Skip to content

Commit 503eef1

Browse files
agilgur5agilgur5
committed
ci: pin all GH Actions (argoproj#12619)
Signed-off-by: Anton Gilgur <[email protected]> (cherry picked from commit 6ba7401)
1 parent b2b1ecd commit 503eef1

File tree

8 files changed

+61
-56
lines changed

8 files changed

+61
-56
lines changed

‎.github/workflows/changelog.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@ jobs:
1818
pull-requests: write # for peter-evans/create-pull-request to create a PR
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2222
with:
2323
ref: main
2424
fetch-depth: 0
2525
- run: git fetch --prune --prune-tags
2626
- run: git tag -l 'v*'
2727
# avoid invoking `make` to reduce the risk of a Makefile bug failing this workflow
2828
- run: ./hack/changelog.sh > CHANGELOG.md
29-
- uses: peter-evans/create-pull-request@v5
29+
- uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
3030
with:
3131
title: 'docs: updated CHANGELOG.md'
3232
commit-message: 'docs: updated CHANGELOG.md'

‎.github/workflows/ci-build.yaml‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,12 @@ jobs:
2828
ui: ${{ steps.changed-files.outputs.ui_any_modified == 'true' }}
2929
runs-on: ubuntu-latest
3030
steps:
31-
- uses: actions/checkout@v4
31+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3232
with:
3333
fetch-depth: 50 # assume PRs are less than 50 commits
3434
- name: Get relevant files changed per group
3535
id: changed-files
36-
uses: tj-actions/changed-files@v41
36+
uses: tj-actions/changed-files@cbda684547adc8c052d50711417fa61b428a9f88 # v41.1.2
3737
with:
3838
files_yaml: |
3939
common: &common
@@ -89,6 +89,8 @@ jobs:
8989
- *tests
9090
# plus lint config
9191
- .golangci.yml
92+
# all GH workflows / actions
93+
- .github/workflows/**
9294
# docs files below
9395
- docs/**
9496
# generated files are covered by codegen
@@ -112,8 +114,8 @@ jobs:
112114
runs-on: ubuntu-latest
113115
timeout-minutes: 10
114116
steps:
115-
- uses: actions/checkout@v4
116-
- uses: actions/setup-go@v5
117+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
118+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
117119
with:
118120
go-version: "1.21"
119121
cache: true
@@ -135,10 +137,10 @@ jobs:
135137
- image: argoexec
136138
- image: argocli
137139
steps:
138-
- uses: actions/checkout@v4
139-
- uses: docker/setup-buildx-action@v3
140+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
141+
- uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
140142
- name: Build and export
141-
uses: docker/build-push-action@v5
143+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
142144
with:
143145
context: .
144146
tags: quay.io/argoproj/${{matrix.image}}:latest
@@ -198,21 +200,21 @@ jobs:
198200
steps:
199201
- name: Install socat (needed by Kubernetes v1.25)
200202
run: sudo apt-get -y install socat
201-
- uses: actions/checkout@v4
202-
- uses: actions/setup-go@v5
203+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
204+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
203205
with:
204206
go-version: "1.21"
205207
cache: true
206208
- name: Install Java for the SDK
207209
if: ${{matrix.test == 'test-java-sdk'}}
208-
uses: actions/setup-java@v4
210+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
209211
with:
210212
java-version: '8'
211213
distribution: adopt
212214
cache: maven
213215
- name: Install Python for the SDK
214216
if: ${{matrix.test == 'test-python-sdk'}}
215-
uses: actions/setup-python@v5
217+
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
216218
with:
217219
python-version: '3.x'
218220
cache: pip
@@ -306,8 +308,8 @@ jobs:
306308
env:
307309
GOPATH: /home/runner/go
308310
steps:
309-
- uses: actions/checkout@v4
310-
- uses: actions/setup-go@v5
311+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
312+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
311313
with:
312314
go-version: "1.21"
313315
cache: true
@@ -342,15 +344,18 @@ jobs:
342344
env:
343345
GOPATH: /home/runner/go
344346
steps:
345-
- uses: actions/checkout@v4
346-
- uses: actions/setup-go@v5
347+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
348+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
347349
with:
348350
go-version: "1.21"
349351
cache: true
350352
- run: make lint STATIC_FILES=false
351353
# if lint makes changes that are not in the PR, fail the build
352354
- name: Check if lint made changes not present in the PR
353355
run: git diff --exit-code
356+
# lint GH Actions
357+
- name: Ensure GH Actions are pinned to SHAs
358+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ba37328d4ea95eaf8b3bd6c6cef308f709a5f2ec # v3.0.3
354359

355360
ui:
356361
name: UI
@@ -359,8 +364,8 @@ jobs:
359364
env:
360365
NODE_OPTIONS: --max-old-space-size=4096
361366
steps:
362-
- uses: actions/checkout@v4
363-
- uses: actions/setup-node@v4
367+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
368+
- uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
364369
with:
365370
node-version: "20" # change in all GH Workflows
366371
cache: yarn

‎.github/workflows/dependabot-reviewer.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
steps:
1616
- name: Dependabot metadata
1717
id: metadata
18-
uses: dependabot/[email protected]
18+
uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
1919
with:
2020
github-token: "${{ secrets.GITHUB_TOKEN }}"
2121
- name: Approve PR

‎.github/workflows/docs.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@ jobs:
2121
permissions:
2222
contents: write # for publishing the docs to GH Pages
2323
steps:
24-
- uses: actions/checkout@v4
25-
- uses: actions/setup-python@v5
24+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
25+
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
2626
with:
2727
python-version: 3.9
28-
- uses: actions/setup-go@v5
28+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
2929
with:
3030
go-version: '1.21'
31-
- uses: actions/setup-node@v4
31+
- uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
3232
with:
3333
node-version: "19"
3434
# Use the same make target both locally and on CI to make it easier to debug failures.
@@ -39,7 +39,7 @@ jobs:
3939
run: git diff --exit-code
4040
# Upload the site so reviewers see it.
4141
- name: Upload Docs Site
42-
uses: actions/upload-artifact@v4
42+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
4343
with:
4444
name: docs
4545
path: site

‎.github/workflows/pr.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: Check PR Title's semantic conformance
19-
uses: amannn/action-semantic-pull-request@v5
19+
uses: amannn/action-semantic-pull-request@e9fabac35e210fea40ca5b14c0da95a099eff26f # v5.4.0
2020
env:
2121
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yaml‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,18 @@ jobs:
2929
platform: [ linux/amd64, linux/arm64 ]
3030
target: [ workflow-controller, argocli, argoexec ]
3131
steps:
32-
- uses: actions/checkout@v4
32+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3333

3434
- name: Set up QEMU
35-
uses: docker/setup-qemu-action@v3
35+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
3636

3737
- name: Set up Docker Buildx
38-
uses: docker/setup-buildx-action@v3
38+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
3939
with:
4040
version: v0.10.4
4141

4242
- name: Cache Docker layers
43-
uses: actions/cache@v3
43+
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
4444
id: cache
4545
with:
4646
path: /tmp/.buildx-cache
@@ -49,13 +49,13 @@ jobs:
4949
${{ runner.os }}-${{ matrix.platform }}-${{ matrix.target }}-buildx-
5050
5151
- name: Docker Login
52-
uses: docker/login-action@v3
52+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
5353
with:
5454
username: ${{ secrets.DOCKERIO_USERNAME }}
5555
password: ${{ secrets.DOCKERIO_PASSWORD }}
5656

57-
- name: Docker Login
58-
uses: docker/login-action@v3
57+
- name: Login to Quay
58+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
5959
with:
6060
registry: quay.io
6161
username: ${{ secrets.QUAYIO_USERNAME }}
@@ -97,15 +97,15 @@ jobs:
9797
if: github.repository == 'argoproj/argo-workflows'
9898
runs-on: windows-2022
9999
steps:
100-
- uses: actions/checkout@v4
100+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
101101
- name: Docker Login
102-
uses: Azure/docker-login@v1
102+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
103103
with:
104104
username: ${{ secrets.DOCKERIO_USERNAME }}
105105
password: ${{ secrets.DOCKERIO_PASSWORD }}
106106

107107
- name: Login to Quay
108-
uses: Azure/docker-login@v1
108+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
109109
with:
110110
login-server: quay.io
111111
username: ${{ secrets.QUAYIO_USERNAME }}
@@ -147,22 +147,22 @@ jobs:
147147
runs-on: ubuntu-latest
148148
needs: [ build-linux, build-windows ]
149149
steps:
150-
- uses: actions/checkout@v4
150+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
151151
- name: Docker Login
152-
uses: Azure/docker-login@v1
152+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
153153
with:
154154
username: ${{ secrets.DOCKERIO_USERNAME }}
155155
password: ${{ secrets.DOCKERIO_PASSWORD }}
156156

157157
- name: Login to Quay
158-
uses: Azure/docker-login@v1
158+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
159159
with:
160160
login-server: quay.io
161161
username: ${{ secrets.QUAYIO_USERNAME }}
162162
password: ${{ secrets.QUAYIO_PASSWORD }}
163163

164164
- name: Install cosign
165-
uses: sigstore/cosign-installer@main
165+
uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
166166
with:
167167
cosign-release: 'v2.2.3'
168168

@@ -211,13 +211,13 @@ jobs:
211211
target: [ workflow-controller, argocli, argoexec ]
212212
steps:
213213
- name: Docker Login
214-
uses: Azure/docker-login@v1
214+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
215215
with:
216216
username: ${{ secrets.DOCKERIO_USERNAME }}
217217
password: ${{ secrets.DOCKERIO_PASSWORD }}
218218

219219
- name: Login to Quay
220-
uses: Azure/docker-login@v1
220+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
221221
with:
222222
login-server: quay.io
223223
username: ${{ secrets.QUAYIO_USERNAME }}
@@ -245,13 +245,13 @@ jobs:
245245
needs: [ push-images ]
246246
steps:
247247
- name: Docker Login
248-
uses: Azure/docker-login@v1
248+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
249249
with:
250250
username: ${{ secrets.DOCKERIO_USERNAME }}
251251
password: ${{ secrets.DOCKERIO_PASSWORD }}
252252

253253
- name: Login to Quay
254-
uses: Azure/docker-login@v1
254+
uses: Azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1
255255
with:
256256
login-server: quay.io
257257
username: ${{ secrets.QUAYIO_USERNAME }}
@@ -284,20 +284,20 @@ jobs:
284284
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
285285
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
286286
steps:
287-
- uses: actions/checkout@v4
288-
- uses: actions/setup-node@v4
287+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
288+
- uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
289289
with:
290290
node-version: "20" # change in all GH Workflows
291-
- uses: actions/setup-go@v5
291+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
292292
with:
293293
go-version: "1.21"
294294
- name: Restore node packages cache
295-
uses: actions/cache@v3
295+
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
296296
with:
297297
path: ui/node_modules
298298
key: ${{ runner.os }}-node-dep-v1-${{ hashFiles('**/yarn.lock') }}
299299
- name: Install cosign
300-
uses: sigstore/cosign-installer@main
300+
uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
301301
with:
302302
cosign-release: 'v2.2.3'
303303
# https://stackoverflow.com/questions/58033366/how-to-get-current-branch-within-github-actions
@@ -340,7 +340,7 @@ jobs:
340340
# If a conflict occurs (because you are not on a tag), the release will not be updated. This is a short coming
341341
# of this action.
342342
# Instead, delete the release so it is re-created.
343-
- uses: softprops/action-gh-release@v1
343+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
344344
if: startsWith(github.ref, 'refs/tags/v')
345345
with:
346346
prerelease: ${{ startsWith(github.ref, 'refs/tags/v0') || contains(github.ref, 'rc') }}

‎.github/workflows/sdks.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
- java
2222
- python
2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2525
- run: make --directory sdks/${{matrix.name}} publish -B
2626
env:
2727
JAVA_SDK_MAVEN_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/snyk.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ jobs:
2020
env:
2121
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
2222
steps:
23-
- uses: actions/checkout@v4
23+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2424
- name: Run Snyk to check for Go vulnerabilities
25-
uses: snyk/actions/golang@master
25+
uses: snyk/actions/golang@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
2626
with:
2727
args: --severity-threshold=high
2828

@@ -33,15 +33,15 @@ jobs:
3333
env:
3434
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
3535
steps:
36-
- uses: actions/checkout@v4
37-
- uses: actions/setup-node@v4
36+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
37+
- uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
3838
with:
3939
node-version: "20" # change in all GH Workflows
4040
cache: yarn
4141
cache-dependency-path: ui/yarn.lock
4242
- run: yarn --cwd ui install
4343
- name: Run Snyk to check for Node vulnerabilities
44-
uses: snyk/actions/node@master
44+
uses: snyk/actions/node@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
4545
with:
4646
args: --file=ui/package.json --severity-threshold=high
4747

0 commit comments

Comments
 (0)