Skip to content

Commit 77c276d

Browse files
crookedstormcrookedstorm
authored
ci: pin all versions for third party actions (#271)
* ci: pin all versions for third party actions Signed-off-by: Brooke Storm <brookes@nvidia.com> * ci: rollback the pnmp action pin Signed-off-by: Brooke Storm <brookes@nvidia.com> * ci: try moving away from the setup action from pnmp Signed-off-by: Brooke Storm <brookes@nvidia.com> * ci: correct the setup of node Signed-off-by: Brooke Storm <brookes@nvidia.com> * chore: turn off creds Signed-off-by: Brooke Storm <brookes@nvidia.com> --------- Signed-off-by: Brooke Storm <brookes@nvidia.com>
1 parent 36efeb9 commit 77c276d

4 files changed

Lines changed: 68 additions & 25 deletions

File tree

‎.github/actions/build-nemo-platform-wheel/action.yaml‎

Lines changed: 52 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Build nemo-platform wheel
22
description: >
3-
Set up the build toolchain (uv, plus pnpm/node when building nemo-platform
3+
Set up the build toolchain (uv, plus node/pnpm when building nemo-platform
44
so the hatch hook can compile Studio assets), stamp the SDK version, and
55
run `uv build --wheel --package <pkg>`. The build itself — including
66
Studio asset compilation and wheel content force-includes — lives in the
@@ -52,6 +52,12 @@ inputs:
5252
the ci.yaml test job uses `.`.
5353
required: false
5454
default: "."
55+
studio-web-root:
56+
description: >
57+
Path to the Studio pnpm workspace, relative to source-root. This is the
58+
directory containing package.json and pnpm-lock.yaml.
59+
required: false
60+
default: web
5561

5662
outputs:
5763
wheel-path:
@@ -65,7 +71,7 @@ runs:
6571
using: composite
6672
steps:
6773
- name: Install uv
68-
uses: astral-sh/setup-uv@v7
74+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
6975
with:
7076
python-version: ${{ inputs.python-version }}
7177
enable-cache: true
@@ -110,22 +116,58 @@ runs:
110116
echo "wheel-version=${wheel_version}" >>"${GITHUB_OUTPUT}"
111117
112118
# Studio assets are only force-included by the nemo-platform wrapper.
113-
# The hatch hook in packages/nemo-platform/hatch_build.py compiles them
114-
# via pnpm during `uv build`; we set up pnpm/node here so the hook can
119+
# The hatch hook in packages/nemo_platform/hatch_build.py compiles them
120+
# via pnpm during `uv build`; we set up node/pnpm here so the hook can
115121
# find them. Other packages (nemo-platform-plugin, ...) skip these.
116-
- name: Set up pnpm
122+
- name: Set up Node.js
117123
if: inputs.package == 'nemo-platform'
118-
uses: pnpm/action-setup@v4
124+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
119125
with:
120-
package_json_file: ${{ inputs.source-root }}/web/package.json
126+
node-version: "22"
121127

122-
- name: Set up Node.js
128+
- name: Install pnpm via Corepack
129+
if: inputs.package == 'nemo-platform'
130+
shell: bash
131+
env:
132+
STUDIO_WEB_ROOT: ${{ inputs.source-root }}/${{ inputs.studio-web-root }}
133+
run: |
134+
set -euo pipefail
135+
136+
if [[ ! -d "${STUDIO_WEB_ROOT}" ]]; then
137+
echo "::error::Studio web root not found at ${STUDIO_WEB_ROOT}" >&2
138+
exit 1
139+
fi
140+
141+
studio_web_root="$(cd "${STUDIO_WEB_ROOT}" && pwd -P)"
142+
package_json="${studio_web_root}/package.json"
143+
lockfile="${studio_web_root}/pnpm-lock.yaml"
144+
if [[ ! -f "${package_json}" ]]; then
145+
echo "::error::Studio package.json not found at ${package_json}" >&2
146+
exit 1
147+
fi
148+
if [[ ! -f "${lockfile}" ]]; then
149+
echo "::error::Studio pnpm lockfile not found at ${lockfile}" >&2
150+
exit 1
151+
fi
152+
153+
package_manager="$(PACKAGE_JSON="${package_json}" node -p "JSON.parse(require('fs').readFileSync(process.env.PACKAGE_JSON, 'utf8')).packageManager || ''")"
154+
if [[ "${package_manager}" != pnpm@* ]]; then
155+
echo "::error::Expected ${package_json} to declare packageManager: pnpm@..., got '${package_manager}'" >&2
156+
exit 1
157+
fi
158+
159+
npm i -g corepack@0.31.0
160+
corepack enable pnpm
161+
corepack prepare "${package_manager}" --activate
162+
pnpm --dir "${studio_web_root}" --version
163+
164+
- name: Restore pnpm cache
123165
if: inputs.package == 'nemo-platform'
124-
uses: actions/setup-node@v4
166+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
125167
with:
126168
node-version: "22"
127169
cache: pnpm
128-
cache-dependency-path: ${{ inputs.source-root }}/web/pnpm-lock.yaml
170+
cache-dependency-path: ${{ inputs.source-root }}/${{ inputs.studio-web-root }}/pnpm-lock.yaml
129171

130172
- name: Build wheel
131173
id: build

‎.github/workflows/release-bundle.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ jobs:
6464
steps:
6565
# Fetch tags so RC auto-increment can use plain local Git.
6666
- name: Checkout workflow code
67-
uses: actions/checkout@v6
67+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6868
with:
6969
fetch-depth: 0
7070
fetch-tags: true
@@ -225,7 +225,7 @@ jobs:
225225
} >>"${GITHUB_OUTPUT}"
226226
227227
- name: Checkout selected source
228-
uses: actions/checkout@v6
228+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
229229
with:
230230
repository: ${{ github.repository }}
231231
ref: ${{ inputs.cadence == 'nightly' && steps.resolve-nightly-source.outputs.source_sha || inputs.source_sha }}
@@ -323,7 +323,7 @@ jobs:
323323
contents: write
324324
steps:
325325
- name: Checkout source at release SHA
326-
uses: actions/checkout@v6
326+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
327327
with:
328328
ref: ${{ needs.plan-release.outputs.source_sha }}
329329
fetch-tags: true
@@ -372,12 +372,12 @@ jobs:
372372
matrix: ${{ fromJson(needs.plan-release.outputs.sdk_matrix) }}
373373
steps:
374374
- name: Checkout workflow code
375-
uses: actions/checkout@v6
375+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
376376
with:
377377
path: workflow
378378

379379
- name: Checkout source
380-
uses: actions/checkout@v6
380+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
381381
with:
382382
repository: ${{ needs.plan-release.outputs.source_repo }}
383383
ref: ${{ needs.plan-release.outputs.source_sha }}
@@ -400,7 +400,7 @@ jobs:
400400
nightly-timestamp: ${{ needs.plan-release.outputs.nightly_timestamp }}
401401

402402
- name: Upload SDK wheel
403-
uses: actions/upload-artifact@v6
403+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
404404
with:
405405
name: release-sdk-${{ matrix.id }}
406406
path: ${{ steps.build-sdk-wheel.outputs.wheel-path }}
@@ -424,17 +424,17 @@ jobs:
424424
release_checksums_digest: ${{ steps.upload-release.outputs.checksums_digest }}
425425
steps:
426426
- name: Checkout workflow code
427-
uses: actions/checkout@v6
427+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
428428

429429
- name: Download SDK wheels
430-
uses: actions/download-artifact@v8
430+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
431431
with:
432432
pattern: release-sdk-*
433433
path: downloaded-sdk-artifacts
434434
merge-multiple: false
435435

436436
- name: Install uv
437-
uses: astral-sh/setup-uv@v7
437+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
438438
with:
439439
python-version: "3.11"
440440

@@ -470,7 +470,7 @@ jobs:
470470
- name: Upload release bundle artifact
471471
id: upload-release-bundle
472472
if: inputs.cadence == 'nightly'
473-
uses: actions/upload-artifact@v6
473+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
474474
with:
475475
name: release-bundle-${{ needs.plan-release.outputs.release_label }}
476476
path: release-bundle/

‎.github/workflows/security.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,11 @@ jobs:
2626
if: ${{ github.event_name == 'merge_group' }}
2727
run: echo "Skipping secrets scan for merge queue"
2828

29-
- uses: actions/checkout@v6
29+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
3030
if: ${{ github.event_name != 'merge_group' }}
3131
with:
3232
fetch-depth: 0
33+
persist-credentials: false
3334
- name: TruffleHog OSS
3435
if: ${{ github.event_name != 'merge_group' }}
3536
id: trufflehog
@@ -58,15 +59,15 @@ jobs:
5859

5960
steps:
6061
- name: Checkout repository
61-
uses: actions/checkout@v6
62+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6263

6364
- name: Initialize CodeQL
64-
uses: github/codeql-action/init@v4
65+
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
6566
with:
6667
languages: ${{matrix.language}}
6768
config-file: ./.github/codeql/codeql-config.yml
6869

6970
- name: Perform CodeQL Analysis
70-
uses: github/codeql-action/analyze@v4
71+
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
7172
with:
7273
category: "/language:${{matrix.language}}"

‎.github/workflows/semantic-pull-requests.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,4 @@ permissions:
1717

1818
jobs:
1919
semantic-pull-request:
20-
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@v0.65.12
20+
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@d48ee21a4986f7281abf746b7d500880c0e91f41 # v1.5.1

0 commit comments

Comments
 (0)