From d0141b2996501bab645488f3710527c04998561e Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Tue, 22 Sep 2026 22:12:25 -0700 Subject: [PATCH 1/5] ci: update shared gh-actions pins --- .github/workflows/build.yml | 12 ++++++------ .github/workflows/changelog-generate.yml | 6 +++--- .github/workflows/changelog.yml | 2 +- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/dependency-scan.yml | 2 +- .github/workflows/friction-log.yml | 4 ++-- .github/workflows/pr-audit.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/scan-github-actions.yml | 2 +- 9 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1d404fb..df52e5f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -26,7 +26,7 @@ jobs: release_tag: ${{ steps.parse.outputs.release_tag }} steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Parse release version from tag id: parse @@ -106,7 +106,7 @@ jobs: TEMPO_WALLET_PACKAGE_OUTPUT: artifacts/${{ matrix.package }}-${{ matrix.build.suffix }} steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -159,7 +159,7 @@ jobs: cat "$BIN.sha256" - name: Generate SBOM (SPDX-JSON) - uses: tempoxyz/gh-actions/vendor/anchore/sbom-action@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/vendor/anchore/sbom-action@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b with: file: artifacts/${{ env.PACKAGE }}-${{ matrix.build.suffix }} format: spdx-json @@ -179,7 +179,7 @@ jobs: subject-path: artifacts/${{ env.PACKAGE }}-${{ matrix.build.suffix }} - name: Install cosign - uses: tempoxyz/gh-actions/vendor/sigstore/cosign-installer@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/vendor/sigstore/cosign-installer@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Sign binary with cosign (keyless) shell: bash @@ -222,7 +222,7 @@ jobs: AWS_REQUEST_CHECKSUM_CALCULATION: when_required steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -405,7 +405,7 @@ jobs: RELEASE_TAG: ${{ needs.parse-tag.outputs.release_tag }} steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Publish draft release env: diff --git a/.github/workflows/changelog-generate.yml b/.github/workflows/changelog-generate.yml index 2dcc9b9..d72187d 100644 --- a/.github/workflows/changelog-generate.yml +++ b/.github/workflows/changelog-generate.yml @@ -17,7 +17,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Determine PR source id: source @@ -48,7 +48,7 @@ jobs: - name: Fetch GitHub token via STS if: steps.source.outputs.same_repo == 'true' id: app-token - uses: tempoxyz/gh-actions/actions/github-sts@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/github-sts@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b with: policy: release @@ -177,7 +177,7 @@ jobs: pull-requests: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Comment for fork PRs if: github.event.pull_request.head.repo.full_name != github.repository diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index e0e5588..a4192a4 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -17,7 +17,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a8916d0..7c31c88 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Check required jobs run: | @@ -41,14 +41,14 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm - uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -70,14 +70,14 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm - uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -102,14 +102,14 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm - uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index 9673bd7..0c4979e 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -7,7 +7,7 @@ permissions: {} jobs: dependency-scan: - uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b permissions: contents: read id-token: write diff --git a/.github/workflows/friction-log.yml b/.github/workflows/friction-log.yml index f3a8807..cd8feb0 100644 --- a/.github/workflows/friction-log.yml +++ b/.github/workflows/friction-log.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Clone repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -37,6 +37,6 @@ jobs: ref: ${{ github.sha }} - name: Report and reconcile frictions - uses: tempoxyz/gh-actions/vendor/wevm/frog/action@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/vendor/wevm/frog/action@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b with: issue-author: github-actions[bot] diff --git a/.github/workflows/pr-audit.yml b/.github/workflows/pr-audit.yml index 28a1543..ce357b9 100644 --- a/.github/workflows/pr-audit.yml +++ b/.github/workflows/pr-audit.yml @@ -19,7 +19,7 @@ jobs: github.event.issue.pull_request && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) ) - uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b secrets: EVENTS_KEY: ${{ secrets.EVENTS_KEY }} EVENTS_CERT: ${{ secrets.EVENTS_CERT }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 67f36c5..12bcb4c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -60,7 +60,7 @@ jobs: - name: Fetch GitHub token via STS if: steps.diff.outputs.changed == 'true' id: sts - uses: tempoxyz/gh-actions/actions/github-sts@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf # main + uses: tempoxyz/gh-actions/actions/github-sts@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b with: policy: release-pr @@ -97,7 +97,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml index 3c40992..39dbae5 100644 --- a/.github/workflows/scan-github-actions.yml +++ b/.github/workflows/scan-github-actions.yml @@ -18,7 +18,7 @@ permissions: {} jobs: scan: if: ${{ github.event_name != 'schedule' || github.repository == 'tempoxyz/wallet-cli' }} - uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@0a60d757d0f4725a34f22f7b9ebf7b91b4b00bcf + uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b permissions: actions: read contents: read From fbeba86ff4e447fdc47000e2fd96edcf76d68d94 Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Tue, 22 Sep 2026 22:15:17 -0700 Subject: [PATCH 2/5] ci: correct checkout pin version comment --- .github/workflows/friction-log.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/friction-log.yml b/.github/workflows/friction-log.yml index cd8feb0..2ea99b0 100644 --- a/.github/workflows/friction-log.yml +++ b/.github/workflows/friction-log.yml @@ -31,7 +31,7 @@ jobs: uses: tempoxyz/gh-actions/actions/secure-runner@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b - name: Clone repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ github.sha }} From 1fc8c02b9f739cc72aa97f53682c8cf3b05c8d41 Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Tue, 22 Sep 2026 22:25:18 -0700 Subject: [PATCH 3/5] test: allow CLI schema checks more startup time --- test/cli-describe.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/cli-describe.test.ts b/test/cli-describe.test.ts index 4b7d002..aeeaf0c 100644 --- a/test/cli-describe.test.ts +++ b/test/cli-describe.test.ts @@ -176,7 +176,7 @@ describe("generated CLI metadata", () => { output: { items: { properties: { installed: { type: string } } } }; }; expect(skillsList.output.items.properties.installed.type).toBe("boolean"); - }); + }, 30_000); it("accepts --no-browser for browser-backed wallet commands", () => { expect(Parser.parse(["--no-browser"], { options: loginOptions }).options).toMatchObject({ From c82f0e5f25eca96e8e5635a6bfc50f1a7c771dc7 Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Tue, 22 Sep 2026 22:27:18 -0700 Subject: [PATCH 4/5] chore: record CI test stability change --- .changelog/gh-actions-pin-ci.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changelog/gh-actions-pin-ci.md diff --git a/.changelog/gh-actions-pin-ci.md b/.changelog/gh-actions-pin-ci.md new file mode 100644 index 0000000..f3bfe79 --- /dev/null +++ b/.changelog/gh-actions-pin-ci.md @@ -0,0 +1,5 @@ +--- +wallet-cli: none +--- + +Allow more time for CLI schema tests to start their subprocesses in CI. From 3e48a97c65ac72fd00f5d0efb036f430f06e8965 Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Tue, 22 Sep 2026 22:31:35 -0700 Subject: [PATCH 5/5] ci: use pinned pnpm setup for changelog checks --- .github/workflows/changelog.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index a4192a4..1ee5a99 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -56,17 +56,16 @@ jobs: exit 1 fi + - name: Setup pnpm + if: steps.changes.outputs.has_changelog == 'true' + uses: tempoxyz/gh-actions/vendor/pnpm/action-setup@d39baa2b43f5eba5d261c047521a4fbd56101129 # 2026-09-23T04-31-11Z-d39baa2b + - name: Setup Node.js if: steps.changes.outputs.has_changelog == 'true' uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" - - - name: Setup pnpm - if: steps.changes.outputs.has_changelog == 'true' - run: | - corepack enable - corepack prepare pnpm@11.0.8 --activate + cache: pnpm - name: Install dependencies if: steps.changes.outputs.has_changelog == 'true'