From 6d5e58549304a69240e0bfd9713d677f34455acb Mon Sep 17 00:00:00 2001 From: BP <11394934+benjipeng@users.noreply.github.com> Date: Fri, 7 Aug 2026 18:31:29 -0400 Subject: [PATCH] Pin every workflow action to an exact current release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both workflows were a major version behind on checkout and two majors behind on setup-uv, and carried floating tags elsewhere. - actions/checkout v6 -> v7.0.1 - astral-sh/setup-uv v7 -> v9.0.0 - actions/upload-artifact v7 -> v7.0.1 - actions/download-artifact v8 -> v8.0.1 - pypa/gh-action-pypi-publish release/v1 -> v1.14.2 The setup-uv jump crosses two majors, so its release notes decided two details rather than the version number alone. v8 stopped publishing major and minor tags on purpose: pinning to @v9 would reopen exactly the supply-chain hole they closed after tj-actions. An exact release is the only supported form now. v9's single breaking change flips `prune-cache` from true to false, which grows the Actions cache instead of trimming it and can raise cost. That default is set back explicitly, so the upgrade changes versions and nothing else. Its other breaking change, the manifest-file format, does not apply — neither workflow defines one. Both checkouts now set persist-credentials: false. Neither workflow pushes, so nothing needs the token left in .git/config. workflow.yaml only runs on a published release, so no pull request exercises it and the green check on this one says nothing about it. All three workflow files were parsed locally, and the release build job was reproduced end to end: uv build produced both artifacts including the arm64 native wheel, check_release_artifacts.py passed, and the native backend smoke test reported Metal available. --- .github/workflows/test.yaml | 11 +++++++++-- .github/workflows/workflow.yaml | 20 +++++++++++++++----- 2 files changed, 24 insertions(+), 7 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index be78923..905fffa 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -15,12 +15,19 @@ jobs: runs-on: macos-15 steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + # setup-uv stopped publishing major tags at v8, deliberately: pinning to + # @v9 would be the supply-chain hole they closed. prune-cache is set + # explicitly because v9 flipped its default to false, which grows the + # Actions cache rather than trimming it. - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@v9.0.0 with: python-version: "3.13" + prune-cache: true - name: Create test scratch directory run: | diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml index ea2ce24..f71c900 100644 --- a/.github/workflows/workflow.yaml +++ b/.github/workflows/workflow.yaml @@ -16,12 +16,19 @@ jobs: contents: read steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + # setup-uv stopped publishing major tags at v8, deliberately: pinning to + # @v9 would be the supply-chain hole they closed. prune-cache is set + # explicitly because v9 flipped its default to false, which grows the + # Actions cache rather than trimming it. - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@v9.0.0 with: python-version: "3.13" + prune-cache: true - name: Build package run: | @@ -40,7 +47,7 @@ jobs: "from mlx_spatial.spatialkit import backend_info; info = backend_info(); assert info['native']; print(info)" - name: Upload package artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: mlx-spatial-dist path: dist/* @@ -58,10 +65,13 @@ jobs: id-token: write steps: - name: Download package artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@v8.0.1 with: name: mlx-spatial-dist path: dist + # PyPA suggests the floating release/v1 tag. This job is the one place in + # the repository that holds an OIDC id-token, so it pins an exact release + # instead: a compromised upstream tag here could publish as us. - name: Publish package - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@v1.14.2