openlayer-ai/jevals touched its CI configuration in commit 70d5e9b on 2026-11-02 (UTC). Every place that referenced GitHub Actions by tag (v4, v5) was pinned to a full commit SHA, and the workflow token permission was lowered to `contents: read`. .github/dependabot.yml was newly added, while ci.yml and publish.yml were modified. The change totals 34 lines, consisting of 27 additions and 7 deletions.
jevals is a project that provides agent evaluation (eval) and guardrails as a single judgment per request, and the repository description states that it supports local execution. What was touched was not the application code but the CI side. A tag is a movable reference, so at a given point in time it can point to a different value, whereas a commit SHA pins exactly one commit. The pinned targets are actions/checkout(v4.4.0), astral-sh/setup-uv(v5.4.2), actions/upload-artifact(v4.6.2), actions/download-artifact(v4.3.0), and pypa/gh-action-pypi-publish(v1.14.3). ci.yml runs uv sync and pytest on a Python 3.10/3.12/3.13 matrix, and publish.yml uploads the artifacts built on v* tags to PyPI with PYPI_API_TOKEN. Maintenance is left to Dependabot. Once a week it groups all Actions updates into a single PR, and raises the SHA along with the version comments in a commit prefixed with `chore(ci)`.
However, the scope touched by this change extends only as far as pinning CI references and reducing token permissions. The commit message states that defaults were added to the workflows that had no permissions block, so other workflows that already have a permissions block remain as they are. This commit contains no figures measuring runtime performance or evaluation results. The values written in the version comments are likewise pinned values as of that point in time, and updates proceed within the weekly Dependabot PR, so the actually pinned versions move at a point in time different from this commit. No comparison material such as license and star counts or scoring results is given, so it is too early to judge.