From a29b701da8436540b3702b372dd228005da68817 Mon Sep 17 00:00:00 2001 From: Chris Burr Date: Fri, 28 Aug 2026 11:38:38 +0200 Subject: [PATCH] chore: Use only Renovate and pin GitHub Actions to commit SHAs Remove the Dependabot config, which only handled github-actions updates that Renovate already covers, so dependency updates come from a single source. Pin every action to a full commit SHA with the version as a trailing comment, and add the helpers:pinGitHubActionDigests preset so Renovate keeps new and updated actions pinned by digest. Action digest bumps are grouped into a single PR. Also drop the upterm debug step from the release workflow. --- .github/dependabot.yml | 6 ----- .github/workflows/build-and-test.yml | 36 ++++++++++++++-------------- .github/workflows/release.yaml | 10 ++------ renovate.json | 7 +++++- 4 files changed, 26 insertions(+), 33 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 5ace460..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,6 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index a0dc380..60da7ee 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -30,14 +30,14 @@ jobs: - target_arch: osx-64 os: macos-15-intel steps: - - uses: actions/checkout@v7 - - uses: prefix-dev/setup-pixi@v0.10.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1 with: cache: true - name: Build installer run: pixi run build-installer - name: Upload installer - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: installer-${{ matrix.target_arch }} path: DIRACOS-*.sh @@ -52,7 +52,7 @@ jobs: target_arch: ["linux-64"] steps: - name: Download installer - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: installer-${{ matrix.target_arch }} - name: Generate environment.yaml @@ -61,7 +61,7 @@ jobs: source diracos/diracosrc conda env export --file environment.yaml --prefix $DIRACOS - name: Upload environment.yaml - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: environment-yaml-${{ matrix.target_arch }} path: | @@ -73,13 +73,13 @@ jobs: needs: get-info runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: prefix-dev/setup-pixi@v0.10.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1 with: cache: true environments: release - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: artifacts - name: Create release notes @@ -90,7 +90,7 @@ jobs: > release-notes.md cat release-notes.md - name: Upload release-notes.md - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-notes path: | @@ -121,9 +121,9 @@ jobs: installer: installer-linux-aarch64 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download installer - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ matrix.installer }} - name: Run tests @@ -139,9 +139,9 @@ jobs: matrix: os: [macos-15-intel] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download installer - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: installer-osx-64 - name: Run tests @@ -161,9 +161,9 @@ jobs: matrix: os: [macos-14, macos-15] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download installer - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: installer-osx-arm64 - name: Run tests @@ -186,12 +186,12 @@ jobs: - rel-v9r0 - integration steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - name: Download installer - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: installer-linux-64 - name: Prepare environment diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 45f6e63..55d9d24 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -17,8 +17,8 @@ jobs: if: github.repository == 'DIRACGrid/DIRACOS2' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: prefix-dev/setup-pixi@v0.10.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1 with: cache: true environments: release @@ -29,9 +29,3 @@ jobs: --run-id="${{ github.event.inputs.run_id }}" \ --version="${{ github.event.inputs.version }}" \ --make-release - - name: Setup upterm session - # uses: lhotari/action-upterm@v1 - uses: chrisburr/action-upterm@patch-1 - if: ${{ failure() }} - with: - limit-access-to-actor: true diff --git a/renovate.json b/renovate.json index d13c643..3cd1345 100644 --- a/renovate.json +++ b/renovate.json @@ -3,7 +3,8 @@ "extends": [ "config:recommended", ":dependencyDashboard", - "group:allNonMajor" + "group:allNonMajor", + "helpers:pinGitHubActionDigests" ], "minimumReleaseAge": "7 days", "internalChecksFilter": "strict", @@ -11,6 +12,10 @@ { "matchManagers": ["pixi"], "groupName": "pixi dependencies" + }, + { + "matchManagers": ["github-actions"], + "groupName": "github-actions" } ] }