chore(deps): pin 396 dependency versions

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM lmsysorg/sglang:dev
+FROM lmsysorg/sglang:v0.5.17@sha256:16aba8925507e631e1dc1e23d95d026533602591775f6a8db68b74ee99746155
 
 # Create non-root user with specified UID and GID
 # NOTE: Replace with your own UID and GID. This is a workaround from https://github.com/microsoft/vscode-remote-release/issues/49#issuecomment-489060908.

.github/actions/check-pr-test-health/action.yml

@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Check PR test health
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
       env:
         SKIP_PR_TEST_HEALTH_CHECK: ${{ env.SKIP_PR_TEST_HEALTH_CHECK }}
       with:

.github/actions/upload-cuda-coredumps/action.yml

@@ -54,7 +54,7 @@ runs:
 
     - name: Upload CUDA coredumps
       if: steps.check.outputs.has_dumps == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
       with:
         name: cuda-coredumps-${{ github.job }}${{ inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) }}
         path: ${{ steps.check.outputs.dump_dir }}/

.github/actions/wait-for-jobs/action.yml

@@ -34,7 +34,7 @@ runs:
   steps:
     - name: Wait for jobs to complete
       id: wait
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
       env:
         INPUT_STAGE_NAME: ${{ inputs.stage-name }}
         INPUT_JOBS: ${{ inputs.jobs }}

.github/workflows/_docker-build-and-publish.yml

@@ -60,7 +60,7 @@ jobs:
         run: sudo rm -rf "$GITHUB_WORKSPACE"/* || true
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
 
@@ -81,7 +81,7 @@ jobs:
           done
 
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
         with:
           tool-cache: true
           docker-images: true
@@ -98,10 +98,10 @@ jobs:
           docker volume prune -af
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -183,7 +183,7 @@ jobs:
         run: sudo rm -rf "$GITHUB_WORKSPACE"/* || true
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
 
@@ -210,10 +210,10 @@ jobs:
           docker volume prune -af
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -283,10 +283,10 @@ jobs:
     environment: ${{ inputs.use_environment || null }}
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/_pr-test-check-changes.yml

@@ -52,7 +52,7 @@ jobs:
       continue_on_error: ${{ steps.set-continue-on-error.outputs.continue_on_error }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           ref: ${{ inputs.git_ref || github.sha }}
 
@@ -73,7 +73,7 @@ jobs:
 
       - name: Detect file changes
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad
         if: steps.run-mode.outputs.run_all_tests != 'true'
         with:
           filters: |

.github/workflows/_pr-test-sgl-kernel-build.yml

@@ -63,15 +63,15 @@ jobs:
             echo "$GITHUB_WORKSPACE does not exist, nothing to clean"
           fi
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           submodules: "recursive"
           ref: ${{ inputs.git_ref || github.sha }}
 
       - uses: ./.github/actions/check-maintenance
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -111,7 +111,7 @@ jobs:
           ls -alh sgl-kernel/dist/*.whl
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: wheel-python${{ matrix.python-version }}-cuda${{ matrix.cuda-version }}${{ inputs.arch_suffix }}
           path: sgl-kernel/dist/*

.github/workflows/_pr-test-stage.yml

@@ -89,7 +89,7 @@ jobs:
       matrix:
         partition: ${{ fromJson(inputs.partitions)[inputs.self_name].arr }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           ref: ${{ fromJson(inputs.caller_inputs).git_ref || github.sha }}
 
@@ -106,15 +106,15 @@ jobs:
 
       - name: Download artifacts (v4)
         if: ${{ fromJson(inputs.check_changes).sgl_kernel == 'true' && steps.rc.outputs.artifact_version == 'v4' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           path: sgl-kernel/dist/
           merge-multiple: true
           pattern: wheel-python3.10-cuda*
 
       - name: Download artifacts (v6)
         if: ${{ fromJson(inputs.check_changes).sgl_kernel == 'true' && steps.rc.outputs.artifact_version == 'v6' }}
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
         with:
           path: sgl-kernel/dist/
           merge-multiple: true

.github/workflows/amd-ci-job-monitor.yml

@@ -39,10 +39,10 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
@@ -70,7 +70,7 @@ jobs:
             --dump-data-file actions-job-snapshot.json
 
       - name: Upload Actions data snapshot
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: actions-job-snapshot
           path: actions-job-snapshot.json
@@ -84,18 +84,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
       - name: Install dependencies
         run: pip install tabulate
 
       - name: Download Actions data snapshot
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: actions-job-snapshot
           path: ci-data
@@ -123,7 +123,7 @@ jobs:
       nightly_rocm720_jobs: ${{ steps.parse.outputs.nightly_rocm720_jobs }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Parse workflow files
         id: parse
@@ -172,18 +172,18 @@ jobs:
         job_name: ${{ fromJson(needs.parse-workflows.outputs.pr_jobs) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
       - name: Install dependencies
         run: pip install tabulate
 
       - name: Download Actions data snapshot
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: actions-job-snapshot
           path: ci-data
@@ -211,18 +211,18 @@ jobs:
         job_name: ${{ fromJson(needs.parse-workflows.outputs.nightly_jobs) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
       - name: Install dependencies
         run: pip install tabulate
 
       - name: Download Actions data snapshot
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: actions-job-snapshot
           path: ci-data
@@ -250,18 +250,18 @@ jobs:
         job_name: ${{ fromJson(needs.parse-workflows.outputs.pr_rocm720_jobs) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
       - name: Install dependencies
         run: pip install tabulate
 
       - name: Download Actions data snapshot
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: actions-job-snapshot
           path: ci-data
@@ -289,18 +289,18 @@ jobs:
         job_name: ${{ fromJson(needs.parse-workflows.outputs.nightly_rocm720_jobs) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
       - name: Install dependencies
         run: pip install tabulate
 
       - name: Download Actions data snapshot
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: actions-job-snapshot
           path: ci-data
@@ -324,18 +324,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 
       - name: Install dependencies
         run: pip install tabulate
 
       - name: Download Actions data snapshot
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: actions-job-snapshot
           path: ci-data

.github/workflows/auto-tune.yml

@@ -7,4 +7,4 @@ jobs:
   auto-tune-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

.github/workflows/bot-bump-flashinfer-version.yml

@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 

.github/workflows/bot-bump-kernel-version-to-sglang.yml

@@ -15,12 +15,12 @@ jobs:
       needs_sync: ${{ steps.check_sync.outputs.needs_sync }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 

.github/workflows/bot-bump-kernel-version.yml

@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'
 

.github/workflows/bot-bump-sglang-version.yml

@@ -19,12 +19,12 @@ jobs:
       branch_name: ${{ steps.set_output.outputs.branch_name }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.10'