oe-python-template 0.6.18__tar.gz → 0.6.19__tar.gz

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/.copier-answers.yml

@@ -1,4 +1,4 @@
-_commit: v0.6.17-7-g3aa4b83
+_commit: v0.6.18-1-g201c4be
 _src_path: .
 author_email: helmuthva@gmail.com
 author_github_username: helmut-hoffer-von-ankershoffen

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/.github/workflows/docker-image-build-publish.yml

@@ -21,18 +21,18 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
 
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
 
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -41,7 +41,7 @@ jobs:
 
 
       - name: Log in to GitHub container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
 
@@ -51,7 +51,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
 
 
@@ -73,7 +73,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: .
           file: ./Dockerfile
@@ -86,10 +86,8 @@ jobs:
 
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
-
-

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/.github/workflows/package-build-publish-release.yml

@@ -15,12 +15,12 @@ jobs:
       packages: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Generate release notes
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@4a4a951bc43fafe41cd2348d181853f52356bee7 # v4.4.2
         id: git-cliff
         with:
           config: pyproject.toml

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/.github/workflows/test-and-report.yml

@@ -17,7 +17,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -30,7 +30,7 @@ jobs:
           sudo apt-get install -y curl jq xsltproc gnupg2 libcairo2
 
       - name: Install uv (python package manager)
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
         with:
           version: "0.5.9"
           enable-cache: true
@@ -58,7 +58,7 @@ jobs:
           echo "Development build - Current version in pyproject.toml: $TOML_VERSION"
 
       - name: Create .env file
-        uses: SpicyPizza/create-envfile@v2.0
+        uses: SpicyPizza/create-envfile@ace6d4f5d7802b600276c23ca417e669f1a06f6f # v2.0.3
         with:
           envkey_ENV_KEY: "ENV_VALUE"
           fail_on_empty: true
@@ -80,7 +80,7 @@ jobs:
           uv run nox
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         if: ${{ always() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
         with:
           name: test-results
@@ -94,7 +94,7 @@ jobs:
           retention-days: 30
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -102,12 +102,12 @@ jobs:
 
       - name: Upload test results to Codecov
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
-        uses: codecov/test-results-action@v1
+        uses: codecov/test-results-action@f2dba722c67b86c6caa034178c6e4d35335f6706 # v1.1.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: SonarQube Scan
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
-        uses: SonarSource/sonarqube-scan-action@v5
+        uses: SonarSource/sonarqube-scan-action@0303d6b62e310685c0e34d0b9cde218036885c4d # v5.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/CHANGELOG.md

@@ -1,6 +1,13 @@
 [🧠 OE Python Template](https://oe-python-template.readthedocs.io/en/latest/)
 
-## [0.6.18](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.17..0.6.18) - 2025-03-18
+## [0.6.19](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.18..0.6.19) - 2025-03-18
+
+### 🚜 Refactor
+
+- *(codeql)* Fix - ([0af319f](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/0af319fcf7a24c06cb3cacdfa3140e6121830e09))
+
+
+## [0.6.18](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.17..v0.6.18) - 2025-03-18
 
 ### 📚 Documentation
 
@@ -12,9 +19,6 @@
 - Debug rtd - ([bc760ac](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/bc760aca603950b8dd1cf5c77241b2f8ccc091d2))
 - Debug rtd pdf link - ([192df7f](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/192df7f2552180eb721fd21b32f9e074c0f35073))
 
-## New Contributors ❤️
-
-* @helmut-hoffer-von-ankershoffen made their first contribution
 
 ## [0.6.17](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.16..v0.6.17) - 2025-03-18
 

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/CONTRIBUTING.md

@@ -20,6 +20,7 @@ fi
 which jq &> /dev/null || brew install jq
 which xmllint &> /dev/null || brew install xmllint
 which act &> /dev/null || brew install act
+which pinact &> /dev/null || brew install pinact
 uv run pre-commit install             # install pre-commit hooks, see https://pre-commit.com/
 ```
 
@@ -130,6 +131,12 @@ docker build -t oe-python-template .
 docker run --env THE_VAR=THE_VALUE oe-python-template --help
 ```
 
+### Pinning github actions
+
+```shell
+pinact run  # See https://dev.to/suzukishunsuke/pin-github-actions-to-a-full-length-commit-sha-for-security-2n7p
+```
+
 ### Copier
 
 Update from template

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oe-python-template
-Version: 0.6.18
+Version: 0.6.19
 Summary: 🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling.
 Project-URL: Homepage, https://oe-python-template.readthedocs.io/en/latest/
 Project-URL: Documentation, https://oe-python-template.readthedocs.io/en/latest/

oe_python_template-0.6.19/RELEASE_NOTES.md

@@ -0,0 +1,8 @@
+## [0.6.19](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/compare/v0.6.18..v0.6.19) - 2025-03-18
+
+### 🚜 Refactor
+
+- *(codeql)* Fix - ([0af319f](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template/commit/0af319fcf7a24c06cb3cacdfa3140e6121830e09))
+
+
+

oe_python_template-0.6.19/VERSION

@@ -0,0 +1 @@
+0.6.19

oe_python_template-0.6.19/docs/source/_static/openapi_v2.json

@@ -0,0 +1,262 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "OE Python Template",
+    "termsOfService": "https://oe-python-template.readthedocs.io/en/latest/",
+    "contact": {
+      "name": "Helmut Hoffer von Ankershoffen",
+      "url": "https://github.com/helmut-hoffer-von-ankershoffen",
+      "email": "helmuthva@gmail.com"
+    },
+    "version": "2.0.0"
+  },
+  "paths": {
+    "/health": {
+      "get": {
+        "tags": [
+          "Observability"
+        ],
+        "summary": "Health",
+        "description": "Check the health of the service.\n\nThis endpoint returns the health status of the service.\nThe health status can be either UP or DOWN.\nIf the service is healthy, the status will be UP.\nIf the service is unhealthy, the status will be DOWN and a reason will be provided.\nThe response will have a 200 OK status code if the service is healthy,\nand a 500 Internal Server Error status code if the service is unhealthy.\n\nReturns:\n    Health: The health status of the service.",
+        "operationId": "health_health_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Health"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/healthz": {
+      "get": {
+        "tags": [
+          "Observability"
+        ],
+        "summary": "Health",
+        "description": "Check the health of the service.\n\nThis endpoint returns the health status of the service.\nThe health status can be either UP or DOWN.\nIf the service is healthy, the status will be UP.\nIf the service is unhealthy, the status will be DOWN and a reason will be provided.\nThe response will have a 200 OK status code if the service is healthy,\nand a 500 Internal Server Error status code if the service is unhealthy.\n\nReturns:\n    Health: The health status of the service.",
+        "operationId": "health_healthz_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Health"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/hello-world": {
+      "get": {
+        "tags": [
+          "Basics"
+        ],
+        "summary": "Hello World",
+        "description": "Return a hello world message.\n\nReturns:\n    HelloWorldResponse: A response containing the hello world message.",
+        "operationId": "hello_world_hello_world_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HelloWorldResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/echo": {
+      "post": {
+        "tags": [
+          "Basics"
+        ],
+        "summary": "Echo V2",
+        "description": "Echo back the provided utterance.\n\nArgs:\n    request (Utterance): The request containing the utterance to echo back.\n\nReturns:\n    EchoResponse: A response containing the echoed utterance.\n\nRaises:\n    422 Unprocessable Entity: If utterance is not provided or empty.",
+        "operationId": "echo_v2_echo_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Utterance"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EchoResponse"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Validation Error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "EchoResponse": {
+        "properties": {
+          "message": {
+            "type": "string",
+            "minLength": 1,
+            "title": "Message",
+            "description": "The message content",
+            "examples": [
+              "Hello, world!"
+            ]
+          }
+        },
+        "type": "object",
+        "required": [
+          "message"
+        ],
+        "title": "EchoResponse",
+        "description": "Response model for echo endpoint."
+      },
+      "HTTPValidationError": {
+        "properties": {
+          "detail": {
+            "items": {
+              "$ref": "#/components/schemas/ValidationError"
+            },
+            "type": "array",
+            "title": "Detail"
+          }
+        },
+        "type": "object",
+        "title": "HTTPValidationError"
+      },
+      "Health": {
+        "properties": {
+          "status": {
+            "$ref": "#/components/schemas/_HealthStatus"
+          },
+          "reason": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Reason"
+          }
+        },
+        "type": "object",
+        "required": [
+          "status"
+        ],
+        "title": "Health",
+        "description": "Health status model."
+      },
+      "HelloWorldResponse": {
+        "properties": {
+          "message": {
+            "type": "string",
+            "title": "Message",
+            "description": "The hello world message",
+            "examples": [
+              "Hello, world!"
+            ]
+          }
+        },
+        "type": "object",
+        "required": [
+          "message"
+        ],
+        "title": "HelloWorldResponse",
+        "description": "Response model for hello-world endpoint."
+      },
+      "Utterance": {
+        "properties": {
+          "utterance": {
+            "type": "string",
+            "minLength": 1,
+            "title": "Utterance",
+            "description": "The utterance to echo back",
+            "examples": [
+              "Hello, world!"
+            ]
+          }
+        },
+        "type": "object",
+        "required": [
+          "utterance"
+        ],
+        "title": "Utterance",
+        "description": "Request model for echo endpoint."
+      },
+      "ValidationError": {
+        "properties": {
+          "loc": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "integer"
+                }
+              ]
+            },
+            "type": "array",
+            "title": "Location"
+          },
+          "msg": {
+            "type": "string",
+            "title": "Message"
+          },
+          "type": {
+            "type": "string",
+            "title": "Error Type"
+          }
+        },
+        "type": "object",
+        "required": [
+          "loc",
+          "msg",
+          "type"
+        ],
+        "title": "ValidationError"
+      },
+      "_HealthStatus": {
+        "type": "string",
+        "enum": [
+          "UP",
+          "DOWN"
+        ],
+        "title": "_HealthStatus",
+        "description": "Health status enumeration."
+      }
+    }
+  }
+}

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/docs/source/conf.py

@@ -29,7 +29,7 @@ extensions = [
 project = "oe-python-template"
 author = "Helmut Hoffer von Ankershoffen"
 copyright = f" (c) 2025-{datetime.now(UTC).year}, {author}"  # noqa: A001
-version = "0.6.18"
+version = "0.6.19"
 release = version
 github_username = "helmut-hoffer-von-ankershoffen"
 github_repository = "oe-python-template"

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/examples/notebook.py

@@ -10,7 +10,7 @@ def _():
 
     service = Service()
     message = service.get_hello_world()
-    message # type: ignore
+    print(message)
     return Service, message, service
 
 

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "oe-python-template"
-version = "0.6.18"
+version = "0.6.19"
 description = "🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling."
 readme = "README.md"
 authors = [
@@ -242,7 +242,7 @@ source = ["src/"]
 
 
 [tool.bumpversion]
-current_version = "0.6.18"
+current_version = "0.6.19"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 search = "{current_version}"

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/sonar-project.properties

@@ -1,6 +1,6 @@
 sonar.projectKey=helmut-hoffer-von-ankershoffen_oe-python-template
 sonar.organization=helmut-hoffer-von-ankershoffen
-sonar.projectVersion=0.6.18
+sonar.projectVersion=0.6.19
 sonar.projectDescription=🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling.
 sonar.links.homepage=https://oe-python-template.readthedocs.io/en/latest/
 sonar.links.scm=https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/template/.github/workflows/docker-image-build-publish.yml.jinja

@@ -21,18 +21,18 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
 
 {% if docker_io_enabled %}
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
 {% raw %}
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -41,7 +41,7 @@ jobs:
 {% endif %}
 
       - name: Log in to GitHub container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
 {% raw %}
@@ -51,7 +51,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
 {% if docker_io_enabled %}
 {% raw %}
@@ -78,7 +78,7 @@ jobs:
 {% raw %}
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: .
           file: ./Dockerfile
@@ -91,7 +91,7 @@ jobs:
 {% if docker_io_enabled %}
 {% raw %}
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/template/.github/workflows/package-build-publish-release.yml.jinja

@@ -15,12 +15,12 @@ jobs:
       packages: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Generate release notes
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@4a4a951bc43fafe41cd2348d181853f52356bee7 # v4.4.2
         id: git-cliff
         with:
           config: pyproject.toml

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/template/.github/workflows/test-and-report.yml.jinja

@@ -17,7 +17,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -30,7 +30,7 @@ jobs:
           sudo apt-get install -y curl jq xsltproc gnupg2 libcairo2
 
       - name: Install uv (python package manager)
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
         with:
           version: "0.5.9"
           enable-cache: true
@@ -58,7 +58,7 @@ jobs:
           echo "Development build - Current version in pyproject.toml: $TOML_VERSION"
 
       - name: Create .env file
-        uses: SpicyPizza/create-envfile@v2.0
+        uses: SpicyPizza/create-envfile@ace6d4f5d7802b600276c23ca417e669f1a06f6f # v2.0.3
         with:
           envkey_ENV_KEY: "ENV_VALUE"
           fail_on_empty: true
@@ -80,7 +80,7 @@ jobs:
           uv run nox
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         if: {% raw %}${{ always() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}{% endraw %}
         with:
           name: test-results
@@ -94,7 +94,7 @@ jobs:
           retention-days: 30
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
         if: {% raw %}${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}{% endraw %}
         with:
           token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
@@ -102,12 +102,12 @@ jobs:
 
       - name: Upload test results to Codecov
         if: {% raw %}${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}{% endraw %}
-        uses: codecov/test-results-action@v1
+        uses: codecov/test-results-action@f2dba722c67b86c6caa034178c6e4d35335f6706 # v1.1.0
         with:
           token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
       - name: SonarQube Scan
         if: {% raw %}${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}{% endraw %}
-        uses: SonarSource/sonarqube-scan-action@v5
+        uses: SonarSource/sonarqube-scan-action@0303d6b62e310685c0e34d0b9cde218036885c4d # v5.0.0
         env:
           GITHUB_TOKEN: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
           SONAR_TOKEN: {% raw %}${{ secrets.SONAR_TOKEN }}{% endraw %}

{oe_python_template-0.6.18 → oe_python_template-0.6.19}/template/CONTRIBUTING.md.jinja

@@ -20,6 +20,7 @@ fi
 which jq &> /dev/null || brew install jq
 which xmllint &> /dev/null || brew install xmllint
 which act &> /dev/null || brew install act
+which pinact &> /dev/null || brew install pinact
 uv run pre-commit install             # install pre-commit hooks, see https://pre-commit.com/
 ```
 
@@ -130,6 +131,12 @@ docker build -t {{ project_name_kebab_case }} .
 docker run --env THE_VAR=THE_VALUE {{ pypi_distribution_name }} --help
 ```
 
+### Pinning github actions
+
+```shell
+pinact run  # See https://dev.to/suzukishunsuke/pin-github-actions-to-a-full-length-commit-sha-for-security-2n7p
+```
+
 ### Copier
 
 Update from template