René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CI: Hash-pin all actions","articleBody":"(Sorry for using a blank issue for this! None of the other templates seemed exactly right.)\n\nI'm proposing that CPython's CI switch to fully-hash-pinned GitHub Actions references. This is enforced by default via [zizmor](https://docs.zizmor.sh), but currently CPython's configuration relaxes that default here:\n\nhttps://github.com/python/cpython/blob/17070f41d4ccf5e82e5841e467b3aef5294f2c9a/.github/zizmor.yml#L10\n\nDoing so should be a non-breaking change: the versions resolved will be the same as before, and tools like Dependabot/Renovate/pinact will continue to be able to update any action references, including their hashes.\n\nRef: https://docs.zizmor.sh/audits/#unpinned-uses\n\nCC @sethmlarson \n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-146489\n* gh-147968\n* gh-147975\n* gh-147978\n* gh-147979\n* gh-147980\n* gh-147981\n* gh-147982\n* gh-147983\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/woodruffw","@type":"Person","name":"woodruffw"},"datePublished":"2026-03-26T20:03:22.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/146488/cpython/issues/146488"}