Skip to content

Commit 8fa902f

Browse files
rlazorlazo
committed
[github actions] Pin actions to hash commits
Tags can be modified to point to different commits, which is a security issue. By pinning to specific commits we ensure the code executing isn't changing.
1 parent 236df1f commit 8fa902f

31 files changed

+144
-144
lines changed

‎.github/workflows/api-information.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,18 @@ jobs:
77
if: github.event.pull_request.head.repo.full_name == github.repository
88
runs-on: ubuntu-latest
99
steps:
10-
- uses: actions/checkout@v4.1.1
10+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1111
with:
1212
fetch-depth: 2
1313
submodules: true
1414
- name: Set up JDK 17
15-
uses: actions/setup-java@v4.1.0
15+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1616
with:
1717
java-version: 17
1818
distribution: temurin
1919
cache: gradle
2020
- name: Set up Python 3.10
21-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
21+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
2222
with:
2323
python-version: '3.10'
2424
- name: Set up fireci

‎.github/workflows/build-release-artifacts.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212
env:
1313
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1414
steps:
15-
- uses: actions/checkout@v4.1.1
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616

1717
- name: Set up JDK 17
18-
uses: actions/setup-java@v4.1.0
18+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1919
with:
2020
java-version: 17
2121
distribution: temurin
@@ -26,21 +26,21 @@ jobs:
2626
./gradlew firebasePublish
2727
2828
- name: Upload m2 repo
29-
uses: actions/upload-artifact@v4.3.3
29+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
3030
with:
3131
name: m2repository
3232
path: build/m2repository/
3333
retention-days: 15
3434

3535
- name: Upload release notes
36-
uses: actions/upload-artifact@v4.3.3
36+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
3737
with:
3838
name: release_notes
3939
path: build/release-notes/
4040
retention-days: 15
4141

4242
- name: Upload kotlindocs
43-
uses: actions/upload-artifact@v4.3.3
43+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
4444
with:
4545
name: kotlindocs
4646
path: build/firebase-kotlindoc/

‎.github/workflows/changelog.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
env:
1414
BUNDLE_GEMFILE: ./ci/danger/Gemfile
1515
steps:
16-
- uses: actions/checkout@v4.1.1
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1717
with:
1818
fetch-depth: 100
1919
submodules: true

‎.github/workflows/check-head-dependencies.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ jobs:
1010
check-head-dependencies:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v4.1.1
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1414
- name: Set up JDK 17
15-
uses: actions/setup-java@v4.1.0
15+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1616
with:
1717
java-version: 17
1818
distribution: temurin

‎.github/workflows/check-vertexai-responses.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
check-version:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: actions/checkout@v4
9+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1010
- name: Clone mock responses
1111
run: firebase-vertexai/update_responses.sh
1212
- name: Find cloned and latest versions

‎.github/workflows/check_format.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ jobs:
1616
outputs:
1717
modules: ${{ steps.changed-modules.outputs.modules }}
1818
steps:
19-
- uses: actions/checkout@v4.1.1
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020
with:
2121
fetch-depth: 2
2222
submodules: true
2323

2424
- name: Set up JDK 17
25-
uses: actions/setup-java@v4.1.0
25+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2626
with:
2727
java-version: 17
2828
distribution: temurin
@@ -44,13 +44,13 @@ jobs:
4444
module: ${{ fromJSON(needs.determine_changed.outputs.modules) }}
4545

4646
steps:
47-
- uses: actions/checkout@v4.1.1
47+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4848
with:
4949
fetch-depth: 2
5050
submodules: true
5151

5252
- name: Set up JDK 17
53-
uses: actions/setup-java@v4.1.0
53+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
5454
with:
5555
java-version: 17
5656
distribution: temurin

‎.github/workflows/ci_tests.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ jobs:
1616
outputs:
1717
modules: ${{ steps.changed-modules.outputs.modules }}
1818
steps:
19-
- uses: actions/checkout@v4.1.1
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020
with:
2121
fetch-depth: 2
2222
submodules: true
2323

2424
- name: Set up JDK 17
25-
uses: actions/setup-java@v4.1.0
25+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2626
with:
2727
java-version: 17
2828
distribution: temurin
@@ -44,13 +44,13 @@ jobs:
4444
module: ${{ fromJSON(needs.determine_changed.outputs.modules) }}
4545

4646
steps:
47-
- uses: actions/checkout@v4.1.1
47+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4848
with:
4949
fetch-depth: 2
5050
submodules: true
5151

5252
- name: Set up JDK 17
53-
uses: actions/setup-java@v4.1.0
53+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
5454
with:
5555
java-version: 17
5656
distribution: temurin
@@ -76,7 +76,7 @@ jobs:
7676
MODULE=${{matrix.module}}
7777
echo "ARTIFACT_NAME=${MODULE//:/_}" >> $GITHUB_ENV
7878
- name: Upload Test Results
79-
uses: actions/upload-artifact@v4.3.3
79+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
8080
if: always()
8181
with:
8282
name: unit-test-result-${{env.ARTIFACT_NAME}}
@@ -113,13 +113,13 @@ jobs:
113113
- module: :firebase-functions:ktx
114114

115115
steps:
116-
- uses: actions/checkout@v4.1.1
116+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117117
with:
118118
fetch-depth: 2
119119
submodules: true
120120

121121
- name: Set up JDK 17
122-
uses: actions/setup-java@v4.1.0
122+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
123123
with:
124124
java-version: 17
125125
distribution: temurin
@@ -130,10 +130,10 @@ jobs:
130130
INTEG_TESTS_GOOGLE_SERVICES: ${{ secrets.INTEG_TESTS_GOOGLE_SERVICES }}
131131
run: |
132132
echo $INTEG_TESTS_GOOGLE_SERVICES | base64 -d > google-services.json
133-
- uses: google-github-actions/auth@v2
133+
- uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
134134
with:
135135
credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT }}
136-
- uses: google-github-actions/setup-gcloud@v2
136+
- uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
137137
- name: ${{ matrix.module }} Integ Tests
138138
env:
139139
FIREBASE_CI: 1
@@ -159,7 +159,7 @@ jobs:
159159

160160
steps:
161161
- name: Download Artifacts
162-
uses: actions/download-artifact@v4.1.7
162+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e #v4.2.1
163163
with:
164164
path: artifacts
165165

‎.github/workflows/config-e2e.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ jobs:
1818

1919
steps:
2020
- name: Checkout firebase-config
21-
uses: actions/checkout@v4.1.1
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2222

2323
- name: set up JDK 17
24-
uses: actions/setup-java@v4.1.0
24+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2525
with:
2626
java-version: '17'
2727
distribution: 'temurin'
@@ -31,10 +31,10 @@ jobs:
3131
run: |
3232
echo $REMOTE_CONFIG_E2E_GOOGLE_SERVICES | base64 -d > google-services.json
3333
34-
- uses: google-github-actions/auth@v2
34+
- uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
3535
with:
3636
credentials_json: ${{ secrets.GCP_service_account }}
37-
- uses: google-github-actions/setup-gcloud@v2
37+
- uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
3838
- name: Run Remote Config end-to-end tests
3939
env:
4040
FTL_RESULTS_BUCKET: fireescape

‎.github/workflows/copyright-check.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ jobs:
1010
copyright-check:
1111
runs-on: ubuntu-22.04
1212
steps:
13-
- uses: actions/checkout@v4.1.1
14-
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
14+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
1515
with:
1616
python-version: '3.9'
1717
- run: |

‎.github/workflows/create_releases.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ jobs:
3232
contents: write
3333
pull-requests: write
3434
steps:
35-
- uses: actions/checkout@v4.1.1
35+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636
with:
3737
fetch-depth: 0
3838
- name: Set up JDK 17
39-
uses: actions/setup-java@v4.1.0
39+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
4040
with:
4141
java-version: 17
4242
distribution: temurin

0 commit comments

Comments
 (0)