Skip to content

Commit ab28f17

Browse files
bentheviningbenthevining
committed
fix(security): pinning all third-party Github actions to commit hashes
1 parent 5f93939 commit ab28f17

File tree

5 files changed

+38
-38
lines changed

5 files changed

+38
-38
lines changed

‎.github/workflows/build_and_test.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -93,15 +93,15 @@ jobs:
9393
# TODO: ensure install of runtime libraries for sanitizers, set LD_LIBRARY_PATH
9494
- name: Ensure Clang version
9595
if: runner.os == 'Linux' && matrix.preset == 'clang'
96-
uses: egor-tensin/setup-clang@v2.1
96+
uses: egor-tensin/setup-clang@471a6f8ef1d449dba8e1a51780e7f943572a3f99 # v2.1
9797
with:
9898
version: 21
9999

100100
- name: Ensure CMake 4.0
101-
uses: lukka/get-cmake@v4.2.3
101+
uses: lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375 # v4.2.3
102102

103103
- name: Checkout code
104-
uses: actions/checkout@v6
104+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
105105

106106
- name: Install Python dependencies
107107
run: cmake -P InstallPythonDeps.cmake
@@ -119,7 +119,7 @@ jobs:
119119
continue-on-error: true
120120

121121
- name: Upload test results
122-
uses: actions/upload-artifact@v7
122+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
123123
with:
124124
name: ${{ env.JUNIT_FILENAME }}
125125
path: ${{ env.BUILD_DIR }}/${{ env.JUNIT_FILENAME }}
@@ -129,7 +129,7 @@ jobs:
129129
run: cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.DEPLOY_DIR }} --component ben_bot --config ${{ matrix.config }}
130130

131131
- name: Upload artifact
132-
uses: actions/upload-artifact@v7
132+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
133133
if: matrix.config == 'Release'
134134
with:
135135
name: BenBot-${{ matrix.os }}-${{ matrix.preset }}
@@ -147,14 +147,14 @@ jobs:
147147

148148
steps:
149149
- name: Download JUnit results
150-
uses: actions/download-artifact@v8
150+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
151151
with:
152152
path: junit
153153
pattern: junit-*
154154
merge-multiple: true
155155

156156
- name: Report aggregate results
157-
uses: EnricoMi/publish-unit-test-result-action@v2.23.0
157+
uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
158158
with:
159159
check_name: "Test Results (${{ github.event.workflow_run.event || github.event_name }})"
160160
files: junit/*.xml

‎.github/workflows/code_ql.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,18 +44,18 @@ jobs:
4444

4545
steps:
4646
- name: Checkout repository
47-
uses: actions/checkout@v6
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4848

4949
- name: Initialize CodeQL
50-
uses: github/codeql-action/init@v4
50+
uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
5151
with:
5252
languages: ${{ matrix.language }}
5353
build-mode: none
5454
analysis-kinds: code-scanning, code-quality
5555
queries: security-and-quality
5656

5757
- name: Perform CodeQL Analysis
58-
uses: github/codeql-action/analyze@v4
58+
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
5959
with:
6060
category: "/language:${{matrix.language}}"
6161

@@ -71,13 +71,13 @@ jobs:
7171

7272
steps:
7373
- name: Ensure CMake 4.0
74-
uses: lukka/get-cmake@v4.2.3
74+
uses: lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375 # v4.2.3
7575

7676
- name: Checkout repository
77-
uses: actions/checkout@v6
77+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7878

7979
- name: Initialize CodeQL
80-
uses: github/codeql-action/init@v4
80+
uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
8181
with:
8282
languages: ${{ env.LANGUAGE }}
8383
build-mode: manual
@@ -92,6 +92,6 @@ jobs:
9292
working-directory: Builds/${{ env.PRESET }}
9393

9494
- name: Perform CodeQL Analysis
95-
uses: github/codeql-action/analyze@v4
95+
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
9696
with:
9797
category: "/language:${{ env.LANGUAGE }}"

‎.github/workflows/docs.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,10 @@ jobs:
6060
sudo apt install -y doxygen graphviz
6161
6262
- name: Ensure CMake 4.0
63-
uses: lukka/get-cmake@v4.2.3
63+
uses: lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375 # v4.2.3
6464

6565
- name: Checkout code
66-
uses: actions/checkout@v6
66+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6767
with:
6868
ref: ${{ inputs.ref || github.ref }}
6969

@@ -90,7 +90,7 @@ jobs:
9090
# Create status check to report warnings
9191
- name: Report check state
9292
if: always()
93-
uses: LouisBrunner/checks-action@v2
93+
uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2
9494
with:
9595
token: ${{ secrets.GITHUB_TOKEN }}
9696
name: Docs warnings
@@ -103,7 +103,7 @@ jobs:
103103
cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.DEPLOY_DIR }} --component ben_bot_docs
104104
105105
- name: Upload artifact
106-
uses: actions/upload-pages-artifact@v4
106+
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
107107
with:
108108
name: BenBot-docs
109109
path: ${{ env.DEPLOY_DIR }}/share/doc/html
@@ -123,6 +123,6 @@ jobs:
123123
steps:
124124
- name: Deploy to GitHub Pages
125125
id: deployment
126-
uses: actions/deploy-pages@v4
126+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
127127
with:
128128
artifact_name: BenBot-docs

‎.github/workflows/sprt_internal.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,14 @@ jobs:
5353

5454
steps:
5555
- name: Ensure CMake 4.0
56-
uses: lukka/get-cmake@v4.2.3
56+
uses: lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375 # v4.2.3
5757

5858
- name: Checkout code
59-
uses: actions/checkout@v6
59+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6060

6161
- name: Download fastchess release
6262
id: download_fastchess
63-
uses: robinraju/release-downloader@v1.12
63+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
6464
with:
6565
repository: Disservin/fastchess
6666
latest: true
@@ -88,7 +88,7 @@ jobs:
8888
- name: Download latest BenBot release
8989
if: ${{ !inputs.use_main }}
9090
id: download_benbot
91-
uses: robinraju/release-downloader@v1.12
91+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
9292
with:
9393
latest: true
9494
fileName: BenBot-ubuntu-latest-clang.zip
@@ -116,7 +116,7 @@ jobs:
116116

117117
- name: Checkout main
118118
if: ${{ inputs.use_main }}
119-
uses: actions/checkout@v6
119+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
120120
with:
121121
ref: main
122122
path: ${{ env.TMP_ROOT }}
@@ -164,7 +164,7 @@ jobs:
164164
working-directory: ${{ env.BUILD_DIR }}
165165

166166
- name: Upload logs
167-
uses: actions/upload-artifact@v7
167+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
168168
with:
169169
name: sprt-logs
170170
path: logs/sprt

‎.github/workflows/tag_and_release.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454

5555
steps:
5656
- name: Checkout code
57-
uses: actions/checkout@v6
57+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5858
with:
5959
fetch-depth: 0
6060

@@ -68,7 +68,7 @@ jobs:
6868
run: pre-commit install --install-hooks
6969

7070
- name: Import GPG key
71-
uses: crazy-max/ghaction-import-gpg@v7
71+
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
7272
with:
7373
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
7474
passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -132,22 +132,22 @@ jobs:
132132
133133
- name: Ensure Clang version
134134
if: runner.os == 'Linux' && matrix.preset == 'clang'
135-
uses: egor-tensin/setup-clang@v2.1
135+
uses: egor-tensin/setup-clang@471a6f8ef1d449dba8e1a51780e7f943572a3f99 # v2.1
136136
with:
137137
version: 21
138138

139139
- name: Ensure CMake 4.0
140-
uses: lukka/get-cmake@v4.2.3
140+
uses: lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375 # v4.2.3
141141

142142
- name: Import signing certificate to keychain
143143
if: runner.os == 'macOS'
144-
uses: Apple-Actions/import-codesign-certs@v6.0.0
144+
uses: Apple-Actions/import-codesign-certs@b610f78488812c1e56b20e6df63ec42d833f2d14 # v6.0.0
145145
with:
146146
p12-file-base64: ${{ secrets.CODESIGN_CERT_FILE_BASE64 }}
147147
p12-password: ${{ secrets.CODESIGN_CERT_PASSWORD }}
148148

149149
- name: Checkout code
150-
uses: actions/checkout@v6
150+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
151151
with:
152152
ref: ${{ needs.bump_version.outputs.tag_name }}
153153

@@ -164,7 +164,7 @@ jobs:
164164
cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.DEPLOY_DIR }} --component ben_bot --config Release
165165
166166
- name: Upload artifact
167-
uses: actions/upload-artifact@v7
167+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
168168
with:
169169
name: BenBot-${{ matrix.os }}-${{ matrix.preset }}
170170
path: ${{ env.DEPLOY_DIR }}
@@ -197,7 +197,7 @@ jobs:
197197

198198
steps:
199199
- name: Checkout code
200-
uses: actions/checkout@v6
200+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
201201
with:
202202
ref: ${{ needs.bump_version.outputs.tag_name }}
203203

@@ -207,7 +207,7 @@ jobs:
207207

208208
- name: Download artifacts
209209
id: download
210-
uses: actions/download-artifact@v8
210+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
211211
with:
212212
path: artifacts
213213

@@ -216,7 +216,7 @@ jobs:
216216
working-directory: .github/scripts
217217

218218
- name: Create release
219-
uses: softprops/action-gh-release@v2
219+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
220220
with:
221221
tag_name: ${{ needs.bump_version.outputs.tag_name }}
222222
files: ${{ env.REZIPPED_ARTIFACTS }}/**
@@ -243,13 +243,13 @@ jobs:
243243

244244
steps:
245245
- name: Login to Docker
246-
uses: docker/login-action@v4
246+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
247247
with:
248248
username: benvining
249249
password: ${{ secrets.DOCKERHUB_TOKEN }}
250250

251251
- name: Checkout code
252-
uses: actions/checkout@v6
252+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
253253
with:
254254
ref: ${{ needs.bump_version.outputs.tag_name }}
255255

@@ -288,7 +288,7 @@ jobs:
288288

289289
steps:
290290
- name: Update & restart Docker image
291-
uses: appleboy/ssh-action@v1
291+
uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1
292292
with:
293293
host: ${{ secrets.VPS_IP_V4 }}
294294
username: root

0 commit comments

Comments
 (0)