Skip to content

Commit b3d9b2f

Browse files
alexsohn1126alexsohn1126
authored
chore: Pin GitHub Actions to commit SHA (#4562)
Pin GitHub Actions to commit SHA for security reasons, as well as consistency and reproducibility.
1 parent ad849d4 commit b3d9b2f

File tree

13 files changed

+58
-58
lines changed

13 files changed

+58
-58
lines changed

‎.github/actions/buildnative/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ runs:
1414
echo "JAVA_HOME_11=$JAVA_HOME_11_X64" >> $GITHUB_ENV
1515
fi
1616
17-
- uses: actions/cache@v3
17+
- uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
1818
id: cache-c
1919
with:
2020
path: lib/sentrysupplemental/bin
@@ -35,7 +35,7 @@ runs:
3535
shell: cmd
3636
run: lib\sentrysupplemental\build.cmd
3737

38-
- uses: actions/cache@v3
38+
- uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
3939
id: cache-android
4040
with:
4141
path: lib/sentry-android-supplemental/bin

‎.github/actions/environment/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ runs:
5252
# Java 17 is needed for Android SDK setup step
5353
- name: Install Java 17
5454
if: ${{ !matrix.container }}
55-
uses: actions/setup-java@v4
55+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
5656
with:
5757
distribution: ${{ runner.os == 'Windows' && runner.arch == 'ARM64' && 'microsoft' || 'temurin' }}
5858
java-version: '17'
@@ -68,7 +68,7 @@ runs:
6868
# Java 11 is needed by .NET Android
6969
- name: Install Java 11
7070
if: ${{ !matrix.container }}
71-
uses: actions/setup-java@v4
71+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
7272
with:
7373
distribution: ${{ runner.os == 'Windows' && runner.arch == 'ARM64' && 'microsoft' || 'temurin' }}
7474
java-version: '11'
@@ -91,7 +91,7 @@ runs:
9191
sudo chmod -R a+rw /usr/share/dotnet
9292
9393
- name: Install .NET SDK
94-
uses: actions/setup-dotnet@v4
94+
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
9595
with:
9696
global-json-file: global.json
9797
dotnet-version: 8.0.x

‎.github/actions/freediskspace/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ runs:
66

77
- name: Free Disk Space
88
if: runner.os == 'Linux'
9-
uses: jlumbroso/free-disk-space@f68fdb76e2ea636224182cfb7377ff9a1708f9b8
9+
uses: jlumbroso/free-disk-space@f68fdb76e2ea636224182cfb7377ff9a1708f9b8 # v1.3.0
1010
with:
1111
android: false
1212
dotnet: false

‎.github/workflows/alpine.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,18 @@ jobs:
2323
packages: write
2424

2525
steps:
26-
- uses: actions/checkout@v5
26+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2727

28-
- uses: docker/login-action@v3
28+
- uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
2929
with:
3030
registry: ghcr.io
3131
username: ${{ github.actor }}
3232
password: ${{ secrets.GITHUB_TOKEN }}
3333

34-
- uses: docker/setup-qemu-action@v3
35-
- uses: docker/setup-buildx-action@v3
34+
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
35+
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
3636

37-
- uses: docker/build-push-action@v6
37+
- uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
3838
with:
3939
push: true
4040
platforms: linux/amd64,linux/arm64

‎.github/workflows/build.yml‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
curl -sSL https://raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/.github/alpine/setup-node.sh | sudo bash /dev/stdin
4949
5050
- name: Checkout
51-
uses: actions/checkout@v5
51+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5252

5353
- run: git submodule update --init modules/sentry-native
5454

@@ -57,8 +57,8 @@ jobs:
5757
- name: Install zstd on Windows ARM64
5858
uses: ./.github/actions/install-zstd
5959

60-
- uses: actions/cache@v4
61-
id: cache
60+
- id: cache
61+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
6262
with:
6363
path: src/Sentry/Platforms/Native/sentry-native
6464
key: sentry-native-${{ matrix.rid }}-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
@@ -118,10 +118,10 @@ jobs:
118118
119119
- name: Cancel Previous Runs
120120
if: github.ref_name != 'main' && !startsWith(github.ref_name, 'release/')
121-
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # Tag: 0.12.1
121+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
122122

123123
- name: Checkout
124-
uses: actions/checkout@v5
124+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
125125
with:
126126
submodules: recursive
127127
fetch-depth: 2 # default is 1 and codecov needs > 1
@@ -140,47 +140,47 @@ jobs:
140140

141141
- name: Download sentry-native (linux-x64)
142142
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'linux-x64') }}
143-
uses: actions/cache/restore@v4
143+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
144144
with:
145145
path: src/Sentry/Platforms/Native/sentry-native
146146
key: sentry-native-linux-x64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
147147
fail-on-cache-miss: true
148148

149149
- name: Download sentry-native (linux-arm64)
150150
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'linux-arm64') }}
151-
uses: actions/cache/restore@v4
151+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
152152
with:
153153
path: src/Sentry/Platforms/Native/sentry-native
154154
key: sentry-native-linux-arm64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
155155
fail-on-cache-miss: true
156156

157157
- name: Download sentry-native (linux-musl-x64)
158158
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'linux-musl-x64') }}
159-
uses: actions/cache/restore@v4
159+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
160160
with:
161161
path: src/Sentry/Platforms/Native/sentry-native
162162
key: sentry-native-linux-musl-x64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
163163
fail-on-cache-miss: true
164164

165165
- name: Download sentry-native (linux-musl-arm64)
166166
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'linux-musl-arm64') }}
167-
uses: actions/cache/restore@v4
167+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
168168
with:
169169
path: src/Sentry/Platforms/Native/sentry-native
170170
key: sentry-native-linux-musl-arm64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
171171
fail-on-cache-miss: true
172172

173173
- name: Download sentry-native (macos)
174174
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'macos') }}
175-
uses: actions/cache/restore@v4
175+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
176176
with:
177177
path: src/Sentry/Platforms/Native/sentry-native
178178
key: sentry-native-macos-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
179179
fail-on-cache-miss: true
180180

181181
- name: Download sentry-native (win-x64)
182182
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'win-x64') }}
183-
uses: actions/cache/restore@v4
183+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
184184
with:
185185
path: src/Sentry/Platforms/Native/sentry-native
186186
key: sentry-native-win-x64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
@@ -189,7 +189,7 @@ jobs:
189189

190190
- name: Download sentry-native (win-arm64)
191191
if: ${{ (env.CI_PUBLISHING_BUILD == 'true') || (matrix.rid == 'win-arm64') }}
192-
uses: actions/cache/restore@v4
192+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
193193
with:
194194
path: src/Sentry/Platforms/Native/sentry-native
195195
key: sentry-native-win-arm64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
@@ -209,7 +209,7 @@ jobs:
209209

210210
- name: Upload build logs
211211
if: ${{ always() }}
212-
uses: actions/upload-artifact@v4
212+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
213213
with:
214214
name: ${{ matrix.rid }}-build-logs
215215
path: |
@@ -221,13 +221,13 @@ jobs:
221221
run: dotnet test ${{ matrix.slnf }} -c Release --no-build --nologo -l GitHubActions -l "trx;LogFilePrefix=testresults_${{ runner.os }}" --collect "XPlat Code Coverage"
222222

223223
- name: Upload code coverage
224-
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7
224+
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
225225
with:
226226
token: ${{ secrets.CODECOV_TOKEN }}
227227

228228
- name: Upload build and test outputs
229229
if: failure()
230-
uses: actions/upload-artifact@v4
230+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
231231
with:
232232
name: ${{ matrix.rid }}-verify-test-results
233233
path: "**/*.received.*"
@@ -237,7 +237,7 @@ jobs:
237237

238238
- name: Archive NuGet Packages
239239
if: env.CI_PUBLISHING_BUILD == 'true'
240-
uses: actions/upload-artifact@v4
240+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
241241
with:
242242
name: ${{ github.sha }}
243243
if-no-files-found: error
@@ -247,7 +247,7 @@ jobs:
247247
248248
- name: Sparse checkout
249249
if: env.CI_PUBLISHING_BUILD == 'true'
250-
uses: actions/checkout@v5
250+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
251251
with:
252252
# We only check out what is absolutely necessary to reduce a chance of local files impacting
253253
# integration tests, e.g. Directory.Build.props, nuget.config, ...
@@ -257,7 +257,7 @@ jobs:
257257
258258
- name: Fetch NuGet Packages
259259
if: env.CI_PUBLISHING_BUILD == 'true'
260-
uses: actions/download-artifact@v5
260+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
261261
with:
262262
name: ${{ github.sha }}
263263
path: src
@@ -274,12 +274,12 @@ jobs:
274274

275275
steps:
276276
- name: Checkout
277-
uses: actions/checkout@v5
277+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
278278
with:
279279
submodules: recursive
280280

281281
- name: Download sentry-native (win-x64)
282-
uses: actions/cache/restore@v4
282+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
283283
with:
284284
path: src/Sentry/Platforms/Native/sentry-native
285285
key: sentry-native-win-x64-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
@@ -293,7 +293,7 @@ jobs:
293293
uses: ./.github/actions/buildnative
294294

295295
- name: Setup MSBuild
296-
uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
296+
uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0
297297

298298
- name: Run MSBuild
299299
id: msbuild
@@ -306,7 +306,7 @@ jobs:
306306

307307
- name: Upload logs
308308
if: ${{ always() }}
309-
uses: actions/upload-artifact@v4
309+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
310310
with:
311311
name: ${{ runner.os }}-msbuild-logs
312312
path: |
@@ -332,7 +332,7 @@ jobs:
332332

333333
steps:
334334
- name: Checkout
335-
uses: actions/checkout@v5
335+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
336336
with:
337337
submodules: recursive
338338

@@ -343,7 +343,7 @@ jobs:
343343
uses: ./.github/actions/buildnative
344344

345345
- name: Fetch NuGet Packages
346-
uses: actions/download-artifact@v5
346+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
347347
with:
348348
name: ${{ github.sha }}
349349
path: src
@@ -362,7 +362,7 @@ jobs:
362362

363363
steps:
364364
- name: Checkout
365-
uses: actions/checkout@v5
365+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
366366
with:
367367
submodules: recursive
368368
fetch-depth: 2 # default is 1 and codecov needs > 1
@@ -372,7 +372,7 @@ jobs:
372372
run: echo "CI_PUBLISHING_BUILD=true" >> $GITHUB_ENV
373373

374374
- name: Download sentry-native (macos)
375-
uses: actions/cache/restore@v4
375+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
376376
with:
377377
path: src/Sentry/Platforms/Native/sentry-native
378378
key: sentry-native-macos-${{ hashFiles('scripts/build-sentry-native.ps1') }}-${{ hashFiles('.git/modules/modules/sentry-native/HEAD') }}
@@ -401,7 +401,7 @@ jobs:
401401
if: ${{ !startsWith(github.ref_name, 'release/') }}
402402

403403
steps:
404-
- uses: actions/checkout@v5
404+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
405405
with:
406406
submodules: recursive
407407

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ jobs:
2424
steps:
2525
- name: Cancel Previous Runs
2626
if: github.ref_name != 'main' && !startsWith(github.ref_name, 'release/')
27-
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # Tag: 0.12.1
27+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
2828

2929
- name: Checkout repository
30-
uses: actions/checkout@v5
30+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3131
with:
3232
submodules: recursive
3333

‎.github/workflows/danger.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ on:
66

77
jobs:
88
danger:
9-
uses: getsentry/github-workflows/.github/workflows/danger.yml@v2
9+
uses: getsentry/github-workflows/.github/workflows/danger.yml@1949ea01ec2da6139d1bcc306c372e6aea76fb72 # 2.13.1

‎.github/workflows/device-tests-android.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ jobs:
2424
steps:
2525
- name: Cancel Previous Runs
2626
if: github.ref_name != 'main' && !startsWith(github.ref_name, 'release/')
27-
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # Tag: 0.12.1
27+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
2828

2929
- name: Checkout
30-
uses: actions/checkout@v5
30+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3131
with:
3232
submodules: recursive
3333

@@ -42,7 +42,7 @@ jobs:
4242

4343
- name: Upload Android Test App (net9.0)
4444
if: matrix.tfm == 'net9.0'
45-
uses: actions/upload-artifact@v4
45+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
4646
with:
4747
name: device-test-android-net9.0
4848
if-no-files-found: error
@@ -80,24 +80,24 @@ jobs:
8080
sudo udevadm trigger --name-match=kvm
8181
8282
- name: Checkout
83-
uses: actions/checkout@v5
83+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
8484

8585
- name: Download test app artifact
86-
uses: actions/download-artifact@v5
86+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
8787
with:
8888
name: device-test-android-${{ matrix.tfm }}
8989
path: bin
9090

9191
- name: Setup Gradle
92-
uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # pin@v3
92+
uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
9393

9494
# Cached AVD setup per https://github.com/ReactiveCircus/android-emulator-runner/blob/main/README.md
9595

9696
- name: Run Tests
9797
id: first-run
9898
continue-on-error: true
9999
timeout-minutes: 40
100-
uses: reactivecircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # Tag: v2.34.0
100+
uses: reactivecircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # v2.34.0
101101
with:
102102
api-level: ${{ matrix.api-level }}
103103
target: ${{ env.ANDROID_EMULATOR_TARGET }}
@@ -112,7 +112,7 @@ jobs:
112112
- name: Retry Tests (if previous failed to run)
113113
if: steps.first-run.outcome == 'failure'
114114
timeout-minutes: 40
115-
uses: reactivecircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # Tag: v2.34.0
115+
uses: reactivecircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # v2.34.0
116116
with:
117117
api-level: ${{ matrix.api-level }}
118118
target: ${{ env.ANDROID_EMULATOR_TARGET }}
@@ -126,7 +126,7 @@ jobs:
126126

127127
- name: Upload results
128128
if: success() || failure()
129-
uses: actions/upload-artifact@v4
129+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
130130
with:
131131
name: device-test-android-${{ matrix.api-level }}-${{ matrix.tfm }}-results
132132
path: test_output

0 commit comments

Comments
 (0)