From 457798c5261bc06e4f7bedf89cdf06eac42c527f Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Thu, 3 Sep 2026 18:39:37 -0400 Subject: [PATCH] DEVOPS-1133: Pin GitHub Actions to commit hashes Pin all GitHub Actions and reusable workflow references to immutable commit hashes, and add the dependabot auto-merge and WIP status workflows. --- .github/workflows/dependabot-auto-merge.yml | 17 +++++++++++++++++ .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/python_analysis.yml | 4 ++-- .github/workflows/wip-status.yml | 12 ++++++++++++ 5 files changed, 33 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/dependabot-auto-merge.yml create mode 100644 .github/workflows/wip-status.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..5e51ffa --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,17 @@ +name: Dependabot auto-merge + +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + call-workflow-dependabot-auto-merge: + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 + permissions: + contents: write + pull-requests: write + statuses: write + checks: read + with: + dependabot-groups: mirageo-ci-tools,pre-commit-hooks + checks-to-skip: 'pre-commit.ci - pr,CodeQL' diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index 7765352..5f2b267 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -6,7 +6,7 @@ on: jobs: call-workflow-create-jira-issue: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: issues: write secrets: diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index 084ddfc..13f6329 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -6,7 +6,7 @@ on: jobs: call-workflow-pr_jira_actions: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: read pull-requests: write diff --git a/.github/workflows/python_analysis.yml b/.github/workflows/python_analysis.yml index 0502b2e..f3e5b90 100644 --- a/.github/workflows/python_analysis.yml +++ b/.github/workflows/python_analysis.yml @@ -24,14 +24,14 @@ concurrency: jobs: call-workflow-static-analysis: name: Static analysis - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 with: package-manager: 'poetry' app-name: 'mirageoscience' python-version: '3.10' call-workflow-pytest: name: Pytest - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 with: package-manager: 'poetry' python-versions: '["3.10", "3.11", "3.12"]' diff --git a/.github/workflows/wip-status.yml b/.github/workflows/wip-status.yml new file mode 100644 index 0000000..7b10fb5 --- /dev/null +++ b/.github/workflows/wip-status.yml @@ -0,0 +1,12 @@ +name: WIP status + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review, edited] + +jobs: + call-workflow-wip-status: + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-wip-status.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 + permissions: + contents: read + statuses: write