remo-cli 2.2.0rc13__tar.gz → 3.0.0__tar.gz

remo_cli-3.0.0/.claude/skills/release/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: release
+description: Cut a remo release — drive the release-please stable release PR, or build/validate/publish a pre-release (RC) — with a mandatory local "test before PyPI" gate and explicit approval before anything is tagged, merged, or published.
+argument-hint: "[stable | rc [X.Y.ZrcN]] — omit to be asked"
+metadata:
+  author: remo
+---
+
+# Release
+
+Operationalizes remo's two-lane release process (see
+[CONTRIBUTING.md](../../../CONTRIBUTING.md) → Release Process). Pairs with the
+release-please integration.
+
+**Non-negotiable safety rules — apply in every mode:**
+
+- **Publishing to PyPI is irreversible.** A version, once uploaded, can never be
+  replaced. Run the local build + smoke gate (Step V below) before any tag,
+  merge, or publish — no exceptions.
+- **Never** `git push` a tag, `git push` a version-bump commit, or `gh pr merge`
+  a release PR **without explicit user approval in the current turn.** Approval
+  from an earlier task does not carry over.
+- Work only from a **clean working tree** on an **up-to-date `main`**. If the
+  tree is dirty or `main` is behind `origin/main`, stop and surface it.
+- Prefer testing **without** publishing. Only publish an RC to PyPI when the user
+  explicitly asks for a public prerelease.
+
+## Step 0 — Determine the mode
+
+From the argument, or by asking the user:
+
+- **`stable`** — drive the release-please release PR to a published stable release.
+- **`rc`** — build/validate a pre-release, optionally publishing it.
+
+Then run `git fetch origin` and verify `git status` is clean and `main` is
+up to date (`git rev-parse HEAD` == `git rev-parse origin/main`).
+
+---
+
+## Stable lane (release-please owns the version + tag)
+
+1. `git checkout main && git pull --ff-only`.
+2. Find the open release PR (release-please titles it `chore(main): release X.Y.Z`
+   and pushes it to a `release-please--…` branch). Match on either signal —
+   do **not** pass the title to `--search`, whose parser silently drops
+   `chore(main):` and returns zero results even when the PR exists:
+   ```bash
+   gh pr list --state open --limit 100 --json number,title,headRefName,url --jq \
+     '.[] | select((.headRefName | startswith("release-please--"))
+                   or (.title | startswith("chore(main): release")))
+      | "\(.number)\t\(.title)\t\(.url)"'
+   ```
+   If none exists, tell the user release-please has not opened one (no
+   releasable `feat:`/`fix:` commits since the last release) and **stop**.
+   Before concluding that, sanity-check with a bare `gh pr list --state open`:
+   a filter bug and a genuinely absent PR look identical from here, and
+   wrongly reporting "no release PR" strands a real one.
+3. Show the proposed bump + changelog for review. `gh pr diff` takes no
+   pathspec (`gh pr diff <n> -- <files>` fails with "accepts at most 1 arg"),
+   so select the files from the API instead:
+   ```bash
+   gh api repos/{owner}/{repo}/pulls/<number>/files --paginate --jq \
+     '.[] | select(.filename == "pyproject.toml" or .filename == "CHANGELOG.md")
+      | "=== \(.filename) ===\n\(.patch)"'
+   ```
+   Read the `⚠ BREAKING CHANGES` block carefully — it is what drives a major
+   bump, and a spurious entry there is the usual cause of an unintended one.
+4. **Run the validation gate (Step V) on the PR's head branch** so you build the
+   exact version that will publish.
+5. **Only on explicit approval**, merge it (release-please then tags `vX.Y.Z`,
+   which triggers `release.yml` to publish to PyPI + GHCR):
+   ```bash
+   gh pr merge <number> --squash
+   ```
+   Before merging, confirm the `RELEASE_PLEASE_TOKEN` secret is set — without it
+   the tag will not trigger the publish. If it's missing, warn the user and let
+   them decide.
+6. Return to `main`, `git pull --ff-only`, report the new tag, and offer to watch
+   the release CI. `gh run watch` needs an explicit run id outside a TTY:
+   ```bash
+   gh run watch "$(gh run list --workflow=release.yml --limit 1 \
+                     --json databaseId --jq '.[0].databaseId')"
+   ```
+
+---
+
+## RC lane (manual — release-please stays out)
+
+1. `git checkout main && git pull --ff-only`.
+2. Determine the RC version `X.Y.ZrcN` (PEP 440 form, **no separator**):
+   - `X.Y.Z` is the next target version (feat → minor, fix → patch over the last
+     stable tag).
+   - `N` increments from the last `vX.Y.Z-rcM` tag for the same `X.Y.Z`
+     (`git tag --list "vX.Y.Z-rc*"`), else `1`.
+   - Confirm the chosen version with the user.
+3. Confirm these two files carry no pre-existing edits, then bump
+   `pyproject.toml` `[project].version` to `X.Y.ZrcN` (optionally run `uv lock`
+   to keep the lockfile's version in step):
+   ```bash
+   git diff --quiet -- pyproject.toml uv.lock \
+     || { echo "pyproject.toml/uv.lock already modified — STOP"; }
+   ```
+   Step 0 already required a clean tree, but re-assert it here: the revert in
+   Step 5 discards whatever is in these files, and the gap between Step 0 and
+   Step 5 spans a full test run.
+4. **Run the validation gate (Step V).**
+5. Ask the user which outcome they want:
+   - **Local test only (default, no PyPI):** revert the bump, then hand off the
+     built wheel (`dist/*.whl`) or the git-install one-liner
+     (`uv tool install --force "git+https://github.com/get2knowio/remo.git@<branch>"`).
+     Nothing is committed, tagged, or published.
+
+     Look before discarding — never `git checkout`/`git restore` these paths
+     blind. Print the diff, confirm it is **only** the version bump you made in
+     Step 3, and only then restore:
+     ```bash
+     git diff -- pyproject.toml uv.lock   # MUST show only the X.Y.ZrcN bump
+     git restore --source=HEAD --worktree -- pyproject.toml uv.lock
+     ```
+     If that diff contains anything else, stop and surface it: something edited
+     these files during the run, and discarding it destroys unrecoverable work.
+   - **CI dev build for cross-machine testing (no PyPI):** trigger the
+     `dev-build.yml` workflow, which builds the wheel in clean CI and uploads it
+     as a run artifact. The stamped version carries a `+g<sha>` local segment, so
+     it is unique and can never reach PyPI. Nothing is committed or tagged.
+     ```bash
+     gh workflow run dev-build.yml -f version=X.Y.ZrcN   # omit -f for an auto dev version
+     # `gh run watch` with no argument fails outside a TTY ("run ID required
+     # when not running interactively"), so resolve the run id first. Give the
+     # dispatch a couple of seconds to register before listing.
+     RUN_ID="$(gh run list --workflow=dev-build.yml --limit 1 \
+                 --json databaseId --jq '.[0].databaseId')"
+     gh run watch "$RUN_ID"
+     # then, on ANY machine:
+     gh run download "$RUN_ID" -n remo-wheel -D ./dl
+     uv tool install --force ./dl/remo_cli-*.whl
+     ```
+   - **Publish a prerelease (only on explicit approval):**
+     ```bash
+     git commit -am "chore(release): X.Y.ZrcN"
+     git tag vX.Y.Z-rcN
+     git push origin main vX.Y.Z-rcN
+     ```
+     `release.yml` detects the `rc` suffix, publishes the prerelease to PyPI +
+     GHCR, and never moves `latest`. Offer to watch CI.
+
+---
+
+## Step V — Validation gate (test the exact wheel before PyPI)
+
+Run this on whatever ref will be released (the release-please PR head for stable,
+or the bumped working tree for an RC). The published version comes from
+`pyproject.toml` via `uv build`, so this builds the identical artifact:
+
+```bash
+uv run pytest -q                    # full suite must pass
+uv build                            # -> dist/remo_cli-<version>-py3-none-any.whl
+VENV="$(mktemp -d)/venv"
+uv venv "$VENV"
+uv pip install --python "$VENV/bin/python" ./dist/remo_cli-<version>-py3-none-any.whl
+"$VENV/bin/remo" --version          # MUST equal <version>
+"$VENV/bin/remo" --help             # sanity-check the CLI loads
+```
+
+Report the results. If tests fail, the wheel version doesn't match, or the CLI
+doesn't load, **stop** and surface it — do not proceed to tag/merge/publish.
+
+## Done when
+
+- The requested lane completed through the point the user approved (validated
+  only; RC wheel handed off; RC published; or stable PR merged).
+- No tag was pushed, commit was pushed, or PR merged without explicit approval.
+- The outcome (and, if published, the immutable version) was reported clearly.

remo_cli-3.0.0/.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Code owners for remo.
+# These owners are the default reviewers for every pull request in this repo.
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+*       @pofallon

{remo_cli-2.2.0rc13 → remo_cli-3.0.0}/.github/dependabot.yml

@@ -7,6 +7,10 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    # Let a new release settle before we bump to it, so we don't chase
+    # immediately-yanked or regression releases.
+    cooldown:
+      default-days: 7
     groups:
       # One PR per week with all minor/patch production deps bumped together.
       production-minor-patch:
@@ -29,6 +33,8 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     groups:
       actions:
         update-types:

{remo_cli-2.2.0rc13 → remo_cli-3.0.0}/.github/workflows/ci.yml

@@ -15,9 +15,9 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -39,16 +39,16 @@ jobs:
     # runs npm ci and pip install under QEMU.
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # Registers binfmt handlers so the arm64 half of tests/image/ can build
       # under emulation on an amd64 runner. The arch-selection branch
       # (FR-027/FR-042) has no other way to be exercised here.
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Install dependencies
         run: uv sync --all-extras
@@ -68,9 +68,9 @@ jobs:
     name: Wheel install smoke test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Build wheel
         run: uv build --wheel
@@ -92,13 +92,39 @@ jobs:
           print("OK: ansible playbooks found in installed wheel")
           EOF
 
+  fish-completion:
+    name: Fish completion (real shell)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+
+      - name: Install fish
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq fish
+
+      # The activation script shells out to `remo` by name, so it has to be a
+      # real binary on PATH — `uv run remo` would never be found by fish.
+      - name: Install remo onto PATH
+        run: |
+          uv sync
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+
+      # Asserting on the text of the generated script is not enough: the bug
+      # this guards against (a2542e9) produced a script that read fine and
+      # emitted a screenful of errors the moment fish executed it.
+      - name: Run completions in a real fish shell
+        run: ./tests/integration/fish_completion.sh
+
   lint:
-    name: Lint
+    name: Lint & Types
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Install dependencies
         run: uv sync --all-extras
@@ -106,6 +132,13 @@ jobs:
       - name: Ruff check
         run: uv run ruff check src/remo_cli
 
+      # mypy analyses against python_version = "3.11" from [tool.mypy], so the
+      # result is independent of whichever interpreter uv resolves here. The
+      # `web` extra must be installed (it is, via --all-extras) or every
+      # src/remo_cli/web/ module degrades to Any and the gate goes blind.
+      - name: Mypy check
+        run: uv run mypy src/remo_cli
+
   frontend:
     name: Frontend (typecheck + unit + build)
     runs-on: ubuntu-latest
@@ -117,9 +150,9 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "20"
           cache: npm
@@ -131,6 +164,9 @@ jobs:
       - name: Typecheck
         run: npm run lint
 
+      - name: Check generated types are fresh
+        run: npm run check:types-fresh
+
       - name: Unit tests
         run: npm run test
 

remo_cli-3.0.0/.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: CodeQL
+
+# Static analysis (code scanning) for the repo's compiled/interpreted sources.
+# Results appear under the Security tab and annotate pull requests.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly full scan so newly published CodeQL queries catch existing code.
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # upload CodeQL results
+      packages: read          # fetch CodeQL packs
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: python
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        with:
+          category: "/language:${{ matrix.language }}"

remo_cli-3.0.0/.github/workflows/dependency-review.yml

@@ -0,0 +1,18 @@
+name: Dependency Review
+
+# Scans dependency manifest changes on pull requests for known-vulnerable
+# packages and disallowed licenses, blocking the PR before they reach main.
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+        with:
+          fail-on-severity: high

remo_cli-3.0.0/.github/workflows/dev-build.yml

@@ -0,0 +1,78 @@
+name: dev-build
+
+# Build an installable wheel and upload it as a run artifact you can download and
+# test on ANY machine — no git tag, no PyPI, no version reserved.
+#
+# The stamped version always carries a PEP 440 *local* segment (`+g<shortsha>`),
+# which PyPI rejects outright — so a dev build can never leak to PyPI, and every
+# build is uniquely identifiable.
+#
+# Trigger manually:
+#   gh workflow run dev-build.yml                     # -> 2.2.0.dev<run>+g<sha>
+#   gh workflow run dev-build.yml -f version=2.3.0rc1 # -> 2.3.0rc1+g<sha>
+#
+# Then, on any machine:
+#   gh run download <run-id> -n remo-wheel -D ./dl
+#   uv tool install --force ./dl/remo_cli-*.whl
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Full base version to stamp (e.g. 2.3.0rc1, 2.3.0). Blank = auto dev version from pyproject. A +g<sha> local segment is always appended."
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+
+      - name: Compute dev version
+        id: ver
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          SHA=$(git rev-parse --short HEAD)
+          if [ -n "$INPUT_VERSION" ]; then
+            BASE="$INPUT_VERSION"
+          else
+            # Core X.Y.Z from pyproject, plus a per-run .dev segment.
+            CORE=$(grep -m1 '^version = ' pyproject.toml \
+              | sed -E 's/version = "([0-9]+\.[0-9]+\.[0-9]+).*"/\1/')
+            BASE="${CORE}.dev${GITHUB_RUN_NUMBER}"
+          fi
+          # Always append the local segment: unique + un-uploadable to PyPI.
+          VERSION="${BASE}+g${SHA}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Building version: $VERSION"
+
+      - name: Stamp version into pyproject.toml
+        env:
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          set -euo pipefail
+          sed -i -E "0,/^version = \".*\"/s//version = \"${VERSION}\"/" pyproject.toml
+          grep -m1 '^version = ' pyproject.toml
+
+      - name: Build wheel + sdist
+        run: uv build
+
+      - name: Upload artifact
+        # NOTE: SHA-pin to match the repo's action-pinning convention once the
+        # v4 commit SHA is available (e.g. `@<sha> # v4`).
+        uses: actions/upload-artifact@v4
+        with:
+          name: remo-wheel
+          path: dist/*
+          retention-days: 30
+          if-no-files-found: error

{remo_cli-2.2.0rc13 → remo_cli-3.0.0}/.github/workflows/provision.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Install Ansible and dependencies
         run: |

remo_cli-3.0.0/.github/workflows/release-please.yml

@@ -0,0 +1,57 @@
+name: release-please
+
+# Automates STABLE releases from Conventional Commits.
+#
+# On every push to main, release-please maintains a "release PR" that bumps the
+# version in pyproject.toml and updates CHANGELOG.md. Merging that PR creates the
+# `vX.Y.Z` tag and a GitHub release — which in turn triggers the existing
+# tag-driven `release.yml` (PyPI + Docker image).
+#
+# RCs / pre-releases are NOT handled here: cut those with a manual `vX.Y.Z-rcN`
+# tag (see CONTRIBUTING.md → Release Process), which `release.yml` publishes as a
+# prerelease. release-please stays out of the RC lane.
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      # Mint a short-lived GitHub App installation token when the App is
+      # configured (org secrets RELEASE_PLEASE_APP_ID + RELEASE_PLEASE_APP_KEY).
+      # An App token — like a PAT, unlike GITHUB_TOKEN — triggers the tag-driven
+      # `release.yml`, but it's short-lived, auto-minted (nothing to rotate), and
+      # tied to no human account. The step is skipped if the App isn't set up.
+      #
+      # NOTE: SHA-pin `create-github-app-token` and `release-please-action` to
+      # match the repo's action-pinning convention (e.g. `@<sha> # v2`) once the
+      # SHAs are available — left as floating tags because they can't be
+      # resolved offline.
+      - name: Mint GitHub App token
+        id: app-token
+        if: ${{ vars.RELEASE_PLEASE_APP_ID != '' }}
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_PLEASE_APP_KEY }}
+
+      - uses: googleapis/release-please-action@v4
+        with:
+          # Token precedence:
+          #   1. GitHub App installation token (recommended — see above).
+          #   2. RELEASE_PLEASE_TOKEN PAT (if someone set one instead).
+          #   3. GITHUB_TOKEN fallback — release-please still opens/maintains the
+          #      release PR out of the box, but a tag it creates will NOT fire
+          #      `on: push: tags`, so `release.yml` (PyPI + Docker) won't run
+          #      until a maintainer re-pushes the tag. Configure the App (or the
+          #      PAT) to make merge-to-publish automatic.
+          token: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

{remo_cli-2.2.0rc13 → remo_cli-3.0.0}/.github/workflows/release.yml

@@ -13,9 +13,9 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
@@ -137,7 +137,7 @@ jobs:
           fi
 
       - name: Create Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           name: ${{ steps.tag.outputs.tag }}
@@ -153,15 +153,15 @@ jobs:
     environment: pypi
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Build package
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
 
   publish-image:
     # Publishes the remo-web container image that docker/compose.example.yml
@@ -177,16 +177,16 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # Needed for the linux/arm64 half of the manifest: GitHub's runners are
       # amd64, so arm64 is cross-built under emulation.
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -194,7 +194,7 @@ jobs:
 
       - name: Derive image tags and labels
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/remo-web
           # latest=false disables this action's automatic `latest`; the raw
@@ -207,7 +207,7 @@ jobs:
             type=raw,value=latest,enable=${{ needs.release.outputs.is_prerelease == 'false' }}
 
       - name: Build and push (amd64 + arm64)
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           file: docker/Dockerfile

{remo_cli-2.2.0rc13 → remo_cli-3.0.0}/.github/workflows/smoke-test-cleanup.yml

@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           role-session-name: remo-cleanup-${{ github.run_id }}
@@ -81,7 +81,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Setup hcloud CLI
-        uses: hetznercloud/setup-hcloud@v2
+        uses: hetznercloud/setup-hcloud@ac9e7d74fb41a3ca44a6a3da123bd5aa70731e3a # v2
 
       - name: Delete stale CI servers
         env: