Skip to content

Commit d6d6330

Browse files
shahbazk8194pixar-oss
shahbazk8194
authored and
pixar-oss
committed
Pin to specific commit hashes for third-party actions
Set workflow permissions to read and override permissions on a per job basis (Internal change: 2398773)
1 parent 2d86bac commit d6d6330

2 files changed

Lines changed: 65 additions & 38 deletions

File tree

‎.github/workflows/buildusd.yml‎

Lines changed: 36 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: BuildUSD
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
branches:
@@ -20,7 +23,7 @@ jobs:
2023
validation-failed: ${{ steps.changed-workflows.outputs.any_changed }}
2124
steps:
2225
- name: Checkout code
23-
uses: actions/checkout@v4
26+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
2427
with:
2528
ref: ${{ github.ref }}
2629
- name: Check workflows directory
@@ -35,23 +38,25 @@ jobs:
3538
- Validation
3639
if: ${{ (github.event_name == 'pull_request' && needs.Validation.outputs.validation-failed != 'true') || github.event_name == 'push' }}
3740
runs-on: ubuntu-22.04
41+
permissions:
42+
contents: write # Grant write permissions in order to upload artifacts
3843
env:
3944
PYTHON_VERSION: "3.9.25"
4045
timeout-minutes: 120
4146
steps:
4247
- name: Checkout Code
43-
uses: actions/checkout@v4
48+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
4449
with:
4550
ref: ${{ github.ref }}
4651
- name: Restore cached artifacts
4752
id: cache-usd-build-dependency
48-
uses: actions/cache/restore@v4
53+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
4954
with:
5055
path: |
5156
USDinst
5257
key: ${{ runner.os }}-BuildUSD-py${{ env.PYTHON_VERSION }}-${{ hashFiles('build_scripts/**/*') }}
5358
- name: Install Python
54-
uses: actions/setup-python@v5
59+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
5560
with:
5661
python-version: ${{ env.PYTHON_VERSION }}
5762
check-latest: false
@@ -76,12 +81,12 @@ jobs:
7681
fi
7782
- name: Save Build Artifacts to Cache
7883
if: steps.cache-usd-build-dependency.outputs.cache-hit != 'true'
79-
uses: actions/cache/save@v4
84+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
8085
with:
8186
path: USDinst
8287
key: ${{ steps.cache-usd-build-dependency.outputs.cache-primary-key }}
8388
- name: Upload Artifact
84-
uses: actions/upload-artifact@v4
89+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
8590
with:
8691
name: usd-linux
8792
path: ${{ github.workspace }}
@@ -97,14 +102,16 @@ jobs:
97102
- Linux
98103
if: ${{ github.event_name == 'push' }}
99104
runs-on: enterprise-linux-x64-t4gpu-4core-16vram-28ram-176ssd
105+
permissions:
106+
contents: write # Grant write permissions in order to upload artifacts
100107
env:
101108
# Ensure python is installed in the same location across different runners
102109
AGENT_TOOLSDIRECTORY: /opt/hostedtoolcache
103110
PYTHON_VERSION: "3.9.25"
104111
timeout-minutes: 30
105112
steps:
106113
- name: Install Python
107-
uses: actions/setup-python@v5
114+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
108115
with:
109116
python-version: ${{ env.PYTHON_VERSION }}
110117
check-latest: false
@@ -126,7 +133,7 @@ jobs:
126133
pip install --upgrade pip
127134
pip install PySide2 PyOpenGL cmake
128135
- name: Download USD Build
129-
uses: actions/download-artifact@v4
136+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 #v4.3.0
130137
with:
131138
name: usd-linux
132139
- name: Restore Executable Permissions
@@ -156,7 +163,7 @@ jobs:
156163
fi
157164
- name: Upload Test artifacts
158165
if: always()
159-
uses: actions/upload-artifact@v4
166+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
160167
with:
161168
name: FailedTestOutput
162169
path: ./USDgen/build/OpenUSD/FailedTestOutput
@@ -167,23 +174,25 @@ jobs:
167174
- Validation
168175
if: ${{ (github.event_name == 'pull_request' && needs.Validation.outputs.validation-failed != 'true') || github.event_name == 'push' }}
169176
runs-on: macos-15
177+
permissions:
178+
contents: write # Grant write permissions in order to upload artifacts
170179
env:
171180
PYTHON_VERSION: "3.11"
172181
timeout-minutes: 120
173182
steps:
174183
- name: Checkout code
175-
uses: actions/checkout@v4
184+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
176185
with:
177186
ref: ${{ github.ref }}
178187
- name: Restore cached artifacts
179188
id: cache-usd-build-dependency
180-
uses: actions/cache/restore@v4
189+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
181190
with:
182191
path: |
183192
USDinst
184193
key: ${{ runner.os }}-BuildUSD-py${{ env.PYTHON_VERSION }}-${{ hashFiles('build_scripts/**/*') }}
185194
- name: Install Python
186-
uses: actions/setup-python@v5
195+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
187196
with:
188197
python-version: ${{ env.PYTHON_VERSION }}
189198
check-latest: false
@@ -203,13 +212,13 @@ jobs:
203212
python3 build_scripts/build_usd.py --no-materialx --generator Xcode --build USDgen/build --src USDgen/src USDinst --build-args USD,"-DPXR_HEADLESS_TEST_MODE=ON -DPXR_BUILD_TESTS=ON" -v
204213
- name: Save build artifacts to cache
205214
if: steps.cache-usd-build-dependency.outputs.cache-hit != 'true'
206-
uses: actions/cache/save@v4
215+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
207216
with:
208217
path: |
209218
USDinst
210219
key: ${{ steps.cache-usd-build-dependency.outputs.cache-primary-key }}
211220
- name: Upload artifacts
212-
uses: actions/upload-artifact@v4
221+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
213222
with:
214223
name: usd-macOS
215224
path: USDinst
@@ -224,23 +233,25 @@ jobs:
224233
- Validation
225234
if: ${{ (github.event_name == 'pull_request' && needs.Validation.outputs.validation-failed != 'true') || github.event_name == 'push' }}
226235
runs-on: windows-2022
236+
permissions:
237+
contents: write # Grant write permissions in order to upload artifacts
227238
env:
228239
PYTHON_VERSION: "3.9"
229240
timeout-minutes: 120
230241
steps:
231242
- name: Checkout code
232-
uses: actions/checkout@v4
243+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
233244
with:
234245
ref: ${{ github.ref }}
235246
- name: Restore cached artifacts
236247
id: cache-usd-build-dependency
237-
uses: actions/cache/restore@v4
248+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
238249
with:
239250
path: |
240251
USDinst
241252
key: ${{ runner.os }}-BuildUSD-py${{ env.PYTHON_VERSION }}-${{ hashFiles('build_scripts/**/*') }}
242253
- name: Install Python
243-
uses: actions/setup-python@v5
254+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
244255
with:
245256
python-version: ${{ env.PYTHON_VERSION }}
246257
check-latest: false
@@ -255,13 +266,13 @@ jobs:
255266
shell: cmd
256267
- name: Save build artifacts to cache
257268
if: steps.cache-usd-build-dependency.outputs.cache-hit != 'true'
258-
uses: actions/cache/save@v4
269+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
259270
with:
260271
path: |
261272
USDinst
262273
key: ${{ steps.cache-usd-build-dependency.outputs.cache-primary-key }}
263274
- name: Upload artifacts
264-
uses: actions/upload-artifact@v4
275+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
265276
with:
266277
name: usd-win64
267278
path: USDinst
@@ -283,9 +294,11 @@ jobs:
283294
target: [Wasm, Wasm64]
284295
fail-fast: false
285296
runs-on: ubuntu-22.04
297+
permissions:
298+
contents: write # Grant write permissions in order to upload artifacts
286299
steps:
287300
- name: Checkout code
288-
uses: actions/checkout@v4
301+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
289302
with:
290303
ref: ${{ github.ref }}
291304
- name: Install Emscripten SDK
@@ -296,7 +309,7 @@ jobs:
296309
./emsdk activate latest
297310
- name: Restore cached artifacts
298311
id: cache-usd-build-dependency
299-
uses: actions/cache/restore@v4
312+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
300313
with:
301314
path: |
302315
USDgen/build
@@ -309,13 +322,13 @@ jobs:
309322
--build-args USD,"-DPXR_HEADLESS_TEST_MODE=ON -DPXR_BUILD_TESTS=ON"
310323
- name: Save build artifacts to cache
311324
if: steps.cache-usd-build-dependency.outputs.cache-hit != 'true'
312-
uses: actions/cache/save@v4
325+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0
313326
with:
314327
path: |
315328
USDgen/build
316329
key: ${{ steps.cache-usd-build-dependency.outputs.cache-primary-key }}
317330
- name: Upload artifacts
318-
uses: actions/upload-artifact@v4
331+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
319332
with:
320333
name: usd-${{ matrix.target }}
321334
path: USDinst

‎.github/workflows/pypi.yml‎

Lines changed: 29 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ name: PyPiPackaging
66
# Ideally we'd run this pipeline for all pull requests, but doing so consumes
77
# our limited number of slots and almost always just duplicates the
88
# build done in the main pipeline.
9+
10+
permissions:
11+
contents: read
12+
913
on:
1014
push:
1115
branches:
@@ -44,12 +48,14 @@ jobs:
4448
INTERPRETER: /opt/python/cp313-cp313/bin/python
4549
VERSION_SPEC: '3.13.5'
4650
runs-on: ubuntu-22.04
51+
permissions:
52+
contents: write # Grant write permissions in order to upload artifacts
4753
timeout-minutes: 60
4854
steps:
4955
- name: Checkout code
50-
uses: actions/checkout@v4
56+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
5157
- name: Install Python
52-
uses: actions/setup-python@v5
58+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
5359
with:
5460
python-version: ${{ matrix.PYTHON.VERSION_SPEC }}
5561
check-latest: false
@@ -99,7 +105,7 @@ jobs:
99105
run: |
100106
docker stop usdmanylinux
101107
- name: Upload artifacts
102-
uses: actions/upload-artifact@v4
108+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
103109
with:
104110
name: dist-linux-${{ matrix.PYTHON.TAG }}
105111
path: /home/vsts/dist
@@ -142,14 +148,16 @@ jobs:
142148
XCODE: '16.0'
143149
DELOCATE: '0.13.0'
144150
runs-on: macos-15
151+
permissions:
152+
contents: write # Grant write permissions in order to upload artifacts
145153
timeout-minutes: 120
146154
env:
147155
MACOSX_DEPLOYMENT_TARGET: 10.15
148156
steps:
149157
- name: Checkout code
150-
uses: actions/checkout@v4
158+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
151159
- name: Install Python
152-
uses: actions/setup-python@v5
160+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
153161
with:
154162
python-version: ${{ matrix.PYTHON.VERSION_SPEC }}
155163
check-latest: false
@@ -195,7 +203,7 @@ jobs:
195203
ls -la ./dist
196204
${{ matrix.PYTHON.INTERPRETER }} build_scripts/pypi/updatePluginfos.py "./dist-delocated/$WHEEL_PACKAGE_NAME" "./dist/$WHEEL_PACKAGE_NAME"
197205
- name: Upload artifacts
198-
uses: actions/upload-artifact@v4
206+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
199207
with:
200208
name: dist-mac-${{ matrix.PYTHON.TAG }}
201209
path: ./dist
@@ -216,12 +224,14 @@ jobs:
216224
- VERSION_SPEC: '3.13.5'
217225
TAG: cp313
218226
runs-on: windows-2022
227+
permissions:
228+
contents: write # Grant write permissions in order to upload artifacts
219229
timeout-minutes: 60
220230
steps:
221231
- name: Checkout code
222-
uses: actions/checkout@v4
232+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
223233
- name: Install Python
224-
uses: actions/setup-python@v5
234+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
225235
with:
226236
python-version: ${{ matrix.PYTHON.VERSION_SPEC }}
227237
check-latest: false
@@ -255,7 +265,7 @@ jobs:
255265
dir
256266
shell: cmd
257267
- name: Upload artifacts
258-
uses: actions/upload-artifact@v4
268+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
259269
with:
260270
name: dist-windows-${{ matrix.PYTHON.TAG }}
261271
path: D:\packaging\dist
@@ -265,16 +275,18 @@ jobs:
265275
needs: [Linux, macOS, Windows]
266276
timeout-minutes: 5
267277
runs-on: ubuntu-24.04
278+
permissions:
279+
contents: write # Grant write permissions in order to upload artifacts
268280
steps:
269-
- uses: actions/download-artifact@v4
281+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 #v4.3.0
270282
with:
271283
path: dist-final
272284
pattern: dist-*-*
273285
merge-multiple: true
274286
- name: Display structure of downloaded files
275287
run: ls -R dist-final
276288
- name: Upload artifacts
277-
uses: actions/upload-artifact@v4
289+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
278290
with:
279291
name: dist
280292
path: dist-final
@@ -358,15 +370,17 @@ jobs:
358370
IMAGE: windows-2022
359371
PYTHON_INTERPRETER: python3
360372
runs-on: ${{ matrix.BUILD_CONFIG.IMAGE }}
373+
permissions:
374+
contents: write # Grant write permissions in order to upload artifacts
361375
steps:
362376
- name: Install Python
363-
uses: actions/setup-python@v5
377+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
364378
with:
365379
python-version: ${{ matrix.BUILD_CONFIG.PYTHON_VERSION_SPEC }}
366380
check-latest: false
367381
- name: Checkout code
368-
uses: actions/checkout@v4
369-
- uses: actions/download-artifact@v4
382+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
383+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 #v4.3.0
370384
with:
371385
name: dist
372386
merge-multiple: true
@@ -378,7 +392,7 @@ jobs:
378392
${{ matrix.BUILD_CONFIG.PYTHON_INTERPRETER }} -m pip install --no-index --find-links=file://${{ github.workspace }} usd-core
379393
py.test --junitxml TEST-usdinstall-${{ matrix.BUILD_CONFIG.NAME }}.xml build_scripts/pypi/test.py
380394
- name: Upload pytest test results
381-
uses: actions/upload-artifact@v4
395+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
382396
with:
383397
name: TEST-usdinstall-${{ matrix.BUILD_CONFIG.NAME }}
384398
path: TEST-usdinstall-${{ matrix.BUILD_CONFIG.NAME }}.xml

0 commit comments

Comments
 (0)
⚡