Skip to content

Commit 60a021d

Browse files
rlazorlazo
authored
[github actions] Pin actions to hash commits (#6784)
Tags can be modified to point to different commits, which is a security issue. By pinning to specific commits we ensure the code executing isn't changing.
1 parent af1fe93 commit 60a021d

32 files changed

+162
-162
lines changed

‎.github/workflows/api-information.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,18 @@ jobs:
77
if: github.event.pull_request.head.repo.full_name == github.repository
88
runs-on: ubuntu-latest
99
steps:
10-
- uses: actions/checkout@v4.1.1
10+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1111
with:
1212
fetch-depth: 2
1313
submodules: true
1414
- name: Set up JDK 17
15-
uses: actions/setup-java@v4.1.0
15+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1616
with:
1717
java-version: 17
1818
distribution: temurin
1919
cache: gradle
2020
- name: Set up Python 3.10
21-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
21+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
2222
with:
2323
python-version: '3.10'
2424
- name: Set up fireci

‎.github/workflows/build-release-artifacts.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212
env:
1313
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1414
steps:
15-
- uses: actions/checkout@v4.1.1
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616

1717
- name: Set up JDK 17
18-
uses: actions/setup-java@v4.1.0
18+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1919
with:
2020
java-version: 17
2121
distribution: temurin
@@ -26,21 +26,21 @@ jobs:
2626
./gradlew firebasePublish
2727
2828
- name: Upload m2 repo
29-
uses: actions/upload-artifact@v4.3.3
29+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
3030
with:
3131
name: m2repository
3232
path: build/m2repository/
3333
retention-days: 15
3434

3535
- name: Upload release notes
36-
uses: actions/upload-artifact@v4.3.3
36+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
3737
with:
3838
name: release_notes
3939
path: build/release-notes/
4040
retention-days: 15
4141

4242
- name: Upload kotlindocs
43-
uses: actions/upload-artifact@v4.3.3
43+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
4444
with:
4545
name: kotlindocs
4646
path: build/firebase-kotlindoc/

‎.github/workflows/changelog.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ jobs:
1313
env:
1414
BUNDLE_GEMFILE: ./ci/danger/Gemfile
1515
steps:
16-
- uses: actions/checkout@v4.1.1
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1717
with:
1818
fetch-depth: 100
1919
submodules: true
20-
- uses: ruby/setup-ruby@v1
20+
- uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f # v1.227.0
2121
with:
2222
ruby-version: '2.7'
2323
- name: Setup Bundler

‎.github/workflows/check-head-dependencies.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ jobs:
1010
check-head-dependencies:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v4.1.1
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1414
- name: Set up JDK 17
15-
uses: actions/setup-java@v4.1.0
15+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1616
with:
1717
java-version: 17
1818
distribution: temurin

‎.github/workflows/check-vertexai-responses.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
check-version:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: actions/checkout@v4
9+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1010
- name: Clone mock responses
1111
run: firebase-vertexai/update_responses.sh
1212
- name: Find cloned and latest versions
@@ -17,24 +17,24 @@ jobs:
1717
echo "latest_tag=$LATEST" >> $GITHUB_ENV
1818
working-directory: firebase-vertexai/src/test/resources/vertexai-sdk-test-data
1919
- name: Find comment from previous run if exists
20-
uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e
20+
uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
2121
id: fc
2222
with:
2323
issue-number: ${{github.event.number}}
2424
body-includes: Vertex AI Mock Responses Check
2525
- name: Comment on PR if newer version is available
2626
if: ${{env.cloned_tag != env.latest_tag && !steps.fc.outputs.comment-id}}
27-
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
27+
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
2828
with:
2929
issue-number: ${{github.event.number}}
3030
body: >
3131
### Vertex AI Mock Responses Check :warning:
32-
32+
3333
A newer major version of the mock responses for Vertex AI unit tests is available.
3434
[update_responses.sh](https://github.com/firebase/firebase-android-sdk/blob/main/firebase-vertexai/update_responses.sh)
3535
should be updated to clone the latest version of the responses: `${{env.latest_tag}}`
3636
- name: Delete comment when version gets updated
3737
if: ${{env.cloned_tag == env.latest_tag && steps.fc.outputs.comment-id}}
38-
uses: detomarco/delete-comment@850734dd44d8b15fef55b45252613b903ceb06f0
38+
uses: detomarco/delete-comment@dd37d1026c669ebfb0ffa5d23890010759ff05d5 # v1.1.0
3939
with:
4040
comment-id: ${{ steps.fc.outputs.comment-id }}

‎.github/workflows/check_format.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ jobs:
1616
outputs:
1717
modules: ${{ steps.changed-modules.outputs.modules }}
1818
steps:
19-
- uses: actions/checkout@v4.1.1
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020
with:
2121
fetch-depth: 2
2222
submodules: true
2323

2424
- name: Set up JDK 17
25-
uses: actions/setup-java@v4.1.0
25+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2626
with:
2727
java-version: 17
2828
distribution: temurin
@@ -44,13 +44,13 @@ jobs:
4444
module: ${{ fromJSON(needs.determine_changed.outputs.modules) }}
4545

4646
steps:
47-
- uses: actions/checkout@v4.1.1
47+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4848
with:
4949
fetch-depth: 2
5050
submodules: true
5151

5252
- name: Set up JDK 17
53-
uses: actions/setup-java@v4.1.0
53+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
5454
with:
5555
java-version: 17
5656
distribution: temurin

‎.github/workflows/ci_tests.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ jobs:
1616
outputs:
1717
modules: ${{ steps.changed-modules.outputs.modules }}
1818
steps:
19-
- uses: actions/checkout@v4.1.1
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020
with:
2121
fetch-depth: 2
2222
submodules: true
2323

2424
- name: Set up JDK 17
25-
uses: actions/setup-java@v4.1.0
25+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2626
with:
2727
java-version: 17
2828
distribution: temurin
@@ -44,13 +44,13 @@ jobs:
4444
module: ${{ fromJSON(needs.determine_changed.outputs.modules) }}
4545

4646
steps:
47-
- uses: actions/checkout@v4.1.1
47+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4848
with:
4949
fetch-depth: 2
5050
submodules: true
5151

5252
- name: Set up JDK 17
53-
uses: actions/setup-java@v4.1.0
53+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
5454
with:
5555
java-version: 17
5656
distribution: temurin
@@ -76,7 +76,7 @@ jobs:
7676
MODULE=${{matrix.module}}
7777
echo "ARTIFACT_NAME=${MODULE//:/_}" >> $GITHUB_ENV
7878
- name: Upload Test Results
79-
uses: actions/upload-artifact@v4.3.3
79+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
8080
if: always()
8181
with:
8282
name: unit-test-result-${{env.ARTIFACT_NAME}}
@@ -113,13 +113,13 @@ jobs:
113113
- module: :firebase-functions:ktx
114114

115115
steps:
116-
- uses: actions/checkout@v4.1.1
116+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117117
with:
118118
fetch-depth: 2
119119
submodules: true
120120

121121
- name: Set up JDK 17
122-
uses: actions/setup-java@v4.1.0
122+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
123123
with:
124124
java-version: 17
125125
distribution: temurin
@@ -130,10 +130,10 @@ jobs:
130130
INTEG_TESTS_GOOGLE_SERVICES: ${{ secrets.INTEG_TESTS_GOOGLE_SERVICES }}
131131
run: |
132132
echo $INTEG_TESTS_GOOGLE_SERVICES | base64 -d > google-services.json
133-
- uses: google-github-actions/auth@v2
133+
- uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
134134
with:
135135
credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT }}
136-
- uses: google-github-actions/setup-gcloud@v2
136+
- uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
137137
- name: ${{ matrix.module }} Integ Tests
138138
env:
139139
FIREBASE_CI: 1
@@ -159,11 +159,11 @@ jobs:
159159

160160
steps:
161161
- name: Download Artifacts
162-
uses: actions/download-artifact@v4.1.7
162+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
163163
with:
164164
path: artifacts
165165

166166
- name: Publish Test Results
167-
uses: EnricoMi/publish-unit-test-result-action@82082dac68ad6a19d980f8ce817e108b9f496c2a
167+
uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b # v2.18.0
168168
with:
169169
files: "artifacts/**/*.xml"

‎.github/workflows/config-e2e.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ jobs:
1818

1919
steps:
2020
- name: Checkout firebase-config
21-
uses: actions/checkout@v4.1.1
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2222

2323
- name: set up JDK 17
24-
uses: actions/setup-java@v4.1.0
24+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2525
with:
2626
java-version: '17'
2727
distribution: 'temurin'
@@ -31,10 +31,10 @@ jobs:
3131
run: |
3232
echo $REMOTE_CONFIG_E2E_GOOGLE_SERVICES | base64 -d > google-services.json
3333
34-
- uses: google-github-actions/auth@v2
34+
- uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
3535
with:
3636
credentials_json: ${{ secrets.GCP_service_account }}
37-
- uses: google-github-actions/setup-gcloud@v2
37+
- uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
3838
- name: Run Remote Config end-to-end tests
3939
env:
4040
FTL_RESULTS_BUCKET: fireescape

‎.github/workflows/copyright-check.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ jobs:
1010
copyright-check:
1111
runs-on: ubuntu-22.04
1212
steps:
13-
- uses: actions/checkout@v4.1.1
14-
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
14+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
1515
with:
1616
python-version: '3.9'
1717
- run: |

‎.github/workflows/create_releases.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ jobs:
3232
contents: write
3333
pull-requests: write
3434
steps:
35-
- uses: actions/checkout@v4.1.1
35+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636
with:
3737
fetch-depth: 0
3838
- name: Set up JDK 17
39-
uses: actions/setup-java@v4.1.0
39+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
4040
with:
4141
java-version: 17
4242
distribution: temurin
@@ -46,7 +46,7 @@ jobs:
4646
./gradlew generateReleaseConfig -PcurrentRelease=${{ inputs.name }} -PpastRelease=${{ inputs.past-name }} -PprintOutput=true
4747
4848
- name: Create Pull Request
49-
uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
49+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
5050
with:
5151
base: 'releases/${{ inputs.name }}'
5252
branch: 'releases/${{ inputs.name }}.release'

0 commit comments

Comments
 (0)