Kobi Hikri dfce767f4c ci: pin ad-m/github-push-action to a full commit SHA in the release job (#3677) ...

Hi, and thank you for LanceDB.

Small CI supply-chain hardening. In `make-release-commit.yml`, the
release job checks out with `LANCEDB_RELEASE_TOKEN` (a push-capable PAT)
and its final step pushes the version tag using a third-party action
pinned to a **mutable branch**:

```yaml
- name: Push new version tag
  uses: ad-m/github-push-action@master
  with:
    github_token: ${{ secrets.LANCEDB_RELEASE_TOKEN }}
```

`@master` can move after review; whatever it points at then runs with
that release token in scope. This PR pins it to the commit behind the
current release (`v1.3.0` → `881a6320…`), keeping the version visible as
a comment. Behavior today is unchanged.

For transparency: I used AI assistance to spot and draft this; I
verified the workflow and resolved the SHA myself.

2026-07-16 12:16:10 -07:00

..

actions/create-failure-issue

ci: automatic issue creation for failed publish workflows (#2694)

2025-10-02 08:24:16 -07:00

ISSUE_TEMPLATE

docs: fix broken documentation links (#3278)

2026-04-15 20:56:59 +08:00

workflows

ci: pin ad-m/github-push-action to a full commit SHA in the release job (#3677)

2026-07-16 12:16:10 -07:00

dependabot.yml

ci: update python lockfile weekly (#3498)

2026-06-03 15:24:32 -07:00

labeler.yml

ci: write down breaking change policy (#1294)

2024-05-13 10:25:55 -07:00

release_notes.json

ci: make preview releases (#1302)

2024-05-17 11:24:38 -07:00