huggingface · dependabot · Sep 17, 2026 · Sep 17, 2026
diff --git a/.github/workflows/build-push-unity.yml b/.github/workflows/build-push-unity.yml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   buildForAllSupportedPlatforms:
+    permissions:
+      contents: read
     name: Build ${{ matrix.targetPlatform }}
     runs-on: ubuntu-latest
     strategy:
@@ -28,13 +32,13 @@ jobs:
           - StandaloneLinux64 # Build a Linux 64-bit standalone.
           # - WebGL # WebGL.
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           lfs: true
 
       - name: Caching Unity Library
-        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace  # v2
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: integrations/Unity/simulate-unity/Library
           key: Library-Simulate
@@ -43,7 +47,7 @@ jobs:
             Library-
 
       - name: Build Unity Simulate
-        uses: game-ci/unity-builder@9f79830454d37cd9e70c4c3b73d26c06bcce2b2a  # v2
+        uses: game-ci/unity-builder@eb1b9fba120c6e62c9fb7a7a81d6c107ce004c45  # v6.0.0
         env:
           UNITY_LICENSE: ${{ secrets.UNITY_LICENSE }}
         with:
@@ -57,7 +61,7 @@ jobs:
           cd ${{ github.workspace }}/integrations/Unity/builds/
           tar -cvzf ${{ github.workspace }}/compressed_builds/${{ matrix.targetPlatform }}.tar.gz ./${{ matrix.targetPlatform }}
 
-      - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2  # v2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Build-${{ matrix.targetPlatform }}
           path: ${{ github.workspace }}/compressed_builds/${{ matrix.targetPlatform }}.tar.gz
@@ -66,7 +70,7 @@ jobs:
   #   name: Simple build and push
   #   runs-on: ubuntu-latest
   #   steps:
-  #     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+  #     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
   #       with:
   #         fetch-depth: 0
   #         lfs: true
@@ -78,28 +82,30 @@ jobs:
   #         tar -cvzf ${{ github.workspace }}/builds/Standalone.tar.gz ./simulate_godot
 
 
-  #     - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2  # v2
+  #     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
   #       with:
   #         name: Build-Standalone
   #         path: ./builds/Standalone.tar.gz
 
   PushToHub:
+    permissions: {}
     name: Upload if release
     needs: [buildForAllSupportedPlatforms]
     runs-on: ubuntu-latest
-    # if: github.event_name == 'release' && github.event.action == 'published'
+    if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.x"
 
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           # name: artifact
           path: builds
 
       - name: Push builds to Hub
+        if: github.event_name == 'release' && github.event.action == 'published'
         env:
           HF_TOKEN: ${{ secrets.UNITY_BUILD_PUSH }}
           HF_USERNAME: thomwolf

diff --git a/.github/workflows/build_documentation.yml b/.github/workflows/build_documentation.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
    build:
-    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3  # main
+    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169  # main
     with:
       commit_sha: ${{ github.sha }}
       package: simulate

diff --git a/.github/workflows/build_pr_documentation.yml b/.github/workflows/build_pr_documentation.yml
@@ -9,7 +9,7 @@ concurrency:
 
 jobs:
   build:
-    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3  # main
+    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169  # main
     with:
       commit_sha: ${{ github.event.pull_request.head.sha }}
       pr_number: ${{ github.event.number }}

diff --git a/.github/workflows/delete_doc_comment.yml b/.github/workflows/delete_doc_comment.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   delete:
-    uses: huggingface/doc-builder/.github/workflows/delete_doc_comment.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3  # main
+    uses: huggingface/doc-builder/.github/workflows/delete_doc_comment.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169  # main
     with:
       pr_number: ${{ github.event.number }}
       package: simulate
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -22,9 +26,9 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: actions/setup-python@v4
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
 

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
@@ -2,13 +2,17 @@ name: Quality Check
 
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   quality:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python 3.8
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: 3.8
     - name: Install Python dependencies

diff --git a/.github/workflows/tests-no-deps.yml b/.github/workflows/tests-no-deps.yml
@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
@@ -17,14 +21,14 @@ jobs:
             vtk-version: '9.0.3'
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c  # v3
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.cache/pip
           key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }}

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
@@ -21,14 +25,14 @@ jobs:
             vtk-version: 'latest'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pip
           key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }}

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
@@ -14,25 +14,31 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build_sdist:
+    permissions:
+      contents: read
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
     - name: Build SDist
       run: pipx run build --sdist
 
     - name: Check metadata
       run: pipx run twine check dist/*
 
-    - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         path: dist/*.tar.gz
 
 
   build_wheels:
+    permissions:
+      contents: read
     name: Wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -41,9 +47,9 @@ jobs:
         os: [ubuntu-20.04, windows-2019, macos-11]
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-    - uses: pypa/cibuildwheel@v2.10.1
+    - uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1
       env:
         CIBW_ARCHS_MACOS: auto universal2
         CIBW_SKIP: cp311-* *-win32 pp38-* pp39-* *_i686 *-musllinux_* cp38-*-universal2
@@ -54,28 +60,29 @@ jobs:
       shell: bash
 
     - name: Upload wheels
-      uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         path: wheelhouse/*.whl
 
 
   upload_all:
+    permissions: {}
     name: Upload if release
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
     if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-    - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: "3.x"
 
-    - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: artifact
         path: dist
 
-    - uses: pypa/gh-action-pypi-publish@v1.5.1
+    - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
       with:
         user: thomwolf
         password: ${{ secrets.pypi_password }}