Fix pypa/gh-action-pypi-publish version to use SHA pinning #69
Conversation
The previous change incorrectly used @v1 which doesn't exist. Pin to release/v1.13 SHA for security best practices. Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>
|
@codex pls review |
There was a problem hiding this comment.
Pull request overview
This PR corrects the GitHub Action reference for pypa/gh-action-pypi-publish by replacing an invalid tag reference (v1) with SHA pinning to a specific commit (ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e), which corresponds to release/v1.13. This change aligns with GitHub's security best practices for using third-party actions.
Key Changes:
- Updated action reference from invalid tag
v1to SHA-pinned version with comment indicating it corresponds torelease/v1.13
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Codex Review: Didn't find any major issues. 🚀 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
3 participants
Summary
Fix incorrect version reference for
pypa/gh-action-pypi-publish.Problem
A previous PR incorrectly changed the action reference from
release/v1(valid branch) tov1(non-existent tag). Thev1tag doesn't exist in the pypa/gh-action-pypi-publish repository.Solution
Updated to use SHA pinning for release/v1.13:
This follows GitHub's security best practices for third-party actions by pinning to an immutable SHA.
Files Changed
.github/workflows/publish.yml