From 3ae64810f3b585b7d031c962761ba4e2286c9eea Mon Sep 17 00:00:00 2001 From: Chris Holden Date: Wed, 4 Nov 2026 12:44:43 -0500 Subject: [PATCH 1/4] chore: add dependabot --- .github/dependabot.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..aa9c5b83 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,21 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + commit-message: + prefix: chore + groups: + # Any change under .github/ triggers the PR Docker build + actions: + patterns: + - "*" + + - package-ecosystem: docker + directory: / + schedule: + interval: monthly + commit-message: + prefix: chore From f4dcc8c171e8b8c8dfcfbe718ddfc49823f1e288 Mon Sep 17 00:00:00 2001 From: Chris Holden Date: Wed, 4 Nov 2026 12:47:36 -0500 Subject: [PATCH 2/4] chore: pin github actions --- .github/workflows/benchmark.yml | 12 +++++------ .github/workflows/build_push_pr_ecr.yml | 22 ++++++++++---------- .github/workflows/build_push_release_ecr.yml | 12 +++++------ .github/workflows/lint.yml | 4 ++-- .github/workflows/publish_conda_packages.yml | 6 +++--- .github/workflows/test.yml | 6 +++--- 6 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 570030df..3aad1aff 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -30,12 +30,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: ./.github/actions/free-disk-space - name: Configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_ARN }} role-session-name: gha-${{ github.run_id }} @@ -43,16 +43,16 @@ jobs: - name: Login to Amazon ECR id: login-ecr - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Compute pixi.lock hash run: echo "LOCK_HASH=$(sha256sum pixi.lock | awk '{print $1}')" >> $GITHUB_ENV - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build benchmark image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 with: context: . load: true @@ -87,7 +87,7 @@ jobs: # only charts runtime, so all three metrics are emitted to resources.json # (customSmallerIsBetter) and published in a single step. - name: Publish benchmarks to GitHub Pages - uses: benchmark-action/github-action-benchmark@v1 + uses: benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc # v1.22.2 with: name: HLS pipeline benchmarks tool: customSmallerIsBetter diff --git a/.github/workflows/build_push_pr_ecr.yml b/.github/workflows/build_push_pr_ecr.yml index 2a8ba2c3..6f7cafab 100644 --- a/.github/workflows/build_push_pr_ecr.yml +++ b/.github/workflows/build_push_pr_ecr.yml @@ -25,9 +25,9 @@ jobs: packages: ${{ steps.filter.outputs.packages }} other: ${{ steps.filter.outputs.other }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: dorny/paths-filter@v3 + - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 id: filter with: filters: | @@ -53,16 +53,16 @@ jobs: S3_REGION: ${{ vars.AWS_REGION }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_ARN }} role-session-name: gha-${{ github.run_id }} aws-region: ${{ env.AWS_REGION }} - - uses: prefix-dev/setup-pixi@v0.9.3 + - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3 with: environments: "" run-install: false @@ -112,12 +112,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: ./.github/actions/free-disk-space - name: Configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_ARN }} role-session-name: gha-${{ github.run_id }} @@ -125,11 +125,11 @@ jobs: - name: Login to Amazon ECR id: login-ecr - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: images: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }} tags: | @@ -137,13 +137,13 @@ jobs: type=sha,prefix=sha- - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Compute pixi.lock hash run: echo "LOCK_HASH=$(sha256sum pixi.lock | awk '{print $1}')" >> $GITHUB_ENV - name: Build - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 with: context: . load: true # Puts the image in 'docker images' for the next step diff --git a/.github/workflows/build_push_release_ecr.yml b/.github/workflows/build_push_release_ecr.yml index ab182fdd..0aa0a558 100644 --- a/.github/workflows/build_push_release_ecr.yml +++ b/.github/workflows/build_push_release_ecr.yml @@ -17,12 +17,12 @@ jobs: release-build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: ./.github/actions/free-disk-space - name: Configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_ARN }} role-session-name: gha-${{ github.run_id }} @@ -30,11 +30,11 @@ jobs: - name: Login to Amazon ECR id: login-ecr - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: images: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }} tags: | @@ -42,13 +42,13 @@ jobs: type=raw,value=latest - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Compute pixi.lock hash run: echo "LOCK_HASH=$(sha256sum pixi.lock | awk '{print $1}')" >> $GITHUB_ENV - name: Build and Push Release to ECR - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 with: context: . target: prod diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index ef963427..21840466 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -13,9 +13,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: prefix-dev/setup-pixi@v0.9.3 + - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3 with: frozen: true environments: dev diff --git a/.github/workflows/publish_conda_packages.yml b/.github/workflows/publish_conda_packages.yml index 6b9c6c68..d2426819 100644 --- a/.github/workflows/publish_conda_packages.yml +++ b/.github/workflows/publish_conda_packages.yml @@ -25,15 +25,15 @@ jobs: S3_ENDPOINT_URL: https://s3.${{ vars.AWS_REGION }}.amazonaws.com steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: prefix-dev/setup-pixi@v0.9.3 + - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3 with: environments: "" run-install: false - name: Configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_ARN }} role-session-name: gha-${{ github.run_id }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 722aa979..a898ce3e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: packages: ${{ steps.packages.outputs.packages }} steps: - - uses: dorny/paths-filter@v3 + - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 id: filter with: # Filter names other than "shared" must match a directory in src/. @@ -54,9 +54,9 @@ jobs: package: ${{ fromJSON(needs.changes.outputs.packages) }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: prefix-dev/setup-pixi@v0.9.3 + - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3 with: frozen: true environments: dev From 4025d7561d5a64d90827fa9b98e47ee90ed23a73 Mon Sep 17 00:00:00 2001 From: Chris Holden Date: Wed, 4 Nov 2026 12:47:53 -0500 Subject: [PATCH 3/4] chore: pin Docker SHAs --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 682065fb..703b0a98 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7-labs ARG PLATFORM=linux/amd64 -FROM --platform=${PLATFORM} ghcr.io/prefix-dev/pixi AS build +FROM --platform=${PLATFORM} ghcr.io/prefix-dev/pixi:0.83.0@sha256:3dce86c6e87371c58035aa41b09f2b56ca8f011722320551e0c2bfc1c59da5fb AS build ARG AWS_DEFAULT_REGION=us-west-2 @@ -72,7 +72,7 @@ CMD [ "/bin/bash" ] # ===== Production installation # "Productionize" pixi install: https://pixi.sh/latest/deployment/container/ -FROM --platform=${PLATFORM} debian:bookworm-slim AS prod +FROM --platform=${PLATFORM} debian:bookworm-slim@sha256:99c0b25c46d0214d5a2091092e7908907dcaecd6a962cde0ac700acee222b6f3 AS prod ARG GIT_SHA ENV GIT_SHA=${GIT_SHA} From 8f258bff108ccd9dac397a0b8e8bc392b88e688e Mon Sep 17 00:00:00 2001 From: Chris Holden Date: Wed, 4 Nov 2026 12:48:01 -0500 Subject: [PATCH 4/4] chore: add dependabot cooldown --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index aa9c5b83..c68277f2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,8 @@ updates: directory: / schedule: interval: monthly + cooldown: + default-days: 7 commit-message: prefix: chore groups: @@ -17,5 +19,7 @@ updates: directory: / schedule: interval: monthly + cooldown: + default-days: 7 commit-message: prefix: chore