Use SHA for 3rd-party actions in publish process (#44)

stefmolin · Oct 5, 2024 · c50a756 · c50a756
1 parent 314edb0
commit c50a756
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
@@ -49,7 +49,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@hf7600683efdcb7656dec5b29656edb7bc586e597  # v1.10.3
 
   github-release:
     name: >-
@@ -70,7 +70,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Sign the dists with Sigstore
-      uses: sigstore/gh-action-sigstore-python@v2.1.1
+      uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46  # v3.0.0
       with:
         inputs: >-
           ./dist/*.tar.gz
@@ -115,6 +115,6 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@hf7600683efdcb7656dec5b29656edb7bc586e597  # v1.10.3
       with:
         repository-url: https://test.pypi.org/legacy/