From 91da80e33294e39951db91d24a626a4c5a7c261d Mon Sep 17 00:00:00 2001 From: Keith Lee Date: Wed, 1 Apr 2026 21:56:18 +0100 Subject: [PATCH] chore: Pin setup-uv action to commit SHA for supply chain security Pin astral-sh/setup-uv to commit SHA 37802adc94f370d6bfd71619e3f0bf239e1f3b78 instead of the mutable v4 tag to prevent supply chain attacks. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build_and_test_python.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_and_test_python.yml b/.github/workflows/build_and_test_python.yml index 39dfa980..94ccb263 100644 --- a/.github/workflows/build_and_test_python.yml +++ b/.github/workflows/build_and_test_python.yml @@ -53,7 +53,7 @@ jobs: python-version: ${{ matrix.python }} - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v4 - name: Install protoc run: sudo apt-get update && sudo apt-get install -y protobuf-compiler