Skip to content

Commit 89aafb3

Browse files
lfnovolfnovo
authored
Merge branch 'main' into chore/process-discussions-skill-2026-09-05
2 parents 2855fb8 + 97e5504 commit 89aafb3

21 files changed

Lines changed: 179 additions & 44 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
cooldown:
8+
default-days: 7
9+
groups:
10+
all-actions:
11+
patterns:
12+
- "*"
13+
actions-security:
14+
applies-to: security-updates
15+
patterns:
16+
- "*"
17+
18+
- package-ecosystem: "uv"
19+
directory: "/"
20+
schedule:
21+
interval: "weekly"
22+
cooldown:
23+
default-days: 7
24+
groups:
25+
all-python:
26+
patterns:
27+
- "*"
28+
python-security:
29+
applies-to: security-updates
30+
patterns:
31+
- "*"
32+
33+
- package-ecosystem: "npm"
34+
directory: "/frontend"
35+
schedule:
36+
interval: "weekly"
37+
cooldown:
38+
default-days: 7
39+
groups:
40+
all-npm:
41+
patterns:
42+
- "*"
43+
npm-security:
44+
applies-to: security-updates
45+
patterns:
46+
- "*"
47+
48+
- package-ecosystem: "docker"
49+
directory: "/"
50+
schedule:
51+
interval: "weekly"
52+
cooldown:
53+
default-days: 7
54+
groups:
55+
all-docker:
56+
patterns:
57+
- "*"
58+
docker-security:
59+
applies-to: security-updates
60+
patterns:
61+
- "*"

‎.github/workflows/build-and-release.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
has_dockerhub_secrets: ${{ steps.check.outputs.has_dockerhub_secrets }}
2828
steps:
2929
- name: Checkout
30-
uses: actions/checkout@v6
30+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
3131

3232
- name: Extract version from pyproject.toml
3333
id: version
@@ -55,7 +55,7 @@ jobs:
5555
runs-on: ubuntu-latest
5656
steps:
5757
- name: Checkout
58-
uses: actions/checkout@v6
58+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
5959

6060
- name: Free up disk space
6161
run: |
@@ -67,24 +67,24 @@ jobs:
6767
df -h
6868
6969
- name: Set up Docker Buildx
70-
uses: docker/setup-buildx-action@v4
70+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
7171

7272
- name: Login to GitHub Container Registry
73-
uses: docker/login-action@v4
73+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
7474
with:
7575
registry: ghcr.io
7676
username: ${{ github.actor }}
7777
password: ${{ secrets.GITHUB_TOKEN }}
7878

7979
- name: Login to Docker Hub
8080
if: needs.extract-version.outputs.has_dockerhub_secrets == 'true'
81-
uses: docker/login-action@v4
81+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
8282
with:
8383
username: ${{ secrets.DOCKER_USERNAME }}
8484
password: ${{ secrets.DOCKER_PASSWORD }}
8585

8686
- name: Cache Docker layers
87-
uses: actions/cache@v5
87+
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
8888
with:
8989
path: /tmp/.buildx-cache
9090
key: ${{ runner.os }}-buildx-regular-${{ github.sha }}
@@ -126,7 +126,7 @@ jobs:
126126
echo "Generated tags: ${TAGS}"
127127
128128
- name: Build and push regular image
129-
uses: docker/build-push-action@v7
129+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
130130
with:
131131
context: .
132132
file: ./Dockerfile
@@ -147,7 +147,7 @@ jobs:
147147
runs-on: ubuntu-latest
148148
steps:
149149
- name: Checkout
150-
uses: actions/checkout@v6
150+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
151151

152152
- name: Free up disk space
153153
run: |
@@ -159,24 +159,24 @@ jobs:
159159
df -h
160160
161161
- name: Set up Docker Buildx
162-
uses: docker/setup-buildx-action@v4
162+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
163163

164164
- name: Login to GitHub Container Registry
165-
uses: docker/login-action@v4
165+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
166166
with:
167167
registry: ghcr.io
168168
username: ${{ github.actor }}
169169
password: ${{ secrets.GITHUB_TOKEN }}
170170

171171
- name: Login to Docker Hub
172172
if: needs.extract-version.outputs.has_dockerhub_secrets == 'true'
173-
uses: docker/login-action@v4
173+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
174174
with:
175175
username: ${{ secrets.DOCKER_USERNAME }}
176176
password: ${{ secrets.DOCKER_PASSWORD }}
177177

178178
- name: Cache Docker layers
179-
uses: actions/cache@v5
179+
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
180180
with:
181181
path: /tmp/.buildx-cache-single
182182
key: ${{ runner.os }}-buildx-single-${{ github.sha }}
@@ -218,7 +218,7 @@ jobs:
218218
echo "Generated tags: ${TAGS}"
219219
220220
- name: Build and push single-container image
221-
uses: docker/build-push-action@v7
221+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
222222
with:
223223
context: .
224224
file: ./Dockerfile

‎.github/workflows/build-dev.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
is_push_to_main: ${{ steps.check.outputs.is_push_to_main }}
4040
steps:
4141
- name: Checkout
42-
uses: actions/checkout@v6
42+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
4343

4444
- name: Extract version from pyproject.toml
4545
id: version
@@ -85,10 +85,10 @@ jobs:
8585
image: ${{ steps.filter.outputs.image }}
8686
steps:
8787
- name: Checkout
88-
uses: actions/checkout@v6
88+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
8989

9090
- name: Detect image-affecting changes
91-
uses: dorny/paths-filter@v3
91+
uses: dorny/paths-filter@15192bc058cc28a13dbf6cde61f19e18988b7af6 # v3
9292
id: filter
9393
with:
9494
filters: |
@@ -111,7 +111,7 @@ jobs:
111111
runs-on: ubuntu-latest
112112
steps:
113113
- name: Checkout
114-
uses: actions/checkout@v6
114+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
115115

116116
- name: Skip notice
117117
if: needs.extract-version.outputs.is_push_to_main != 'true' && needs.changes.outputs.image != 'true'
@@ -129,26 +129,26 @@ jobs:
129129
130130
- name: Set up Docker Buildx
131131
if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true'
132-
uses: docker/setup-buildx-action@v4
132+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
133133

134134
- name: Login to GitHub Container Registry
135135
if: needs.extract-version.outputs.is_push_to_main == 'true'
136-
uses: docker/login-action@v4
136+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
137137
with:
138138
registry: ghcr.io
139139
username: ${{ github.actor }}
140140
password: ${{ secrets.GITHUB_TOKEN }}
141141

142142
- name: Login to Docker Hub
143143
if: needs.extract-version.outputs.is_push_to_main == 'true' && needs.extract-version.outputs.has_dockerhub_secrets == 'true'
144-
uses: docker/login-action@v4
144+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
145145
with:
146146
username: ${{ secrets.DOCKER_USERNAME }}
147147
password: ${{ secrets.DOCKER_PASSWORD }}
148148

149149
- name: Cache Docker layers
150150
if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true'
151-
uses: actions/cache@v5
151+
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
152152
with:
153153
path: /tmp/.buildx-cache-dev
154154
key: ${{ runner.os }}-buildx-dev-${{ github.sha }}
@@ -177,7 +177,7 @@ jobs:
177177
178178
- name: Build and push regular image
179179
if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true'
180-
uses: docker/build-push-action@v7
180+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
181181
with:
182182
context: .
183183
file: ./Dockerfile
@@ -201,7 +201,7 @@ jobs:
201201
runs-on: ubuntu-latest
202202
steps:
203203
- name: Checkout
204-
uses: actions/checkout@v6
204+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
205205

206206
- name: Free up disk space
207207
run: |
@@ -213,24 +213,24 @@ jobs:
213213
df -h
214214
215215
- name: Set up Docker Buildx
216-
uses: docker/setup-buildx-action@v4
216+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
217217

218218
- name: Login to GitHub Container Registry
219-
uses: docker/login-action@v4
219+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
220220
with:
221221
registry: ghcr.io
222222
username: ${{ github.actor }}
223223
password: ${{ secrets.GITHUB_TOKEN }}
224224

225225
- name: Login to Docker Hub
226226
if: needs.extract-version.outputs.has_dockerhub_secrets == 'true'
227-
uses: docker/login-action@v4
227+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
228228
with:
229229
username: ${{ secrets.DOCKER_USERNAME }}
230230
password: ${{ secrets.DOCKER_PASSWORD }}
231231

232232
- name: Cache Docker layers
233-
uses: actions/cache@v5
233+
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
234234
with:
235235
path: /tmp/.buildx-cache-dev-single
236236
key: ${{ runner.os }}-buildx-dev-single-${{ github.sha }}
@@ -247,7 +247,7 @@ jobs:
247247
echo "tags=${TAGS}" >> $GITHUB_OUTPUT
248248
249249
- name: Build and push single-container image
250-
uses: docker/build-push-action@v7
250+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
251251
with:
252252
context: .
253253
file: ./Dockerfile

‎.github/workflows/docs-links.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,13 @@ on:
77
- "scripts/check_md_links.py"
88
- ".github/workflows/docs-links.yml"
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
check-links:
1215
runs-on: ubuntu-latest
1316
steps:
14-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
1518
- name: Check relative markdown links
1619
run: python3 scripts/check_md_links.py

‎.github/workflows/test.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout
22-
uses: actions/checkout@v6
22+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
2323

2424
- name: Set up uv
25-
uses: astral-sh/setup-uv@v8.1.0
25+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
2626
with:
2727
enable-cache: true
2828

@@ -36,7 +36,7 @@ jobs:
3636
run: uv run pytest tests/ -v --cov=open_notebook --cov=api --cov-report=term-missing --cov-report=xml
3737

3838
- name: Upload coverage artifact
39-
uses: actions/upload-artifact@v4
39+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
4040
with:
4141
name: backend-coverage
4242
path: coverage.xml
@@ -46,10 +46,10 @@ jobs:
4646
runs-on: ubuntu-latest
4747
steps:
4848
- name: Checkout
49-
uses: actions/checkout@v6
49+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
5050

5151
- name: Set up uv
52-
uses: astral-sh/setup-uv@v8.1.0
52+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
5353
with:
5454
enable-cache: true
5555

@@ -67,10 +67,10 @@ jobs:
6767
runs-on: ubuntu-latest
6868
steps:
6969
- name: Checkout
70-
uses: actions/checkout@v6
70+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
7171

7272
- name: Set up uv
73-
uses: astral-sh/setup-uv@v8.1.0
73+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
7474
with:
7575
enable-cache: true
7676

@@ -91,10 +91,10 @@ jobs:
9191
working-directory: frontend
9292
steps:
9393
- name: Checkout
94-
uses: actions/checkout@v6
94+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
9595

9696
- name: Set up Node.js
97-
uses: actions/setup-node@v6
97+
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
9898
with:
9999
node-version: 22
100100
cache: npm
@@ -107,7 +107,7 @@ jobs:
107107
run: npm run test:coverage
108108

109109
- name: Upload coverage artifact
110-
uses: actions/upload-artifact@v4
110+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
111111
with:
112112
name: frontend-coverage
113113
path: frontend/coverage/
@@ -120,10 +120,10 @@ jobs:
120120
working-directory: frontend
121121
steps:
122122
- name: Checkout
123-
uses: actions/checkout@v6
123+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
124124

125125
- name: Set up Node.js
126-
uses: actions/setup-node@v6
126+
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
127127
with:
128128
node-version: 22
129129
cache: npm
@@ -143,10 +143,10 @@ jobs:
143143
working-directory: frontend
144144
steps:
145145
- name: Checkout
146-
uses: actions/checkout@v6
146+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
147147

148148
- name: Set up Node.js
149-
uses: actions/setup-node@v6
149+
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
150150
with:
151151
node-version: 22
152152
cache: npm

0 commit comments

Comments
 (0)