diff --git a/.github/workflows/changelog-build.yml b/.github/workflows/changelog-build.yml index 8ae4344f..94925bad 100644 --- a/.github/workflows/changelog-build.yml +++ b/.github/workflows/changelog-build.yml @@ -22,14 +22,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout branch - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: ref: main fetch-depth: 0 - name: Build Changelog id: github_tag - uses: mikepenz/release-changelog-builder-action@v3.3.1 + uses: mikepenz/release-changelog-builder-action@000e44613cdb6c340ac98cb1582f99e8d3230058 # v3.3.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -80,7 +80,7 @@ jobs: run: cat CHANGELOG.md - name: Create or update label - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 with: script: | const labelName = '${{ inputs.release-branch }}'; @@ -112,7 +112,7 @@ jobs: } - name: Create Pull Request - uses: peter-evans/create-pull-request@v7 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 with: commit-message: "beep boop: Update changelog" title: "Update changelog for `${{ inputs.release-branch }}`" diff --git a/.github/workflows/cherry-pick-release-commit.yml b/.github/workflows/cherry-pick-release-commit.yml index 32f06df5..c99145a1 100644 --- a/.github/workflows/cherry-pick-release-commit.yml +++ b/.github/workflows/cherry-pick-release-commit.yml @@ -7,7 +7,7 @@ on: jobs: cherry-pick: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@v0.63.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@8ebb3aec4c246c944a25adc7b09107cbd6a76976 # v0.63.0 secrets: PAT: ${{ secrets.PAT }} SLACK_WEBHOOK_ADMIN: ${{ secrets.SLACK_WEBHOOK_ADMIN }} diff --git a/.github/workflows/close-inactive-issue-pr.yml b/.github/workflows/close-inactive-issue-pr.yml index b81f8293..61c57c8f 100644 --- a/.github/workflows/close-inactive-issue-pr.yml +++ b/.github/workflows/close-inactive-issue-pr.yml @@ -5,4 +5,4 @@ on: jobs: close-issues: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_close_inactive_issue_pr.yml@v0.44.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_close_inactive_issue_pr.yml@9e07489b8a6bc533c8792099b012c588f4430298 # v0.44.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c0cd20e6..2311eb10 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,11 +38,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -57,7 +57,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -70,6 +70,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/community-bot.yml b/.github/workflows/community-bot.yml index fa004e28..4c507c19 100644 --- a/.github/workflows/community-bot.yml +++ b/.github/workflows/community-bot.yml @@ -8,7 +8,7 @@ on: jobs: community-bot: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_community_bot.yml@v0.54.4 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_community_bot.yml@a8006e87bff5bce54336c3e1e8571563ac70d88e # v0.54.4 with: community_project_id: ${{ vars.COMMUNITY_PROJECT_ID }} secrets: diff --git a/.github/workflows/copyright-check.yml b/.github/workflows/copyright-check.yml index 55d95abd..6dd2e2ee 100644 --- a/.github/workflows/copyright-check.yml +++ b/.github/workflows/copyright-check.yml @@ -20,4 +20,4 @@ on: jobs: copyright-check: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@v0.54.4 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@a8006e87bff5bce54336c3e1e8571563ac70d88e # v0.54.4 diff --git a/.github/workflows/detect-secrets.yml b/.github/workflows/detect-secrets.yml index d7aae1cd..fff5bcf2 100644 --- a/.github/workflows/detect-secrets.yml +++ b/.github/workflows/detect-secrets.yml @@ -18,4 +18,4 @@ on: jobs: secrets-detector: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@v0.74.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@859ae21dd5588c87e3bde499ddab7a3025773e8d # v0.74.0 diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index 740349bb..c660cf27 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -16,10 +16,10 @@ jobs: os: [ubuntu-latest, macos-latest, ubuntu-22.04-arm] python: ["3.10", "3.11", "3.12"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Setup Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "${{ matrix.python }}" diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 81850f76..2350ffe1 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -17,10 +17,10 @@ jobs: runs-on: ubuntu-latest needs: [format, lint, test] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Create nightly tag - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 with: script: | // Delete existing nightly tag if it exists diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml index 024ccdaf..1a485892 100644 --- a/.github/workflows/release-docs.yml +++ b/.github/workflows/release-docs.yml @@ -78,7 +78,7 @@ on: jobs: build-docs: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@v0.67.0 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@3ab507cd035df3ae37cce8808ed3210ff6e7062b # v0.67.0 with: ref: ${{ inputs.github-ref }} @@ -86,7 +86,7 @@ jobs: runs-on: ubuntu-latest needs: [build-docs] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: repository: NVIDIA-NeMo/FW-CI-templates ref: v0.74.0 diff --git a/.github/workflows/release-freeze.yml b/.github/workflows/release-freeze.yml index 1996d062..b2b277ae 100644 --- a/.github/workflows/release-freeze.yml +++ b/.github/workflows/release-freeze.yml @@ -21,7 +21,7 @@ on: default: true jobs: code-freeze: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_code_freeze.yml@v1.4.2 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_code_freeze.yml@bfdb5e35067fd8cd91ce21fca4eb1072ffd7ab8c # v1.4.2 with: library-name: NeMo Run python-package: nemo_run diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2305ca21..ca9298cb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -63,7 +63,7 @@ concurrency: jobs: release: if: '!cancelled()' - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@v1.4.3 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@f7af92c4d1caea5a58577ce4ac5314f7de1bc5d4 # v1.4.3 with: release-ref: ${{ inputs.release-ref || github.sha }} python-package: nemo_run diff --git a/.github/workflows/ruff-format.yml b/.github/workflows/ruff-format.yml index 9369e6df..1a1957d5 100644 --- a/.github/workflows/ruff-format.yml +++ b/.github/workflows/ruff-format.yml @@ -12,10 +12,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Install the latest version of uv - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 with: version: "latest" diff --git a/.github/workflows/ruff-lint.yml b/.github/workflows/ruff-lint.yml index 1efe83ee..df6df6f1 100644 --- a/.github/workflows/ruff-lint.yml +++ b/.github/workflows/ruff-lint.yml @@ -12,10 +12,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Install the latest version of uv - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 with: version: "latest" diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml index e782cdb5..f426dfcf 100644 --- a/.github/workflows/spelling.yml +++ b/.github/workflows/spelling.yml @@ -11,8 +11,8 @@ jobs: name: "Spell check" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: crate-ci/typos@master + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: crate-ci/typos@3bc303c295c081add5df4a4d52a1e117f2fb2dce # master with: files: . config: ./.github/workflows/config/typos.toml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b301f651..b1e1d206 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,10 +12,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Install the latest version of uv - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 with: version: "latest" @@ -48,7 +48,7 @@ jobs: uv run -- coverage report - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: coverage.xml