chore: change to centralized managed GitHub pool

.github/workflows/cd-langchain.yml

@@ -11,26 +11,26 @@ on:
 jobs:
   build:
     name: Build package
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     environment: pypi
     permissions:
       contents: read
       id-token: write
       actions: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           fetch-depth: 2
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           version: "0.9.27"
           enable-cache: true
 
       - name: "Set up Python"
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version-file: ".python-version"
 
@@ -113,12 +113,12 @@ jobs:
   release:
     name: Create GitHub release
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     permissions:
       contents: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: Get version
         id: version
@@ -141,7 +141,7 @@ jobs:
           "
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
         with:
           tag_name: langchain-v${{ steps.version.outputs.version }}
           name: UiPath LangChain Client [langchain-v${{ steps.version.outputs.version }}]

.github/workflows/cd.yml

@@ -11,23 +11,23 @@ on:
 jobs:
   build:
     name: Build package
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     environment: pypi
     permissions:
       contents: read
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           version: "0.9.27"
           enable-cache: true
 
       - name: "Set up Python"
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version-file: ".python-version"
 
@@ -53,12 +53,12 @@ jobs:
   release:
     name: Create GitHub release
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     permissions:
       contents: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: Get version
         id: version
@@ -81,7 +81,7 @@ jobs:
           "
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
         with:
           tag_name: v${{ steps.version.outputs.version }}
           name: UiPath LLM Client [v${{ steps.version.outputs.version }}]

.github/workflows/ci.yml

@@ -18,18 +18,18 @@ permissions:
 jobs:
   type_check:
     name: Type Check and Lint
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           version: "0.9.27"
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version-file: ".python-version"
 
@@ -46,18 +46,18 @@ jobs:
 
   import_without_extras:
     name: Import Without Extras
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           version: "0.9.27"
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version-file: ".python-version"
 
@@ -71,7 +71,7 @@ jobs:
 
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     needs: type_check
     environment: LLMGW_SETTINGS
     env:
@@ -85,18 +85,18 @@ jobs:
       LLMGW_CLIENT_ID: ${{ secrets.LLMGW_CLIENT_ID }}
       LLMGW_CLIENT_SECRET: ${{ secrets.LLMGW_CLIENT_SECRET }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           lfs: true
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           version: "0.9.27"
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version-file: ".python-version"
 

.github/workflows/ci_change_version.yml

@@ -8,9 +8,9 @@ on:
 jobs:
   validate-uipath-llm-client:
     name: uipath-llm-client
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           fetch-depth: 0
 
@@ -42,9 +42,9 @@ jobs:
 
   validate-uipath-langchain-client:
     name: uipath-langchain-client
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           fetch-depth: 0
 

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43  # v4.37.5
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -96,6 +96,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43  # v4.37.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/publish-dev.yml

@@ -6,61 +6,61 @@
 
 jobs:
   detect-changes:
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'build:dev')
     outputs:
       core-changed: ${{ steps.changes.outputs.core }}
       langchain-changed: ${{ steps.changes.outputs.langchain }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           fetch-depth: 0
 
       - name: Detect changed packages
         id: changes
         run: |
           # Get list of changed files
           git diff origin/main...HEAD --name-only > changes.txt
           echo "Changed files:"
           cat changes.txt
 
           # Check if core package changed
           if grep -qE '^src/uipath/llm_client/' changes.txt; then
             echo "core=true" >> $GITHUB_OUTPUT
             echo "Core package has changes"
           else
             echo "core=false" >> $GITHUB_OUTPUT
             echo "Core package has no changes"
           fi
 
           # Check if langchain package changed
           if grep -qE '^packages/uipath_langchain_client/' changes.txt; then
             echo "langchain=true" >> $GITHUB_OUTPUT
             echo "Langchain package has changes"
           else
             echo "langchain=false" >> $GITHUB_OUTPUT
             echo "Langchain package has no changes"
           fi
 
   publish-dev:
     needs: detect-changes
-    runs-on: ubuntu-latest
+    runs-on: uipath-ubuntu-latest
     if: needs.detect-changes.outputs.core-changed == 'true' || needs.detect-changes.outputs.langchain-changed == 'true'
     permissions:
       contents: read
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           version: "0.9.27"
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version-file: ".python-version"