Skip to content
This repository was archived by the owner on Nov 19, 2025. It is now read-only.

Commit c8be070

Browse files
ChadKillingsworthChadKillingsworth
authored
Merge pull request #322 from google/supply-chain
Pin all GitHub actions to specific commit hashes
2 parents efb6d55 + f689b51 commit c8be070

File tree

3 files changed

+60
-60
lines changed

3 files changed

+60
-60
lines changed

‎.github/workflows/build.yml‎

Lines changed: 53 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -24,22 +24,22 @@ jobs:
2424
FORCE_COLOR: '1'
2525
steps:
2626
- name: Setup Java
27-
uses: actions/setup-java@v4
27+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
2828
with:
2929
distribution: adopt-hotspot
3030
java-version: 21
3131
java-package: jdk
3232
architecture: x64
3333
- name: Setup Bazelisk
34-
uses: bazel-contrib/setup-bazel@0.8.1
34+
uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
3535
with:
3636
# Avoid downloading Bazel every time.
3737
bazelisk-cache: true
3838
# Store build cache per workflow.
3939
disk-cache: ${{ github.workflow }}
4040
# Share repository cache between workflows.
4141
repository-cache: true
42-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
4343
with:
4444
submodules: recursive
4545
ref: ${{ inputs.release-tag || '' }}
@@ -49,7 +49,7 @@ jobs:
4949
- name: Get yarn cache directory path
5050
run: echo "yarn_cache_dir=$(yarn cache dir)" >> $GITHUB_ENV
5151
- name: Yarn and maven cache
52-
uses: actions/cache@v4
52+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3
5353
with:
5454
path: |
5555
${{ env.yarn_cache_dir }}
@@ -63,17 +63,17 @@ jobs:
6363
- name: Tests
6464
run: yarn test:root --color
6565
- name: Upload contrib folder
66-
uses: actions/upload-artifact@v4
66+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6767
with:
6868
name: Contrib folder
6969
path: compiler/contrib
7070
- name: Upload externs folder
71-
uses: actions/upload-artifact@v4
71+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7272
with:
7373
name: Externs folder
7474
path: compiler/externs
7575
- name: Upload compiler jar
76-
uses: actions/upload-artifact@v4
76+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7777
with:
7878
name: Compiler.jar
7979
path: packages/google-closure-compiler-java/compiler.jar
@@ -90,20 +90,20 @@ jobs:
9090
FORCE_COLOR: '1'
9191
steps:
9292
- name: Setup Java
93-
uses: actions/setup-java@v4
93+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
9494
with:
9595
distribution: adopt-hotspot
9696
java-version: 21
9797
java-package: jdk
9898
architecture: x64
99-
- uses: actions/checkout@v4
99+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
100100
with:
101101
ref: ${{ inputs.release-tag || '' }}
102102
- name: Use Node.js ${{ env.NODE_VERSION }}
103-
uses: actions/setup-node@v4
103+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
104104
with:
105105
node-version: ${{ env.NODE_VERSION }}
106-
- uses: graalvm/setup-graalvm@v1
106+
- uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab # 1.3.3
107107
with:
108108
java-version: 21
109109
distribution: 'graalvm-community'
@@ -116,24 +116,24 @@ jobs:
116116
tar -xf upx-$UPX_VERSION-amd64_linux.tar.xz
117117
mv ./upx-$UPX_VERSION-amd64_linux/upx /usr/local/bin/upx
118118
- name: Download compiler jar
119-
uses: actions/download-artifact@v4
119+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
120120
with:
121121
name: Compiler.jar
122122
path: packages/google-closure-compiler-java/
123123
- name: Download contrib folder
124-
uses: actions/download-artifact@v4
124+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
125125
with:
126126
name: Contrib folder
127127
path: packages/google-closure-compiler/contrib
128128
- name: Download externs folder
129-
uses: actions/download-artifact@v4
129+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
130130
with:
131131
name: Externs folder
132132
path: packages/google-closure-compiler/externs
133133
- name: Get yarn cache directory path
134134
run: echo "yarn_cache_dir=$(yarn cache dir)" >> $GITHUB_ENV
135135
- name: Cache yarn
136-
uses: actions/cache@v4
136+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3
137137
id: yarn-cache
138138
with:
139139
path: ${{ env.yarn_cache_dir }}
@@ -151,7 +151,7 @@ jobs:
151151
- name: Tests
152152
run: yarn workspaces run test --color
153153
- name: Upload artifacts
154-
uses: actions/upload-artifact@v4
154+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
155155
with:
156156
name: Linux image
157157
path: packages/google-closure-compiler-linux/compiler
@@ -168,20 +168,20 @@ jobs:
168168
FORCE_COLOR: '1'
169169
steps:
170170
- name: Setup Java
171-
uses: actions/setup-java@v4
171+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
172172
with:
173173
distribution: adopt-hotspot
174174
java-version: 21
175175
java-package: jdk
176176
architecture: x64
177-
- uses: actions/checkout@v4
177+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
178178
with:
179179
ref: ${{ inputs.release-tag || '' }}
180180
- name: Use Node.js ${{ env.NODE_VERSION }}
181-
uses: actions/setup-node@v4
181+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
182182
with:
183183
node-version: ${{ env.NODE_VERSION }}
184-
- uses: graalvm/setup-graalvm@v1
184+
- uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab # 1.3.3
185185
with:
186186
java-version: 21
187187
distribution: 'graalvm-community'
@@ -194,24 +194,24 @@ jobs:
194194
tar -xf upx-$UPX_VERSION-arm64_linux.tar.xz
195195
mv ./upx-$UPX_VERSION-arm64_linux/upx /usr/local/bin/upx
196196
- name: Download compiler jar
197-
uses: actions/download-artifact@v4
197+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
198198
with:
199199
name: Compiler.jar
200200
path: packages/google-closure-compiler-java/
201201
- name: Download contrib folder
202-
uses: actions/download-artifact@v4
202+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
203203
with:
204204
name: Contrib folder
205205
path: packages/google-closure-compiler/contrib
206206
- name: Download externs folder
207-
uses: actions/download-artifact@v4
207+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
208208
with:
209209
name: Externs folder
210210
path: packages/google-closure-compiler/externs
211211
- name: Get yarn cache directory path
212212
run: echo "yarn_cache_dir=$(yarn cache dir)" >> $GITHUB_ENV
213213
- name: Cache yarn
214-
uses: actions/cache@v4
214+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3
215215
id: yarn-cache
216216
with:
217217
path: ${{ env.yarn_cache_dir }}
@@ -229,7 +229,7 @@ jobs:
229229
- name: Tests
230230
run: yarn workspaces run test --color
231231
- name: Upload artifacts
232-
uses: actions/upload-artifact@v4
232+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
233233
with:
234234
name: Linux arm64 image
235235
path: packages/google-closure-compiler-linux-arm64/compiler
@@ -244,20 +244,20 @@ jobs:
244244
FORCE_COLOR: '1'
245245
steps:
246246
- name: Setup Java
247-
uses: actions/setup-java@v4
247+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
248248
with:
249249
distribution: adopt-hotspot
250250
java-version: 21
251251
java-package: jdk
252252
architecture: x64
253-
- uses: actions/checkout@v4
253+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
254254
with:
255255
ref: ${{ inputs.release-tag || '' }}
256256
- name: Use Node.js ${{ env.NODE_VERSION }}
257-
uses: actions/setup-node@v4
257+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
258258
with:
259259
node-version: ${{ env.NODE_VERSION }}
260-
- uses: graalvm/setup-graalvm@v1
260+
- uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab # 1.3.3
261261
with:
262262
java-version: 21
263263
distribution: 'graalvm-community'
@@ -267,24 +267,24 @@ jobs:
267267
# - name: Install upx
268268
# run: brew install upx
269269
- name: Download compiler jar
270-
uses: actions/download-artifact@v4
270+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
271271
with:
272272
name: Compiler.jar
273273
path: packages/google-closure-compiler-java/
274274
- name: Download contrib folder
275-
uses: actions/download-artifact@v4
275+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
276276
with:
277277
name: Contrib folder
278278
path: packages/google-closure-compiler/contrib
279279
- name: Download externs folder
280-
uses: actions/download-artifact@v4
280+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
281281
with:
282282
name: Externs folder
283283
path: packages/google-closure-compiler/externs
284284
- name: Get yarn cache directory path
285285
run: echo "yarn_cache_dir=$(yarn cache dir)" >> $GITHUB_ENV
286286
- name: Cache yarn
287-
uses: actions/cache@v4
287+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3
288288
id: yarn-cache
289289
with:
290290
path: ${{ env.yarn_cache_dir }}
@@ -302,7 +302,7 @@ jobs:
302302
- name: Tests
303303
run: yarn workspaces run test --color
304304
- name: Upload artifacts
305-
uses: actions/upload-artifact@v4
305+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
306306
with:
307307
name: MacOS image
308308
path: packages/google-closure-compiler-macos/compiler
@@ -317,45 +317,45 @@ jobs:
317317
FORCE_COLOR: '1'
318318
steps:
319319
- name: Setup Java
320-
uses: actions/setup-java@v4
320+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
321321
with:
322322
distribution: adopt-hotspot
323323
java-version: 21
324324
java-package: jdk
325325
architecture: x64
326-
- uses: actions/checkout@v4
326+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
327327
with:
328328
ref: ${{ inputs.release-tag || '' }}
329329
- name: Use Node.js ${{ env.NODE_VERSION }}
330-
uses: actions/setup-node@v4
330+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
331331
with:
332332
node-version: ${{ env.NODE_VERSION }}
333-
- uses: graalvm/setup-graalvm@v1
333+
- uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab # 1.3.3
334334
with:
335335
java-version: 21
336336
distribution: 'graalvm-community'
337337
github-token: ${{ secrets.GITHUB_TOKEN }}
338338
native-image-job-reports: 'true'
339339
- name: Download compiler jar
340-
uses: actions/download-artifact@v4
340+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
341341
with:
342342
name: Compiler.jar
343343
path: packages/google-closure-compiler-java/
344344
- name: Download contrib folder
345-
uses: actions/download-artifact@v4
345+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
346346
with:
347347
name: Contrib folder
348348
path: packages/google-closure-compiler/contrib
349349
- name: Download externs folder
350-
uses: actions/download-artifact@v4
350+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
351351
with:
352352
name: Externs folder
353353
path: packages/google-closure-compiler/externs
354354
- name: Get yarn cache directory path
355355
# See https://stackoverflow.com/a/66737579/1211524
356356
run: echo "yarn_cache_dir=$(yarn cache dir)" >> $env:GITHUB_ENV
357357
- name: Cache yarn
358-
uses: actions/cache@v4
358+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3
359359
id: yarn-cache
360360
with:
361361
path: ${{ env.yarn_cache_dir }}
@@ -375,7 +375,7 @@ jobs:
375375
echo "Running Tests"
376376
yarn workspaces run test --color
377377
- name: Upload artifacts
378-
uses: actions/upload-artifact@v4
378+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
379379
with:
380380
name: Windows image
381381
path: packages/google-closure-compiler-windows/compiler.exe
@@ -395,46 +395,46 @@ jobs:
395395
- build-macos
396396
- build-windows
397397
steps:
398-
- uses: actions/checkout@v4
398+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
399399
with:
400400
ref: ${{ inputs.release-tag || '' }}
401401
- name: Use Node.js ${{ env.NODE_VERSION }}
402-
uses: actions/setup-node@v4
402+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
403403
with:
404404
node-version: ${{ env.NODE_VERSION }}
405405
registry-url: https://registry.npmjs.org/
406406
- name: Download compiler jar
407-
uses: actions/download-artifact@v4
407+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
408408
with:
409409
name: Compiler.jar
410410
path: packages/google-closure-compiler-java/
411411
- name: Download Linux image
412-
uses: actions/download-artifact@v4
412+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
413413
with:
414414
name: Linux image
415415
path: packages/google-closure-compiler-linux/
416416
- name: Download Linux arm64 image
417-
uses: actions/download-artifact@v4
417+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
418418
with:
419419
name: Linux arm64 image
420420
path: packages/google-closure-compiler-linux-arm64/
421421
- name: Download MacOS image
422-
uses: actions/download-artifact@v4
422+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
423423
with:
424424
name: MacOS image
425425
path: packages/google-closure-compiler-macos/
426426
- name: Download Windows image
427-
uses: actions/download-artifact@v4
427+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
428428
with:
429429
name: Windows image
430430
path: packages/google-closure-compiler-windows/
431431
- name: Download contrib folder
432-
uses: actions/download-artifact@v4
432+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
433433
with:
434434
name: Contrib folder
435435
path: packages/google-closure-compiler/contrib
436436
- name: Download externs folder
437-
uses: actions/download-artifact@v4
437+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
438438
with:
439439
name: Externs folder
440440
path: packages/google-closure-compiler/externs
@@ -447,7 +447,7 @@ jobs:
447447
- name: Get yarn cache directory path
448448
run: echo "yarn_cache_dir=$(yarn cache dir)" >> $GITHUB_ENV
449449
- name: Cache yarn
450-
uses: actions/cache@v4
450+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3
451451
id: yarn-cache
452452
with:
453453
path: ${{ env.yarn_cache_dir }}

0 commit comments

Comments
 (0)