mirror of
https://github.com/hwchase17/langchain.git
synced 2026-03-18 02:53:16 +00:00
bb8b057ac3
## Summary - Adds top-level `permissions: contents: read` to 5 workflows that only had job-level permissions: `pr_labeler_file`, `pr_labeler_title`, `tag-external-contributions`, `v03_api_doc_build`, `auto-label-by-package` - SHA-pins all 14 third-party actions to full commit SHAs to prevent supply chain attacks via tag hijacking ## Why **Missing top-level permissions:** Without an explicit top-level `permissions` block, workflows inherit the repository/org default token permissions, which may be overly broad. Adding `contents: read` as the default restricts the blast radius if a dependency or action step is compromised. **SHA pinning:** Mutable tags (`@v1`, `@master`) can be force-pushed by the action maintainer or an attacker who compromises their account. Pinning to a full 40-character SHA ensures the exact reviewed code always runs. Tag comments are preserved for readability. ### Actions pinned | Action | File(s) | |--------|---------| | `pypa/gh-action-pypi-publish` | `_release.yml` (2 uses) | | `ncipollo/release-action` | `_release.yml` | | `Ana06/get-changed-files` | `check_diffs.yml` | | `astral-sh/setup-uv` | `check_diffs.yml`, `uv_setup/action.yml` | | `CodSpeedHQ/action` | `check_diffs.yml` | | `google-github-actions/auth` | `integration_tests.yml` | | `aws-actions/configure-aws-credentials` | `integration_tests.yml` | | `amannn/action-semantic-pull-request` | `pr_lint.yml` | | `bcoe/conventional-release-labels` | `pr_labeler_title.yml` | | `mikefarah/yq` | `v03_api_doc_build.yml` | | `EndBug/add-and-commit` | `v03_api_doc_build.yml` | | `peter-evans/create-pull-request` | `refresh_model_profiles.yml` | ## Test plan - [x] CI passes — all workflows still resolve their actions correctly - [x] Verify no functional change: SHA refs point to the same code as the previous tags --- > This PR was generated with assistance from an AI coding agent as part of a repository posture check. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
117 lines
3.6 KiB
YAML
117 lines
3.6 KiB
YAML
# PR title linting.
|
||
#
|
||
# FORMAT (Conventional Commits 1.0.0):
|
||
#
|
||
# <type>[optional scope]: <description>
|
||
# [optional body]
|
||
# [optional footer(s)]
|
||
#
|
||
# Examples:
|
||
# feat(core): add multi‐tenant support
|
||
# fix(langchain): resolve error
|
||
# docs: update API usage examples
|
||
# docs(openai): update API usage examples
|
||
#
|
||
# Allowed Types:
|
||
# * feat — a new feature (MINOR)
|
||
# * fix — a bug fix (PATCH)
|
||
# * docs — documentation only changes
|
||
# * style — formatting, linting, etc.; no code change or typing refactors
|
||
# * refactor — code change that neither fixes a bug nor adds a feature
|
||
# * perf — code change that improves performance
|
||
# * test — adding tests or correcting existing
|
||
# * build — changes that affect the build system/external dependencies
|
||
# * ci — continuous integration/configuration changes
|
||
# * chore — other changes that don't modify source or test files
|
||
# * revert — reverts a previous commit
|
||
# * release — prepare a new release
|
||
#
|
||
# Allowed Scope(s) (optional):
|
||
# core, langchain, langchain-classic, model-profiles,
|
||
# standard-tests, text-splitters, docs, anthropic, chroma, deepseek, exa,
|
||
# fireworks, groq, huggingface, mistralai, nomic, ollama, openai,
|
||
# perplexity, qdrant, xai, infra, deps
|
||
#
|
||
# Multiple scopes can be used by separating them with a comma. For example:
|
||
#
|
||
# feat(core,langchain): add multi‐tenant support to core and langchain
|
||
#
|
||
# Note: PRs touching the langchain package should use the 'langchain' scope. It is not
|
||
# acceptable to omit the scope for changes to the langchain package, despite it being
|
||
# the main package & name of the repo.
|
||
#
|
||
# Rules:
|
||
# 1. The 'Type' must start with a lowercase letter.
|
||
# 2. Breaking changes: append "!" after type/scope (e.g., feat!: drop x support)
|
||
# 3. When releasing (updating the pyproject.toml and uv.lock), the commit message
|
||
# should be: `release(scope): x.y.z` (e.g., `release(core): 1.2.0` with no
|
||
# body, footer, or preceeding/proceeding text).
|
||
#
|
||
# Enforces Conventional Commits format for pull request titles to maintain a clear and
|
||
# machine-readable change history.
|
||
|
||
name: "🏷️ PR Title Lint"
|
||
|
||
permissions:
|
||
pull-requests: read
|
||
|
||
on:
|
||
pull_request:
|
||
types: [opened, edited, synchronize]
|
||
|
||
jobs:
|
||
# Validates that PR title follows Conventional Commits 1.0.0 specification
|
||
lint-pr-title:
|
||
name: "validate format"
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: "✅ Validate Conventional Commits Format"
|
||
uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
with:
|
||
types: |
|
||
feat
|
||
fix
|
||
docs
|
||
style
|
||
refactor
|
||
perf
|
||
test
|
||
build
|
||
ci
|
||
chore
|
||
revert
|
||
release
|
||
scopes: |
|
||
core
|
||
langchain
|
||
langchain-classic
|
||
model-profiles
|
||
standard-tests
|
||
text-splitters
|
||
docs
|
||
anthropic
|
||
chroma
|
||
deepseek
|
||
exa
|
||
fireworks
|
||
groq
|
||
huggingface
|
||
mistralai
|
||
nomic
|
||
ollama
|
||
openai
|
||
openrouter
|
||
perplexity
|
||
qdrant
|
||
xai
|
||
infra
|
||
deps
|
||
requireScope: false
|
||
disallowScopes: |
|
||
release
|
||
[A-Z]+
|
||
ignoreLabels: |
|
||
ignore-lint-pr-title
|