Roger Barreto and GitHub
01a3c5be8a
ci: pin third-party GitHub Actions to commit SHAs ( #5972 )
...
Replaces every floating tag in our workflow and composite action files
with an immutable 40-character commit SHA, keeping the original `# vX`
comment so Dependabot can still propose version bumps. 186 occurrences
across 25 workflows and 2 composite actions.
Also widens the github-actions Dependabot entry to use the plural
`directories` key with `/.github/actions/*` so composite actions under
`.github/actions/<name>/action.yml` are kept up to date. Previously
Dependabot only scanned `.github/workflows` and the repo-root
`action.yml`, leaving our `python-setup` and `sample-validation-setup`
composite actions unmaintained.
2026-05-20 22:10:32 +00:00
50fdcbaf57
Python: chore(python): improve dependency range automation ( #4343 )
...
* chore(python): improve dependency range automation
- tighten dependency bounds and coding standards guidance\n- add dependency range validation workflow, reporting, and issue automation\n- update related tests and dependency pins for compatibility
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* updated text and pyarrow
* new lock
* fixed workflow
* updated deps
* fix tiktoken
* chore(python): refine dependency validation workflows
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* docs(python): add high-level dependency validation comments
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* WIP
* added additional comments and excludes
* added dev dependency handling and workflow and updates to package ranges
* added readme and simplified commands
* fix markers
* chore(python): address dependency review feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Tighten dependency bounds, remove stale overrides, restore Python 3.10 support
- Apply dependency bound policy across all packages: stable >=1.0 deps use
>=floor,<next_major; pre-1.0/prerelease deps use validated hard-bounded ranges
- Remove stale root tool.uv.override-dependencies (uvicorn, websockets, grpcio)
- Lower github_copilot requires-python to >=3.10 with github-copilot-sdk gated
behind python_version >= 3.11 marker; import raises ImportError on 3.10
- Skip github_copilot pyright/mypy/test tasks on Python <3.11
- Use version-conditional pyrightconfig for samples on Python 3.10
- Add compatibility fix in core responses client for older openai typed dicts
- Normalize uv.lock prerelease mode and refresh dev dependencies
- Update CODING_STANDARD.md, DEV_SETUP.md, and package management skill docs
Closes #902
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* small tweaks
* add note in workflow
* fix workflows and several versions
* fix duplicate
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-03-13 12:32:37 +00:00
Roger BarretoandGitHub
