Skip to content

Commit 095958a

Browse files
dbutenhofdbutenhof
authored
Identify action versions (#679)
## Summary Update workflow action dependencies to include commented versions to help review. ## Details dependabot reads and updates commented version strings on SHA dependencies, making it a bit easier to review proposed changes. Note that its updates are not 100% reliable, and sometimes it proposes SHA updates for unreleased commits, so we need to be vigilant. Also updating the neural magic actions, which apparently aren't released separately -- the original SHA was an action commit that wasn't the latest commit in the release, so I updated it. ## Test Plan - Monitor workflows and dependabot behavior ... ## Related Issues --- - [x] "I certify that all code in this PR is my own, except as noted below." ## Use of AI - [x] Includes AI-assisted code completion - [ ] Includes code generated by an AI application - [ ] Includes AI-generated tests (NOTE: AI written tests should have a docstring that includes `## WRITTEN BY AI ##`)
2 parents e095779 + fe22e6e commit 095958a

11 files changed

Lines changed: 61 additions & 61 deletions

File tree

‎.github/actions/python-uv/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ inputs:
77
runs:
88
using: "composite"
99
steps:
10-
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
10+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1111
with:
1212
python-version: ${{ inputs.python-version }}
1313
- name: Setup Python with UV
14-
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
14+
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
1515
with:
1616
python-version: ${{ inputs.python-version }}
1717
enable-cache: "true"

‎.github/workflows/container-maintenance.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Delete PR and untagged images older than 2 weeks
20-
uses: snok/container-retention-policy@3b0972b2276b171b212f8c4efbca59ebba26eceb
20+
uses: snok/container-retention-policy@3b0972b2276b171b212f8c4efbca59ebba26eceb # v3.0.1
2121
with:
2222
account: ${{ github.repository_owner }}
2323
token: ${{ github.token }}
@@ -32,7 +32,7 @@ jobs:
3232
if: always() # Run after cleanup even if it fails
3333
steps:
3434
- name: Log into ghcr.io
35-
uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603
35+
uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
3636
with:
3737
username: ${{ github.repository_owner }}
3838
password: ${{ github.token }}

‎.github/workflows/development-cleanup.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
steps:
1616
- name: Check out gh-pages branch
17-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
1919
ref: gh-pages
2020
fetch-depth: 1
@@ -36,7 +36,7 @@ jobs:
3636

3737
- name: Remove GitHub Pages Build
3838
if: steps.check-preview.outputs.preview_exists == 'true'
39-
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
39+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
4040
with:
4141
github_token: ${{ secrets.GITHUB_TOKEN }}
4242
publish_dir: ./empty
@@ -59,7 +59,7 @@ jobs:
5959
runs-on: ubuntu-latest
6060
steps:
6161
- name: Update PR comment to reflect cleanup
62-
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
62+
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
6363
id: find-comment
6464
with:
6565
token: ${{ secrets.GITHUB_TOKEN }}
@@ -68,7 +68,7 @@ jobs:
6868

6969
- name: Update PR comment to reflect cleanup
7070
if: steps.find-comment.outputs.comment-id != ''
71-
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
71+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
7272
with:
7373
token: ${{ secrets.GITHUB_TOKEN }}
7474
comment-id: ${{ steps.find-comment.outputs.comment-id }}

‎.github/workflows/development.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ jobs:
3636
runs-on: ubuntu-latest
3737
steps:
3838
- name: Check out code
39-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4040
with:
4141
fetch-depth: 0
4242

4343
- name: Set up Node.js 22
44-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
44+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4545
with:
4646
node-version: '22'
4747

@@ -87,7 +87,7 @@ jobs:
8787
8888
- name: Deploy to GitHub Pages
8989
if: steps.check-changes.outputs.should_build == 'true'
90-
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
90+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
9191
with:
9292
github_token: ${{ secrets.GITHUB_TOKEN }}
9393
publish_dir: ./src/ui/out
@@ -107,7 +107,7 @@ jobs:
107107
108108
- name: Find PR comment
109109
if: steps.check-changes.outputs.should_build == 'true'
110-
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
110+
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
111111
id: find-comment
112112
with:
113113
token: ${{ secrets.GITHUB_TOKEN }}
@@ -116,7 +116,7 @@ jobs:
116116

117117
- name: Post Deployment URL to PR
118118
if: steps.check-changes.outputs.should_build == 'true'
119-
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
119+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
120120
with:
121121
token: ${{ secrets.GITHUB_TOKEN }}
122122
comment-id: ${{ steps.find-comment.outputs.comment-id }}
@@ -139,18 +139,18 @@ jobs:
139139
packages: write
140140
steps:
141141
- name: Checkout
142-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
142+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
143143
with:
144144
fetch-depth: 0
145145
- name: Store/retrieve build caches
146146
id: cache-buildah
147-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7
147+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
148148
with:
149149
path: /var/tmp/buildah-cache-*
150150
key: buildah-mount-cache-${{ runner.os }}-${{ runner.arch }}
151151
- name: Buildah build
152152
id: build-image
153-
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056
153+
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
154154
with:
155155
image: ${{ github.event.repository.name }}
156156
build-args: |
@@ -161,7 +161,7 @@ jobs:
161161
./Containerfile
162162
- name: Push To ghcr.io
163163
id: push-to-ghcr
164-
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c
164+
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
165165
with:
166166
image: ${{ steps.build-image.outputs.image }}
167167
tags: ${{ steps.build-image.outputs.tags }}

‎.github/workflows/main.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ jobs:
3636
runs-on: ubuntu-latest
3737
steps:
3838
- name: Check out code
39-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4040

4141
- name: Set up Node.js 22
42-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
42+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4343
with:
4444
node-version: '22'
4545

@@ -62,7 +62,7 @@ jobs:
6262
npm run build
6363
6464
- name: Deploy to GitHub Pages
65-
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
65+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
6666
with:
6767
github_token: ${{ secrets.GITHUB_TOKEN }}
6868
publish_dir: ./src/ui/out

‎.github/workflows/nightly.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ jobs:
2727
runs-on: ubuntu-latest
2828
steps:
2929
- name: Check out code
30-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131

3232
- name: Set up Node.js 22
33-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
33+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3434
with:
3535
node-version: '22'
3636

@@ -62,7 +62,7 @@ jobs:
6262
npm run build
6363
6464
- name: Update latest build in GitHub Pages
65-
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
65+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
6666
with:
6767
github_token: ${{ secrets.GITHUB_TOKEN }}
6868
publish_dir: ./src/ui/out
@@ -77,12 +77,12 @@ jobs:
7777
runs-on: ubuntu-latest
7878
steps:
7979
- name: Checkout
80-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
80+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8181
with:
8282
fetch-depth: 0
8383
- name: Buildah build
8484
id: build-image
85-
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056
85+
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
8686
with:
8787
image: ${{ github.event.repository.name }}
8888
build-args: |
@@ -92,7 +92,7 @@ jobs:
9292
./Containerfile
9393
- name: Push To ghcr.io
9494
id: push-to-ghcr
95-
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c
95+
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
9696
with:
9797
image: ${{ steps.build-image.outputs.image }}
9898
tags: ${{ steps.build-image.outputs.tags }}

‎.github/workflows/quality.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
quality-checks:
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
14+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1515
- name: Run quality checks
1616
uses: ./.github/actions/run-tox
1717
with:
@@ -21,7 +21,7 @@ jobs:
2121
type-checks:
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525
- name: Run type checks
2626
uses: ./.github/actions/run-tox
2727
with:
@@ -31,9 +31,9 @@ jobs:
3131
precommit-checks:
3232
runs-on: ubuntu-latest
3333
steps:
34-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535
- name: Set up Python
36-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
36+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3737
with:
3838
python-version: ${{ inputs.python }}
3939
- name: Install dependencies

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
python: ["3.10"]
2525
steps:
2626
- name: Checkout code
27-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828
with:
2929
fetch-depth: 0
3030
- name: Setup Python with UV
@@ -40,7 +40,7 @@ jobs:
4040
tox -e build
4141
- name: Upload build artifacts
4242
id: artifact-upload
43-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
43+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
4444
with:
4545
name: release-artifacts
4646
path: dist/*
@@ -51,13 +51,13 @@ jobs:
5151
run: |
5252
echo "Artifacts uploaded to: ${{ steps.artifact-upload.outputs.artifact-url }}"
5353
- name: Push wheel to PyPI
54-
uses: neuralmagic/nm-actions/actions/publish-whl@5f51a3426881661e49c99068bb967a591338b8a9
54+
uses: neuralmagic/nm-actions/actions/publish-whl@1db28bd7b210523049e533d6f14ee3d4b2ff2b32 # v1.24.0
5555
with:
5656
username: ${{ secrets.PYPI_PUBLIC_USER }}
5757
password: ${{ secrets.PYPI_PUBLIC_AUTH }}
5858
whl: $(find dist -name '*.whl')
5959
- name: Push tar.gz to PyPI
60-
uses: neuralmagic/nm-actions/actions/publish-whl@5f51a3426881661e49c99068bb967a591338b8a9
60+
uses: neuralmagic/nm-actions/actions/publish-whl@1db28bd7b210523049e533d6f14ee3d4b2ff2b32 # v1.24.0
6161
with:
6262
username: ${{ secrets.PYPI_PUBLIC_USER }}
6363
password: ${{ secrets.PYPI_PUBLIC_AUTH }}
@@ -71,10 +71,10 @@ jobs:
7171
runs-on: ubuntu-latest
7272
steps:
7373
- name: Check out code
74-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
74+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7575

7676
- name: Set up Node.js 22
77-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
77+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
7878
with:
7979
node-version: '22'
8080

@@ -106,7 +106,7 @@ jobs:
106106
npm run build
107107
108108
- name: Deploy versioned build to GitHub Pages
109-
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
109+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
110110
with:
111111
github_token: ${{ secrets.GITHUB_TOKEN }}
112112
publish_dir: ./src/ui/out
@@ -125,10 +125,10 @@ jobs:
125125
runs-on: ubuntu-latest
126126
steps:
127127
- name: Check out code
128-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
128+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
129129

130130
- name: Set up Node.js 22
131-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
131+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
132132
with:
133133
node-version: '22'
134134

@@ -160,7 +160,7 @@ jobs:
160160
npm run build
161161
162162
- name: Update latest build in GitHub Pages
163-
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
163+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
164164
with:
165165
github_token: ${{ secrets.GITHUB_TOKEN }}
166166
publish_dir: ./src/ui/out
@@ -174,7 +174,7 @@ jobs:
174174
runs-on: ubuntu-latest
175175
steps:
176176
- name: Checkout
177-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
177+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
178178
with:
179179
fetch-depth: 0
180180
- name: Get version from branch
@@ -186,13 +186,13 @@ jobs:
186186
exit 1
187187
- name: Store/retrieve build caches
188188
id: cache-buildah
189-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7
189+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
190190
with:
191191
path: /var/tmp/buildah-cache-*
192192
key: buildah-mount-cache-${{ runner.os }}-${{ runner.arch }}
193193
- name: Buildah build
194194
id: build-image
195-
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056
195+
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
196196
with:
197197
image: ${{ github.event.repository.name }}
198198
build-args: |
@@ -202,7 +202,7 @@ jobs:
202202
./Containerfile
203203
- name: Push To ghcr.io
204204
id: push-to-ghcr
205-
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c
205+
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
206206
with:
207207
image: ${{ steps.build-image.outputs.image }}
208208
tags: ${{ steps.build-image.outputs.tags }}

‎.github/workflows/testing.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
unit-tests:
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
- name: Run unit tests
1919
uses: ./.github/actions/run-tox
2020
with:
@@ -25,7 +25,7 @@ jobs:
2525
integration-tests:
2626
runs-on: ubuntu-latest
2727
steps:
28-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929
- name: Run integration tests
3030
uses: ./.github/actions/run-tox
3131
with:
@@ -36,21 +36,21 @@ jobs:
3636
e2e-tests:
3737
runs-on: ubuntu-latest
3838
steps:
39-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
39+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4040
# Cache the binary artifact
4141
# The key is based on the runner's OS and the hash of the Dockerfile.
4242
# If the Dockerfile changes, the hash changes, and a new cache is created.
4343
- name: Cache vLLM-sim binary
4444
id: cache-vllm-sim
45-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7
45+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
4646
with:
4747
# The path to the file you want to cache
4848
path: bin/llm-d-inference-sim
4949
# The unique key for the cache
5050
key: vllm-sim-binary-${{ runner.os }}-${{ hashFiles('tests/e2e/vllm-sim.Dockerfile') }}
5151
# Set up Docker Buildx (required for the 'docker build -o' command)
5252
- name: Set up Docker Buildx
53-
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
53+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
5454
# Conditionally build the artifact
5555
# This step only runs if the cache step above did NOT find a match.
5656
# 'steps.cache-vllm-sim.outputs.cache-hit' will be 'true' if the cache was restored.

0 commit comments

Comments
 (0)