Skip to content

Commit f433e86

Browse files
damientobin1damientobin1
committed
CCM-14499: Pinning all GitHub Actions to SHAs
1 parent 36c566d commit f433e86

File tree

15 files changed

+86
-43
lines changed

15 files changed

+86
-43
lines changed

‎.github/actions/acceptance-tests/action.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ runs:
6060
ENVIRONMENT: ${{ inputs.targetEnvironment }}
6161
- name: Archive integration test results
6262
if: ${{ inputs.testType == 'integration' }}
63-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
64+
with:
6465
name: Integration test report
6566
path: "tests/playwright/playwright-report"

‎.github/actions/build-docs/action.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ runs:
3030
working-directory: "./docs"
3131
- name: Setup Pages
3232
id: pages
33-
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - name: Build with Jekyll
33+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
34+
- name: Build with Jekyll
3435
working-directory: ./docs
3536
# Outputs to the './_site' directory by default
3637
shell: bash
@@ -42,7 +43,8 @@ runs:
4243
VERSION: ${{ inputs.version }}
4344
- name: Upload artifact
4445
# Automatically uploads an artifact from the './_site' directory by default
45-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with:
46+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
47+
with:
4648
path: "docs/_site/"
4749
name: jekyll-docs-${{ inputs.version }}
4850

@@ -51,6 +53,7 @@ runs:
5153
shell: bash
5254

5355
- name: Upload artifact
54-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
56+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
57+
with:
5558
path: "artifact.tar"
5659
name: schemas-${{ inputs.version }}

‎.github/actions/build-schemas/action.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ runs:
2727
shell: bash
2828

2929
- name: Upload artifact
30-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
30+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
31+
with:
3132
path: "artifact.tar"
3233
name: schemas-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ runs:
3333
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3434
- name: "Upload CLOC report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
36+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
37+
with:
3738
name: lines-of-code-report.json.zip
3839
path: ./lines-of-code-report.json.zip
3940
retention-days: 21
@@ -44,7 +45,8 @@ runs:
4445
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4546
- name: "Authenticate to send the report"
4647
if: steps.check.outputs.secrets_exist == 'true'
47-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with:
48+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
49+
with:
4850
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
4951
aws-region: ${{ inputs.idp_aws_report_upload_region }}
5052
- name: "Send the CLOC report to the central location"

‎.github/actions/node-install/action.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ runs:
1313
using: 'composite'
1414
steps:
1515
- name: 'Use Node.js'
16-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with:
16+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
17+
with:
1718
node-version: '${{ inputs.node-version }}'
1819
cache: 'npm'
1920
cache-dependency-path: '**/package-lock.json'

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ runs:
3333
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3434
- name: "Upload SBOM report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
36+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
37+
with:
3738
name: sbom-repository-report.json.zip
3839
path: ./sbom-repository-report.json.zip
3940
retention-days: 21
@@ -48,7 +49,8 @@ runs:
4849
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4950
- name: "Upload vulnerabilities report as an artefact"
5051
if: ${{ !env.ACT }}
51-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
52+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
53+
with:
5254
name: vulnerabilities-repository-report.json.zip
5355
path: ./vulnerabilities-repository-report.json.zip
5456
retention-days: 21
@@ -58,7 +60,8 @@ runs:
5860
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
5961
- name: "Authenticate to send the reports"
6062
if: steps.check.outputs.secrets_exist == 'true'
61-
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with:
63+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
64+
with:
6265
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6366
aws-region: ${{ inputs.idp_aws_report_upload_region }}
6467
- name: "Send the SBOM and vulnerabilities reports to the central location"

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ jobs:
4040
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
4141
steps:
4242
- name: "Checkout code"
43-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: "Set CI/CD variables"
43+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
44+
- name: "Set CI/CD variables"
4445
id: variables
4546
run: |
4647
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,8 @@ jobs:
5252
# tag: ${{ steps.variables.outputs.tag }}
5353
steps:
5454
- name: "Checkout code"
55-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: "Set CI/CD variables"
55+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
56+
- name: "Set CI/CD variables"
5657
id: variables
5758
run: |
5859
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
@@ -141,5 +142,6 @@ jobs:
141142

142143
- name: Deploy to GitHub Pages
143144
id: deployment
144-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 with:
145+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
146+
with:
145147
artifact_name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ jobs:
1818
- name: Check out the repository
1919
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
2020
- name: Check out external repository
21-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with:
21+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
22+
with:
2223
repository: NHSDigital/nhs-notify-repository-template
2324
path: nhs-notify-repository-template
2425
token: ${{ github.token }}

‎.github/workflows/scorecard.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ jobs:
5959
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6060
# format to the repository Actions tab.
6161
- name: "Upload artifact"
62-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
62+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
63+
with:
6364
name: SARIF file
6465
path: results.sarif
6566
retention-days: 5

0 commit comments

Comments
 (0)