From 1d01539e74931dfc989e69e84de2d188229999d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bal=C5=A1a=20=C5=A0arenac?= Date: Fri, 23 Oct 2026 14:11:34 +0200 Subject: [PATCH] ci: pin astral-sh/setup-uv to a commit SHA A tag or branch can be moved to different code. In March 2026 the Trivy action tags were moved to steal CI secrets. A commit SHA cannot be moved. A run only changes when someone edits this file. This pins setup-uv v7 (v7.6.0) to the commit that tag points to today. Behaviour is the same. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cba4a55..9852562 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: python-version: "${{ matrix.python-version }}" architecture: x64 - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 - name: Create virtualenv run: |