Skip to content

Commit 36c566d

Browse files
damientobin1damientobin1
committed
CCM-14499: Pinning all GitHub Actions to SHAs
1 parent 2676deb commit 36c566d

File tree

18 files changed

+60
-120
lines changed

18 files changed

+60
-120
lines changed

‎.github/actions/acceptance-tests/action.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ runs:
6060
ENVIRONMENT: ${{ inputs.targetEnvironment }}
6161
- name: Archive integration test results
6262
if: ${{ inputs.testType == 'integration' }}
63-
uses: actions/upload-artifact@v4
64-
with:
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
6564
name: Integration test report
6665
path: "tests/playwright/playwright-report"

‎.github/actions/build-docs/action.yml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,7 @@ runs:
1414
using: "composite"
1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v5
18-
- uses: ./.github/actions/node-install
17+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - uses: ./.github/actions/node-install
1918
with:
2019
node-version: ${{ inputs.node-version }}
2120
GITHUB_TOKEN: ${{ inputs.GITHUB_TOKEN }}
@@ -24,16 +23,14 @@ runs:
2423
run: npm ci
2524
shell: bash
2625
- name: Setup Ruby
27-
uses: ruby/setup-ruby@v1.267.0
28-
with:
26+
uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0 with:
2927
ruby-version: "3.4.7" # Not needed with a .ruby-version file
3028
bundler-cache: true # Enable automatic gem caching
3129
cache-version: 0 # Increment this number if you need to re-download cached gems
3230
working-directory: "./docs"
3331
- name: Setup Pages
3432
id: pages
35-
uses: actions/configure-pages@v5
36-
- name: Build with Jekyll
33+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - name: Build with Jekyll
3734
working-directory: ./docs
3835
# Outputs to the './_site' directory by default
3936
shell: bash
@@ -45,8 +42,7 @@ runs:
4542
VERSION: ${{ inputs.version }}
4643
- name: Upload artifact
4744
# Automatically uploads an artifact from the './_site' directory by default
48-
uses: actions/upload-pages-artifact@v3
49-
with:
45+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with:
5046
path: "docs/_site/"
5147
name: jekyll-docs-${{ inputs.version }}
5248

@@ -55,7 +51,6 @@ runs:
5551
shell: bash
5652

5753
- name: Upload artifact
58-
uses: actions/upload-artifact@v4
59-
with:
54+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
6055
path: "artifact.tar"
6156
name: schemas-${{ inputs.version }}

‎.github/actions/build-schemas/action.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,7 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - uses: actions/setup-node@v4
1312
with:
1413
node-version: 18
1514

@@ -28,7 +27,6 @@ runs:
2827
shell: bash
2928

3029
- name: Upload artifact
31-
uses: actions/upload-artifact@v4
32-
with:
30+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
3331
path: "artifact.tar"
3432
name: schemas-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ runs:
3333
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3434
- name: "Upload CLOC report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@v4
37-
with:
36+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
3837
name: lines-of-code-report.json.zip
3938
path: ./lines-of-code-report.json.zip
4039
retention-days: 21
@@ -45,8 +44,7 @@ runs:
4544
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4645
- name: "Authenticate to send the report"
4746
if: steps.check.outputs.secrets_exist == 'true'
48-
uses: aws-actions/configure-aws-credentials@v4
49-
with:
47+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with:
5048
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5149
aws-region: ${{ inputs.idp_aws_report_upload_region }}
5250
- name: "Send the CLOC report to the central location"

‎.github/actions/node-install/action.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,7 @@ runs:
1313
using: 'composite'
1414
steps:
1515
- name: 'Use Node.js'
16-
uses: actions/setup-node@v6
17-
with:
16+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with:
1817
node-version: '${{ inputs.node-version }}'
1918
cache: 'npm'
2019
cache-dependency-path: '**/package-lock.json'

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ runs:
3333
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3434
- name: "Upload SBOM report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@v4
37-
with:
36+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
3837
name: sbom-repository-report.json.zip
3938
path: ./sbom-repository-report.json.zip
4039
retention-days: 21
@@ -49,8 +48,7 @@ runs:
4948
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
5049
- name: "Upload vulnerabilities report as an artefact"
5150
if: ${{ !env.ACT }}
52-
uses: actions/upload-artifact@v4
53-
with:
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
5452
name: vulnerabilities-repository-report.json.zip
5553
path: ./vulnerabilities-repository-report.json.zip
5654
retention-days: 21
@@ -60,8 +58,7 @@ runs:
6058
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
6159
- name: "Authenticate to send the reports"
6260
if: steps.check.outputs.secrets_exist == 'true'
63-
uses: aws-actions/configure-aws-credentials@v4
64-
with:
61+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with:
6562
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6663
aws-region: ${{ inputs.idp_aws_report_upload_region }}
6764
- name: "Send the SBOM and vulnerabilities reports to the central location"

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,7 @@ jobs:
4040
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
4141
steps:
4242
- name: "Checkout code"
43-
uses: actions/checkout@v5
44-
- name: "Set CI/CD variables"
43+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: "Set CI/CD variables"
4544
id: variables
4645
run: |
4746
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,7 @@ jobs:
5252
# tag: ${{ steps.variables.outputs.tag }}
5353
steps:
5454
- name: "Checkout code"
55-
uses: actions/checkout@v5
56-
- name: "Set CI/CD variables"
55+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: "Set CI/CD variables"
5756
id: variables
5857
run: |
5958
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
@@ -85,8 +84,7 @@ jobs:
8584
needs: metadata
8685
steps:
8786
- name: "Checkout code"
88-
uses: actions/checkout@v5
89-
87+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
9088
- name: "Get version"
9189
id: get-asset-version
9290
shell: bash
@@ -143,6 +141,5 @@ jobs:
143141

144142
- name: Deploy to GitHub Pages
145143
id: deployment
146-
uses: actions/deploy-pages@v4
147-
with:
144+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 with:
148145
artifact_name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@ jobs:
1515
steps:
1616
- name: combine-prs
1717
id: combine-prs
18-
uses: github/combine-prs@v5.2.0
19-
with:
18+
uses: github/combine-prs@e6d37110da1b512313419ba6992492dad622139f # v5.2.0 with:
2019
ci_required: false
2120
labels: dependencies
2221
pr_title: Combined Dependabot PRs

‎.github/workflows/pr_closed.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Checkout repository
51-
uses: actions/checkout@v5.0.0
52-
51+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5352
- name: Updating Main Environment
5453
env:
5554
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

0 commit comments

Comments
 (0)