Skip to content

Commit ecb664f

Browse files
authored
Pin GitHub action references (#5508)
## Summary - Pin all GitHub action references to their commit SHAs - Each SHA maps to the current tag for the action at the time of pinning NO_CHANGELOG=true
1 parent ee0be18 commit ecb664f

File tree

8 files changed

+27
-27
lines changed

8 files changed

+27
-27
lines changed

.github/workflows/codeql-analysis.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,20 +24,20 @@ jobs:
2424

2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v4
27+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2828

2929
- name: Setup Go
30-
uses: actions/setup-go@v5
30+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
3131
with:
3232
go-version-file: go.mod
3333

3434
- name: Initialize CodeQL
35-
uses: github/codeql-action/init@v3
35+
uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
3636
with:
3737
languages: ${{ matrix.language }}
3838

3939
- name: Autobuild
40-
uses: github/codeql-action/autobuild@v3
40+
uses: github/codeql-action/autobuild@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
4141

4242
- name: Perform CodeQL Analysis
43-
uses: github/codeql-action/analyze@v3
43+
uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1

.github/workflows/integration-tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747

4848
- name: Generate GitHub App Token for Workflow Trigger
4949
id: generate-token
50-
uses: actions/create-github-app-token@v1
50+
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
5151
with:
5252
app-id: ${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }}
5353
private-key: ${{ secrets.DECO_WORKFLOW_TRIGGER_PRIVATE_KEY }}
@@ -85,7 +85,7 @@ jobs:
8585

8686
steps:
8787
- name: Auto-approve Check for Merge Queue
88-
uses: actions/github-script@v7
88+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
8989
with:
9090
script: |
9191
await github.rest.checks.create({

.github/workflows/next-changelog.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313

1414
steps:
1515
- name: Checkout code
16-
uses: actions/checkout@v3
16+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1717

1818
- name: Fetch list of changed files
1919
id: changed-files

.github/workflows/push.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ jobs:
1111
runs-on: ubuntu-latest
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@v4
14+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1515

1616
- name: Setup Go
17-
uses: actions/setup-go@v5
17+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
1818
with:
1919
go-version-file: go.mod
2020

@@ -25,7 +25,7 @@ jobs:
2525
run: make test
2626

2727
- name: Publish test coverage
28-
uses: codecov/codecov-action@v4
28+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
2929
env:
3030
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
3131

@@ -34,10 +34,10 @@ jobs:
3434

3535
steps:
3636
- name: Checkout
37-
uses: actions/checkout@v4
37+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3838

3939
- name: Setup Go
40-
uses: actions/setup-go@v5
40+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
4141
with:
4242
go-version-file: go.mod
4343

.github/workflows/release.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ jobs:
1515

1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1919
with:
2020
fetch-depth: 0
2121

2222
- name: Setup Go
23-
uses: actions/setup-go@v5
23+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
2424
with:
2525
go-version-file: go.mod
2626

@@ -33,7 +33,7 @@ jobs:
3333
3434
- name: Import GPG key
3535
id: import_gpg
36-
uses: crazy-max/ghaction-import-gpg@v2
36+
uses: crazy-max/ghaction-import-gpg@4c65c687307523ba52326ed829da04bc892ce413 # v2.3.0
3737
env:
3838
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
3939
PASSPHRASE: ${{ secrets.PASSPHRASE }}
@@ -53,7 +53,7 @@ jobs:
5353
fi
5454
5555
- name: Run GoReleaser
56-
uses: goreleaser/goreleaser-action@v6
56+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
5757
if: ${{ startsWith(github.ref, 'refs/tags/v') }}
5858
with:
5959
version: ~> v2
@@ -67,7 +67,7 @@ jobs:
6767
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
6868

6969
- name: Run GoReleaser (snapshot)
70-
uses: goreleaser/goreleaser-action@v6
70+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
7171
if: ${{ ! startsWith(github.ref , 'refs/tags/v') }}
7272
with:
7373
version: ~> v2

.github/workflows/schema.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,31 +24,31 @@ jobs:
2424
# uses the current commit as the head commit.
2525
- if: github.event_name == 'pull_request'
2626
name: Checkout PR base commit
27-
uses: actions/checkout@v4
27+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2828
with:
2929
ref: ${{ github.base_ref }}
3030
- if: github.event_name == 'pull_request'
3131
name: Checkout PR merge commit
32-
uses: actions/checkout@v4
32+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3333

3434
- if: github.event_name == 'workflow_dispatch'
3535
name: Checkout base commit
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3737
with:
3838
ref: ${{ github.event.inputs.base }}
3939
- if: github.event_name == 'workflow_dispatch'
4040
name: Checkout head commit
41-
uses: actions/checkout@v4
41+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4242
with:
4343
ref: ${{ github.event.inputs.head }}
4444

4545
- name: "Setup Go"
46-
uses: actions/setup-go@v5
46+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
4747
with:
4848
go-version-file: go.mod
4949

5050
- name: "Setup Terraform"
51-
uses: hashicorp/setup-terraform@v2
51+
uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
5252
with:
5353
terraform_wrapper: false
5454

.github/workflows/tagging.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,13 @@ jobs:
3535
steps:
3636
- name: Generate GitHub App Token
3737
id: generate-token
38-
uses: actions/create-github-app-token@v3
38+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
3939
with:
4040
app-id: ${{ secrets.DECO_SDK_TAGGING_APP_ID }}
4141
private-key: ${{ secrets.DECO_SDK_TAGGING_PRIVATE_KEY }}
4242

4343
- name: Checkout repository
44-
uses: actions/checkout@v4
44+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4545
with:
4646
fetch-depth: 0
4747
token: ${{ steps.generate-token.outputs.token }}

.github/workflows/validate-sha.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: Checkout
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1313

1414
- name: Validate SHA
1515
run: |

0 commit comments

Comments
 (0)