Skip to content

Commit 43108a0

Browse files
kruskallkruskall
authored
ci: pin actions to specific commits (elastic#16297)
replace mutable tag with commit hash to improve security and reproducibility
1 parent 160b98a commit 43108a0

26 files changed

+99
-99
lines changed

‎.github/workflows/add-to-docs-project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
"organization_projects": "write",
2323
"issues": "read"
2424
}
25-
- uses: octokit/[email protected]
25+
- uses: octokit/graphql-action@51bf543c240dcd14761320e2efc625dc32ec0d32 # v2.x
2626
id: add_to_project
2727
with:
2828
query: |

‎.github/workflows/add-to-project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
"organization_projects": "write",
2626
"issues": "read"
2727
}
28-
- uses: actions/[email protected]
28+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
2929
with:
3030
project-url: https://github.com/orgs/elastic/projects/1286
3131
github-token: ${{ steps.get_token.outputs.token }}

‎.github/workflows/benchmarks.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -88,13 +88,13 @@ jobs:
8888
GOBENCH_USERNAME: ${{ secrets.GOBENCH_USERNAME }}
8989
GOBENCH_HOST: ${{ secrets.GOBENCH_HOST }}
9090
steps:
91-
- uses: actions/checkout@v4
91+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
9292

93-
- uses: actions/setup-go@v5
93+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
9494
with:
9595
go-version-file: 'go.mod'
9696

97-
- uses: rlespinasse/github-slug-action@955b5ba4560860f8a633bd24190941f16016e42c
97+
- uses: rlespinasse/github-slug-action@955b5ba4560860f8a633bd24190941f16016e42c # 955b5ba4560860f8a633bd24190941f16016e42c
9898

9999
- name: Set up env
100100
run: |
@@ -132,9 +132,9 @@ jobs:
132132
username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
133133
password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
134134

135-
- uses: elastic/oblt-actions/google/auth@v1
135+
- uses: elastic/oblt-actions/google/auth@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
136136

137-
- uses: elastic/oblt-actions/aws/auth@v1
137+
- uses: elastic/oblt-actions/aws/auth@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
138138
with:
139139
role-duration-seconds: 21600 # 6 hours
140140

@@ -144,7 +144,7 @@ jobs:
144144
secrets: |-
145145
EC_API_KEY:elastic-observability/elastic-cloud-observability-team-pro-api-key
146146
147-
- uses: hashicorp/setup-terraform@v3
147+
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
148148
with:
149149
terraform_version: ~1.10.0
150150
terraform_wrapper: false
@@ -197,7 +197,7 @@ jobs:
197197
$PNG_REPORT_FILE
198198
199199
- name: Upload PNG
200-
uses: actions/upload-artifact@v4
200+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
201201
with:
202202
name: kibana-png-report
203203
path: ${{ env.WORKING_DIRECTORY }}/${{ env.PNG_REPORT_FILE }}
@@ -213,7 +213,7 @@ jobs:
213213
echo "png_report_url=https://elastic-apm-server-benchmark-reports.s3.amazonaws.com/${DEST_NAME}" >> "$GITHUB_OUTPUT"
214214
215215
- name: Upload benchmark result
216-
uses: actions/upload-artifact@v4
216+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
217217
with:
218218
name: benchmark-result
219219
path: ${{ env.WORKING_DIRECTORY }}/${{ env.BENCHMARK_RESULT }}
@@ -227,7 +227,7 @@ jobs:
227227
run: make cp-cpuprof
228228

229229
- name: Upload CPU profile
230-
uses: actions/upload-artifact@v4
230+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
231231
with:
232232
name: cpu-profile
233233
path: ${{ env.WORKING_DIRECTORY }}/${{ env.BENCHMARK_CPU_OUT }}
@@ -249,7 +249,7 @@ jobs:
249249
# GitHub bot won't trigger any CI builds.
250250
# See https://github.com/peter-evans/create-pull-request/issues/48#issuecomment-537478081
251251
- name: Configure git user
252-
uses: elastic/oblt-actions/git/setup@v1
252+
uses: elastic/oblt-actions/git/setup@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
253253
with:
254254
github-token: ${{ steps.get_token.outputs.token }}
255255

@@ -287,7 +287,7 @@ jobs:
287287

288288
# Notify failure to Slack only on schedule (nightly run)
289289
- if: failure() && github.event_name == 'schedule'
290-
uses: elastic/oblt-actions/slack/notify-result@v1
290+
uses: elastic/oblt-actions/slack/notify-result@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
291291
with:
292292
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
293293
channel-id: "#apm-server"

‎.github/workflows/bump-elastic-stack.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
matrix: ${{ steps.generator.outputs.matrix }}
1818
steps:
1919
- id: generator
20-
uses: elastic/oblt-actions/elastic/active-branches@v1
20+
uses: elastic/oblt-actions/elastic/active-branches@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2121

2222
bump-elastic-stack:
2323
runs-on: ubuntu-latest
@@ -26,7 +26,7 @@ jobs:
2626
fail-fast: false
2727
matrix: ${{ fromJson(needs.filter.outputs.matrix) }}
2828
steps:
29-
- uses: actions/checkout@v4
29+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3030
with:
3131
ref: ${{ matrix.branch }}
3232

@@ -42,15 +42,15 @@ jobs:
4242
"pull_requests": "write"
4343
}
4444
45-
- uses: elastic/oblt-actions/updatecli/run@v1
45+
- uses: elastic/oblt-actions/updatecli/run@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
4646
with:
4747
command: --experimental apply --config .ci/updatecli/bump-elastic-stack-snapshot.yml --values .ci/updatecli/values.d/scm.yml
4848
env:
4949
BRANCH: ${{ matrix.branch }}
5050
GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
5151

5252
- if: ${{ failure() }}
53-
uses: elastic/oblt-actions/slack/send@v1
53+
uses: elastic/oblt-actions/slack/send@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
5454
with:
5555
channel-id: '#apm-server'
5656
message: ":traffic_cone: updatecli failed for `${{ github.repository }}@${{ github.ref_name }}`, @robots-ci please look what's going on <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|here>"

‎.github/workflows/bump-golang.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
steps:
2020
- id: generate
2121
name: Generate matrix
22-
uses: elastic/oblt-actions/elastic/active-branches@v1
22+
uses: elastic/oblt-actions/elastic/active-branches@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2323
with:
2424
exclude-branches: '7.17,main'
25-
- uses: actions/github-script@v7
25+
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
2626
id: labels
2727
env:
2828
BRANCHES: ${{ steps.generate.outputs.branches }}
@@ -39,7 +39,7 @@ jobs:
3939
needs: [labels]
4040
steps:
4141

42-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4343

4444
- name: Get token
4545
id: get_token
@@ -53,7 +53,7 @@ jobs:
5353
"pull_requests": "write"
5454
}
5555
56-
- uses: elastic/oblt-actions/updatecli/run@v1
56+
- uses: elastic/oblt-actions/updatecli/run@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
5757
with:
5858
command: --experimental apply --config .ci/updatecli/bump-golang.yml --values .ci/updatecli/values.d/scm.yml
5959
env:
@@ -64,11 +64,11 @@ jobs:
6464
bump-7:
6565
runs-on: ubuntu-latest
6666
steps:
67-
- uses: actions/checkout@v4
67+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
6868
with:
6969
ref: '7.17'
7070

71-
- uses: elastic/oblt-actions/updatecli/run@v1
71+
- uses: elastic/oblt-actions/updatecli/run@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
7272
with:
7373
command: --experimental apply --config .ci/updatecli/bump-golang.yml --values .ci/updatecli/values.d/scm.yml
7474
env:
@@ -82,11 +82,11 @@ jobs:
8282
if: always()
8383
steps:
8484
- id: check
85-
uses: elastic/oblt-actions/check-dependent-jobs@v1
85+
uses: elastic/oblt-actions/check-dependent-jobs@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
8686
with:
8787
jobs: ${{ toJSON(needs) }}
8888
- if: ${{ steps.check.outputs.isSuccess == 'false' }}
89-
uses: elastic/oblt-actions/slack/send@v1
89+
uses: elastic/oblt-actions/slack/send@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
9090
with:
9191
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
9292
channel-id: "#apm-server"

‎.github/workflows/check-docker-compose.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
matrix: ${{ steps.generator.outputs.matrix }}
1818
steps:
1919
- id: generator
20-
uses: elastic/oblt-actions/elastic/active-branches@v1
20+
uses: elastic/oblt-actions/elastic/active-branches@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2121

2222
check-docker-compose:
2323
needs:
@@ -27,10 +27,10 @@ jobs:
2727
fail-fast: false
2828
matrix: ${{ fromJson(needs.filter.outputs.matrix) }}
2929
steps:
30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3131
with:
3232
ref: ${{ matrix.branch }}
33-
- uses: actions/setup-go@v5
33+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
3434
with:
3535
go-version-file: go.mod
3636
cache: false
@@ -44,12 +44,12 @@ jobs:
4444
- check-docker-compose
4545
steps:
4646
- id: check
47-
uses: elastic/oblt-actions/check-dependent-jobs@v1
47+
uses: elastic/oblt-actions/check-dependent-jobs@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
4848
with:
4949
jobs: ${{ toJSON(needs) }}
5050
- run: ${{ steps.check.outputs.isSuccess }}
5151
- if: failure()
52-
uses: elastic/oblt-actions/slack/notify-result@v1
52+
uses: elastic/oblt-actions/slack/notify-result@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
5353
with:
5454
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
5555
channel-id: "#apm-server"

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ jobs:
2828
lint:
2929
runs-on: ubuntu-latest
3030
steps:
31-
- uses: actions/checkout@v4
32-
- uses: actions/setup-go@v5
31+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
32+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
3333
with:
3434
go-version-file: go.mod
3535
cache: true
@@ -43,13 +43,13 @@ jobs:
4343
os: ['macos-latest', 'ubuntu-latest', 'windows-latest']
4444
runs-on: ${{ matrix.os }}
4545
steps:
46-
- uses: actions/checkout@v4
47-
- uses: antontroshin/setup-go@bda02de8887c9946189f81e7e59512914aeb9ea4
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
47+
- uses: antontroshin/setup-go@bda02de8887c9946189f81e7e59512914aeb9ea4 # bda02de8887c9946189f81e7e59512914aeb9ea4
4848
if: runner.os == 'Windows'
4949
with:
5050
go-version-file: go.mod
5151
cache: true
52-
- uses: actions/setup-go@v5
52+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
5353
if: runner.os != 'Windows'
5454
with:
5555
go-version-file: go.mod
@@ -65,8 +65,8 @@ jobs:
6565
test-fips:
6666
runs-on: ubuntu-latest
6767
steps:
68-
- uses: actions/checkout@v4
69-
- uses: actions/setup-go@v5
68+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
69+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
7070
with:
7171
go-version-file: go.mod
7272
cache: true
@@ -78,8 +78,8 @@ jobs:
7878
system-test:
7979
runs-on: ubuntu-latest
8080
steps:
81-
- uses: actions/checkout@v4
82-
- uses: actions/setup-go@v5
81+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
82+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
8383
with:
8484
go-version-file: systemtest/go.mod
8585
cache: true
@@ -95,8 +95,8 @@ jobs:
9595
test-package:
9696
runs-on: ubuntu-latest
9797
steps:
98-
- uses: actions/checkout@v4
99-
- uses: actions/setup-go@v5
98+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
99+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
100100
with:
101101
go-version-file: go.mod
102102
cache: false
@@ -113,8 +113,8 @@ jobs:
113113
env:
114114
GENERATE_WOLFI_IMAGES: true
115115
steps:
116-
- uses: actions/checkout@v4
117-
- uses: actions/setup-go@v5
116+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
117+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
118118
with:
119119
go-version-file: go.mod
120120
cache: false

‎.github/workflows/docs-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ on:
99

1010
jobs:
1111
docs-preview:
12-
uses: elastic/docs-builder/.github/workflows/preview-build.yml@main
12+
uses: elastic/docs-builder/.github/workflows/preview-build.yml@d20bc8650b8ea27a58ee6d17ed963659e878f993 # main
1313
with:
1414
path-pattern: docs/**
1515
permissions:

‎.github/workflows/docs-cleanup.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77

88
jobs:
99
docs-preview:
10-
uses: elastic/docs-builder/.github/workflows/preview-cleanup.yml@main
10+
uses: elastic/docs-builder/.github/workflows/preview-cleanup.yml@d20bc8650b8ea27a58ee6d17ed963659e878f993 # main
1111
permissions:
1212
contents: none
1313
id-token: write

‎.github/workflows/functional-tests.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,17 +29,17 @@ jobs:
2929
- 'qa'
3030
- 'pro'
3131
steps:
32-
- uses: actions/checkout@v4
32+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3333

3434
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
3535
with:
3636
terraform_version: "${{ env.TERRAFORM_VERSION }}"
3737

38-
- uses: actions/setup-go@v5
38+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
3939
with:
4040
go-version-file: 'functionaltests/go.mod'
4141

42-
- uses: elastic/oblt-actions/google/auth@v1
42+
- uses: elastic/oblt-actions/google/auth@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
4343

4444
- uses: google-github-actions/get-secretmanager-secrets@a8440875e1c2892062aef9061228d4f1af8f919b # v2.2.3
4545
with:

0 commit comments

Comments
 (0)