --- a/.github/workflows/check-semantic-pr.yml +++ b/.github/workflows/check-semantic-pr.yml @@ -10,4 +10,4 @@ permissions: jobs: check: - uses: reqstool/.github/.github/workflows/common-check-semantic-pr.yml@main + uses: reqstool/.github/.github/workflows/common-check-semantic-pr.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0 diff --git a/.github/workflows/publish_gh_pages.yml b/.github/workflows/publish_gh_pages.yml index 07303d9..1aeeea7 100644 --- a/.github/workflows/publish_gh_pages.yml +++ b/.github/workflows/publish_gh_pages.yml @@ -13,7 +13,7 @@ permissions: jobs: publish: - uses: reqstool/.github/.github/workflows/common-publish-to-github-pages.yml@main + uses: reqstool/.github/.github/workflows/common-publish-to-github-pages.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0 permissions: contents: read pages: write