Skip to content

Commit c0d31ee

Browse files
slawomirbabiczslawomirbabicz
authored
chore: pin GitHub Actions to commit SHAs (#1968)
1 parent 9407f7b commit c0d31ee

12 files changed

+32
-32
lines changed

‎.github/workflows/build-runner.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Check out the repo
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2929

3030
- name: "🔧 Login to GitHub Container Registry"
31-
uses: docker/login-action@v3
31+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
3232
with:
3333
registry: ghcr.io
3434
username: ${{ github.actor }}

‎.github/workflows/clean-bazel-caches.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ jobs:
1818
matrix:
1919
runner: [1, 2, 3, 4] # We currently have 4 runners, adjust this number if more runners are added
2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2222
with:
2323
fetch-depth: 1
2424

2525
- name: "☁️ Setup bazelisk"
26-
uses: bazelbuild/setup-bazelisk@v3
26+
uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2 # v3
2727

2828
- name: Clean Bazel Cache
2929
run: |

‎.github/workflows/dashboard.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@ jobs:
2121
build:
2222
runs-on: ubuntu-22.04
2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2525
- name: "🚀 Building"
2626
run: |
2727
docker build -t ghcr.io/dfinity/dre/ic-management-frontend:$GITHUB_SHA -f dashboard/Dockerfile dashboard
2828
2929
- name: "🔧 Login to GitHub Container Registry"
30-
uses: docker/login-action@v3
30+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
3131
with:
3232
registry: ghcr.io
3333
username: ${{ github.actor }}

‎.github/workflows/dre-release.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
labels: dre-runner-custom
1515
container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
1616
steps:
17-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1818

1919
- name: "☁️ Setup runner"
2020
uses: ./.github/workflows/manage-runner-pre
@@ -31,7 +31,7 @@ jobs:
3131
needs: [test]
3232
runs-on: macos-14
3333
steps:
34-
- uses: actions/checkout@v4
34+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3535
with:
3636
fetch-depth: 0
3737

@@ -54,7 +54,7 @@ jobs:
5454
echo "toolchain=$ver" >> "$GITHUB_OUTPUT"
5555
5656
- name: Set up Rust toolchain
57-
uses: dtolnay/rust-toolchain@master
57+
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
5858
with:
5959
toolchain: ${{ steps.rust.outputs.toolchain }}
6060

@@ -79,7 +79,7 @@ jobs:
7979
cargo build --release -p dre --target aarch64-apple-darwin
8080
8181
- name: Upload macOS aarch64 artifact
82-
uses: actions/upload-artifact@v4
82+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8383
with:
8484
name: dre-aarch64-apple-darwin
8585
path: target/aarch64-apple-darwin/release/dre
@@ -97,7 +97,7 @@ jobs:
9797
cargo build --release -p dre --target x86_64-apple-darwin
9898
9999
- name: Upload macOS x86_64 artifact
100-
uses: actions/upload-artifact@v4
100+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
101101
with:
102102
name: dre-x86_64-apple-darwin
103103
path: target/x86_64-apple-darwin/release/dre
@@ -113,7 +113,7 @@ jobs:
113113
packages: write
114114
pages: write
115115
steps:
116-
- uses: actions/checkout@v4
116+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
117117
with:
118118
fetch-tags: true
119119
fetch-depth: 0
@@ -125,7 +125,7 @@ jobs:
125125
# If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
126126
# https://github.com/orgs/community/discussions/25702
127127
- name: Create GitHub App Token
128-
uses: actions/create-github-app-token@v2
128+
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
129129
id: app-token
130130
with:
131131
app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
@@ -158,7 +158,7 @@ jobs:
158158
cp --dereference bazel-out/k8-opt/bin/rs/cli/dre release/artifacts/dre-x86_64-unknown-linux
159159
160160
- name: Download macOS x86_64 artifact
161-
uses: actions/download-artifact@v4
161+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
162162
with:
163163
name: dre-x86_64-apple-darwin
164164
path: release/artifacts/
@@ -168,7 +168,7 @@ jobs:
168168
run: mv release/artifacts/dre release/artifacts/dre-x86_64-apple-darwin
169169

170170
- name: Download macOS aarch64 artifact
171-
uses: actions/download-artifact@v4
171+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
172172
with:
173173
name: dre-aarch64-apple-darwin
174174
path: release/artifacts/
@@ -202,7 +202,7 @@ jobs:
202202
rm -rf release
203203
204204
- name: "🆕 Create a new Pull Request with the changes"
205-
uses: peter-evans/create-pull-request@v7
205+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
206206
with:
207207
commit-message: "chore(release): New release of `dre` version ${{ steps.tag.outputs.tag }}"
208208
branch: bot-release-${{ steps.tag.outputs.tag }}

‎.github/workflows/main.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,15 @@ jobs:
3737
packages: write
3838
pages: write
3939
steps:
40-
- uses: actions/checkout@v4
40+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4141
with:
4242
fetch-depth: 2
4343

4444
# The GitHub App token is necessary for pushing changed files back to the repository
4545
# If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
4646
# https://github.com/orgs/community/discussions/25702
4747
- name: Create GitHub App Token
48-
uses: actions/create-github-app-token@v2
48+
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
4949
id: app-token
5050
with:
5151
app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
@@ -85,7 +85,7 @@ jobs:
8585

8686
- name: "🧪 Upload test artifacts"
8787
if: ${{ github.ref == 'refs/heads/main' }}
88-
uses: actions/upload-artifact@v4
88+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8989
with:
9090
name: test-artifacts
9191
path: bazel-out/k8-opt/bin/rs/ic-observability/multiservice-discovery/multiservice-discovery

‎.github/workflows/msd-diff.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ jobs:
1919
# This image is based on ubuntu:20.04
2020
container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
2121
steps:
22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2323
with:
2424
ref: ${{ github.event.pull_request.head.ref }}
2525

2626
- name: "🔧 Setup runner"
2727
uses: ./.github/workflows/manage-runner-pre
2828

2929
- name: "📥 Download main test artifact"
30-
uses: dawidd6/action-download-artifact@v11
30+
uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
3131
with:
3232
name: test-artifacts
3333
branch: main

‎.github/workflows/pull-request-update.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ jobs:
1010
runs-on: ubuntu-22.04
1111
steps:
1212
- name: Create GitHub App Token
13-
uses: actions/create-github-app-token@v2
13+
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
1414
id: app-token
1515
with:
1616
app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
1717
private-key: ${{ secrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY }}
18-
- uses: chinthakagodawita/autoupdate@v1.7.0
18+
- uses: chinthakagodawita/autoupdate@0707656cd062a3b0cf8fa9b2cda1d1404d74437e # v1.7.0
1919
env:
2020
GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"
2121
MERGE_MSG: "Branch was auto-updated."

‎.github/workflows/release-controller.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,15 @@ jobs:
4242
packages: write
4343
pages: write
4444
steps:
45-
- uses: actions/checkout@v4
45+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4646
with:
4747
fetch-depth: 2
4848

4949
# The GitHub App token is necessary for pushing changed files back to the repository
5050
# If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
5151
# https://github.com/orgs/community/discussions/25702
5252
- name: Create GitHub App Token
53-
uses: actions/create-github-app-token@v2
53+
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
5454
id: app-token
5555
with:
5656
app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}

‎.github/workflows/release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
2121
name: Check changed release index files
2222
steps:
23-
- uses: actions/checkout@v4
23+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2424
- name: Run checks for release index
2525
run: |
2626
rye sync

‎.github/workflows/required-checks.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Wait for running jobs
15-
uses: lewagon/wait-on-check-action@v1.3.4
15+
uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc # v1.3.4
1616
with:
1717
ref: ${{ github.ref }}
1818
running-workflow-name: Wait for required jobs to complete or be skipped

0 commit comments

Comments
 (0)