PYTHON-6075 Pin exact drivers-github-tools versions ahead of v4 - #3048
Merged
Merged
Conversation
aclark4life
marked this pull request as ready for review
September 10, 2026 17:05
aclark4life
requested review from
sleepyStick
and
a lite review from Copilot
September 10, 2026 17:05
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The changes consistently pin the intended actions to a single immutable SHA and update zizmor policy accordingly, with no functional workflow logic changes introduced.
Pull request overview
Pins all mongodb-labs/drivers-github-tools/* GitHub Actions usages in this repo to an immutable commit SHA (annotated as v3.0.4) to improve CI supply-chain safety ahead of the v4 release process, and tightens zizmor policy to prevent regressions.
Changes:
- Updated all
drivers-github-toolsaction references to@1a2d86bd5fed4b0090453bcd510e4c2ba3b92356 # v3.0.4. - Tightened
.github/zizmor.ymlpolicy formongodb-labs/drivers-github-tools/*fromref-pintohash-pin.
File summaries
| File | Description |
|---|---|
.github/zizmor.yml |
Enforces hash pinning for mongodb-labs/drivers-github-tools/* to prevent floating refs. |
.github/workflows/uv-lock-update.yml |
Pins the uv-lock-update reusable action to the v3.0.4 commit SHA. |
.github/workflows/test-python.yml |
Pins the shared Python tooling setup action to the v3.0.4 commit SHA across all jobs. |
.github/workflows/release-python.yml |
Pins release pipeline actions (secure-checkout, setup, pre/post-publish) to the v3.0.4 commit SHA. |
.github/workflows/create-release-branch.yml |
Pins release-branch automation actions (setup, create-branch) to the v3.0.4 commit SHA. |
.github/workflows/codeql.yml |
Pins the CodeQL helper action to the v3.0.4 commit SHA. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
sleepyStick
approved these changes
Sep 10, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-6075
Changes in this PR
drivers-github-toolsnow cuts immutable, versioned releases (e.g.v3.0.4) instead of only moving a floating major-version tag.All 18
mongodb-labs/drivers-github-tools/*references now pin to1a2d86bd5fed4b0090453bcd510e4c2ba3b92356 # v3.0.4:@v3d518d2c.github/zizmor.ymltightens themongodb-labs/drivers-github-tools/*policy fromref-pintohash-pinso this can't regress.Test Plan
No unit tests. This is a CI configuration change with no runtime code affected.
Checklist
Checklist for Author
mongo-arrow,django-mongodb-backend, anddjango-mongodb-extensionseach still have floating@v3refs; tracked under DRIVERS-3633.Checklist for Reviewer