Merge pull request #112 from github/claude/pin-dependencies-in-actions

fix: pin GitHub Actions dependencies to SHA hashes

Author: zkoppert

.github/workflows/docker-image.yml

@@ -14,7 +14,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Build the Docker image

.github/workflows/linter.yaml

@@ -18,20 +18,20 @@ jobs:
       statuses: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Full git history is needed to get a proper
           # list of changed files within `super-linter`
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
       - name: Install dependencies
         run: |
           pip install -r requirements.txt -r requirements-test.txt
       - name: Lint Code Base
-        uses: super-linter/super-linter@502f4fe48a81a392756e173e39a861f8c8efe056 # v8.3.0
+        uses: super-linter/super-linter@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
         env:
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/python-package.yml

@@ -21,11 +21,11 @@ jobs:
         python-version: [3.11, 3.12]
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -36,7 +36,7 @@ jobs:
           results_format: sarif
           publish_results: true
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v6.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/stale.yaml

@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10.1.1
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           stale-issue-message: "This issue is stale because it has been open 21 days with no activity. Remove stale label or comment or this will be closed in 14 days."
           close-issue-message: "This issue was closed because it has been stalled for 35 days with no activity."

Dockerfile

@@ -3,15 +3,15 @@
 #trivy:ignore:AVD-DS-0002
 FROM python:3.14.0-slim@sha256:0aecac02dc3d4c5dbb024b753af084cafe41f5416e02193f1ce345d671ec966e
 LABEL com.github.actions.name="measure-innersource" \
-    com.github.actions.description="Measure and report on the InnerSource collaboration occuring in a given repository" \
+    com.github.actions.description="Measure and report on the InnerSource collaboration occurring in a given repository" \
     com.github.actions.icon="bar-chart" \
     com.github.actions.color="white" \
     maintainer="@zkoppert" \
     org.opencontainers.image.url="https://github.com/github/measure-innersource" \
     org.opencontainers.image.source="https://github.com/github/measure-innersource" \
     org.opencontainers.image.documentation="https://github.com/github/measure-innersource" \
     org.opencontainers.image.vendor="GitHub" \
-    org.opencontainers.image.description="Measure and report on the InnerSource collaboration occuring in a given repository"
+    org.opencontainers.image.description="Measure and report on the InnerSource collaboration occurring in a given repository"
 
 WORKDIR /action/workspace
 COPY requirements.txt *.py /action/workspace/

auth.py

@@ -95,8 +95,8 @@ def auth_to_github(
         github_connection = github3.login(token=token)
     else:
         raise ValueError(
-            "GH_TOKEN or the set of [GH_APP_ID, GH_APP_INSTALLATION_ID, \
-                GH_APP_PRIVATE_KEY] environment variables are not set"
+            "GH_TOKEN or the set of [GH_APP_ID, GH_APP_INSTALLATION_ID, "
+            "GH_APP_PRIVATE_KEY] environment variables are not set"
         )
 
     if not github_connection:

measure_innersource.py

@@ -1,7 +1,7 @@
 """A tool for measuring InnerSource collaboration in a given repository
 
 This script uses the GitHub API to search for issues/prs in a repository
-and measure the InnerSource collaboration occuring in those issues/prs.
+and measure the InnerSource collaboration occurring in those issues/prs.
 The results are then written to a markdown file.
 
 """