From 01b12e8019f3fd4361240e5212ad442e3d77593c Mon Sep 17 00:00:00 2001
From: Mike Odnis <airwolf635@gmail.com>
Date: Tue, 22 Sep 2026 05:34:43 -0400
Subject: [PATCH] ci(api-docs/py): bring pypi's cache-poisoning fix upstream,
 reconcile pins

pypi set `enable-cache: false` on setup-uv downstream in
resq-software/pypi#48 to close a zizmor cache-poisoning finding, and
the template never received it. `automation/sync-templates.sh` is a
blind `cp`, so the next run would have deleted the mitigation.

Also bumps the four action pins to the versions pypi actually runs.
The templates live outside `.github/workflows/`, which is the only
path Dependabot's github-actions ecosystem scans, so they get no bump
PRs. The template had fallen 1-4 majors behind every consumer, meaning
a sync today would have rolled those pins backward.

The rationale comment is rewritten rather than copied across. pypi's
version says setup-uv "enables caching by default"; at v10.1.0 the
default is `auto`, which already skips the cache on tag pushes. The
case that still needs an explicit opt-out is workflow_dispatch -- the
trigger these runs actually use.

Verified: each SHA resolves to its commented tag; every input the
template passes is declared by the bumped version (create-pull-request
v7 -> v8 uses 12 of the 24 inputs v8 declares); actionlint clean.
---
 .../source-repo-templates/api-docs.python.yml | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/automation/source-repo-templates/api-docs.python.yml b/automation/source-repo-templates/api-docs.python.yml
index 24173ed0..59fbad4f 100644
--- a/automation/source-repo-templates/api-docs.python.yml
+++ b/automation/source-repo-templates/api-docs.python.yml
@@ -85,18 +85,28 @@ jobs:
           echo "DOCS_REF_SLUG=$slug" >> "$GITHUB_ENV"
 
       - name: Checkout source repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref || github.ref }}
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0
+        # This job opens a cross-repo PR with DOCS_REPO_PR_TOKEN, so it
+        # runs privileged and must not restore a cache that a
+        # less-trusted run could have populated (zizmor
+        # cache-poisoning). setup-uv's `auto` default already skips the
+        # cache on tag pushes, but not on workflow_dispatch -- which is
+        # the trigger these runs actually use -- so the opt-out is set
+        # explicitly rather than inherited. Docs are generated once per
+        # release; a cold uv install costs little.
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: false
 
       - name: Install packages + lazydocs into a venv
         # lazydocs imports the packages it documents, so they must
@@ -513,7 +523,7 @@ jobs:
           rm _pages.txt
 
       - name: Checkout docs repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: resq-software/docs
           path: docs-checkout
@@ -602,7 +612,7 @@ jobs:
           PYINNER
 
       - name: Open PR in docs repo
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           path: docs-checkout
           token: ${{ secrets.DOCS_REPO_PR_TOKEN }}