Skip to content

Commit a0d7161

Browse files
marko-bekhtayrodiere
marko-bekhta
authored and
yrodiere
committed
Use SHA instead of versions in GH actions
1 parent 159818d commit a0d7161

File tree

3 files changed

+30
-30
lines changed

3 files changed

+30
-30
lines changed

‎.github/workflows/ci-report.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ jobs:
1717
steps:
1818
# Checkout target branch which has trusted code
1919
- name: Check out target branch
20-
uses: actions/checkout@v4
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2121
with:
2222
persist-credentials: false
2323
ref: ${{ github.ref }}
2424
- name: Set up Java 17
25-
uses: actions/setup-java@v4
25+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
2626
with:
2727
distribution: 'temurin'
2828
java-version: '17'
@@ -38,7 +38,7 @@ jobs:
3838
echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" >> $GITHUB_OUTPUT
3939
echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
4040
- name: Restore Maven/Gradle Dependency/Dist Caches
41-
uses: actions/cache/restore@v4
41+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
4242
with:
4343
path: |
4444
~/.m2/repository/
@@ -52,7 +52,7 @@ jobs:
5252
5353
- name: Download GitHub Actions artifacts for the Develocity build scans
5454
id: downloadBuildScan
55-
uses: actions/download-artifact@v4
55+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
5656
with:
5757
pattern: build-scan-data-*
5858
github-token: ${{ github.token }}
@@ -75,4 +75,4 @@ jobs:
7575
done
7676
exit $status
7777
env:
78-
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}
78+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}

‎.github/workflows/ci.yml

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
# Running with HANA requires at least 8GB memory just for the database, which we don't have on GH Actions runners
4747
# - rdbms: hana
4848
steps:
49-
- uses: actions/checkout@v4
49+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5050
with:
5151
persist-credentials: false
5252
- name: Reclaim Disk Space
@@ -56,7 +56,7 @@ jobs:
5656
RDBMS: ${{ matrix.rdbms }}
5757
run: ci/database-start.sh
5858
- name: Set up Java 17
59-
uses: actions/setup-java@v4
59+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
6060
with:
6161
distribution: 'temurin'
6262
java-version: '17'
@@ -73,7 +73,7 @@ jobs:
7373
echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
7474
- name: Cache Maven/Gradle Dependency/Dist Caches
7575
id: cache-maven
76-
uses: actions/cache@v4
76+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
7777
# if it's not a pull request, we restore and save the cache
7878
if: github.event_name != 'pull_request'
7979
with:
@@ -90,7 +90,7 @@ jobs:
9090
${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
9191
${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
9292
- name: Restore Maven/Gradle Dependency/Dist Caches
93-
uses: actions/cache/restore@v4
93+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
9494
# if it a pull request, we restore the cache but we don't save it
9595
if: github.event_name == 'pull_request'
9696
with:
@@ -118,14 +118,14 @@ jobs:
118118
# The actual publishing must be done in a separate job (see ci-report.yml).
119119
# We don't write to the remote cache as that would be unsafe.
120120
- name: Upload GitHub Actions artifact for the Develocity build scan
121-
uses: actions/upload-artifact@v4
121+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
122122
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
123123
with:
124124
name: build-scan-data-${{ matrix.rdbms }}
125125
path: ~/.gradle/build-scan-data
126126

127127
- name: Upload test reports (if Gradle failed)
128-
uses: actions/upload-artifact@v4
128+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
129129
if: failure()
130130
with:
131131
name: test-reports-java11-${{ matrix.rdbms }}
@@ -151,7 +151,7 @@ jobs:
151151
- rdbms: oracle_db21c
152152
- rdbms: oracle_db23c
153153
steps:
154-
- uses: actions/checkout@v4
154+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
155155
with:
156156
persist-credentials: false
157157
- name: Reclaim disk space and sanitize user home
@@ -162,7 +162,7 @@ jobs:
162162
RUNID: ${{ github.run_number }}
163163
run: ci/database-start.sh
164164
- name: Set up Java 21
165-
uses: graalvm/setup-graalvm@v1
165+
uses: graalvm/setup-graalvm@aafbedb8d382ed0ca6167d3a051415f20c859274 # v1.2.8
166166
with:
167167
distribution: 'graalvm'
168168
java-version: '21'
@@ -179,7 +179,7 @@ jobs:
179179
echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
180180
- name: Cache Maven/Gradle Dependency/Dist Caches
181181
id: cache-maven
182-
uses: actions/cache@v4
182+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
183183
# if it's not a pull request, we restore and save the cache
184184
if: github.event_name != 'pull_request'
185185
with:
@@ -196,7 +196,7 @@ jobs:
196196
${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
197197
${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
198198
- name: Restore Maven/Gradle Dependency/Dist Caches
199-
uses: actions/cache/restore@v4
199+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
200200
# if it a pull request, we restore the cache but we don't save it
201201
if: github.event_name == 'pull_request'
202202
with:
@@ -226,13 +226,13 @@ jobs:
226226
# We don't write to the remote cache as that would be unsafe.
227227
# That's even on push, because we do not trust Atlas runners to hold secrets: they are shared infrastructure.
228228
- name: Upload GitHub Actions artifact for the Develocity build scan
229-
uses: actions/upload-artifact@v4
229+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
230230
if: "${{ !cancelled() }}"
231231
with:
232232
name: build-scan-data-${{ matrix.rdbms }}
233233
path: ~/.gradle/build-scan-data
234234
- name: Upload test reports (if Gradle failed)
235-
uses: actions/upload-artifact@v4
235+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
236236
if: failure()
237237
with:
238238
name: test-reports-java11-${{ matrix.rdbms }}
@@ -248,13 +248,13 @@ jobs:
248248
name: Static code analysis
249249
runs-on: ubuntu-latest
250250
steps:
251-
- uses: actions/checkout@v4
251+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
252252
with:
253253
persist-credentials: false
254254
- name: Reclaim disk space and sanitize user home
255255
run: .github/ci-prerequisites-atlas.sh
256256
- name: Set up Java 17
257-
uses: actions/setup-java@v4
257+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
258258
with:
259259
distribution: 'temurin'
260260
java-version: '17'
@@ -271,7 +271,7 @@ jobs:
271271
echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
272272
- name: Cache Maven/Gradle Dependency/Dist Caches
273273
id: cache-maven
274-
uses: actions/cache@v4
274+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
275275
# if it's not a pull request, we restore and save the cache
276276
if: github.event_name != 'pull_request'
277277
with:
@@ -288,7 +288,7 @@ jobs:
288288
${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
289289
${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
290290
- name: Restore Maven/Gradle Dependency/Dist Caches
291-
uses: actions/cache/restore@v4
291+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
292292
# if it a pull request, we restore the cache but we don't save it
293293
if: github.event_name == 'pull_request'
294294
with:
@@ -314,18 +314,18 @@ jobs:
314314
# The actual publishing must be done in a separate job (see ci-report.yml).
315315
# We don't write to the remote cache as that would be unsafe.
316316
- name: Upload GitHub Actions artifact for the Develocity build scan
317-
uses: actions/upload-artifact@v4
317+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
318318
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
319319
with:
320320
name: build-scan-data-sca
321321
path: ~/.gradle/build-scan-data
322322

323323
- name: Upload test reports (if Gradle failed)
324-
uses: actions/upload-artifact@v4
324+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
325325
if: failure()
326326
with:
327327
name: test-reports-java11-sca
328328
path: |
329329
./**/target/reports/tests/
330330
- name: Omit produced artifacts from build cache
331-
run: ./ci/before-cache.sh
331+
run: ./ci/before-cache.sh

‎.github/workflows/codeql.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,17 +37,17 @@ jobs:
3737
steps:
3838

3939
- name: Set up JDK
40-
uses: actions/setup-java@v3
40+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
4141
with:
4242
distribution: 'temurin'
4343
java-version: '17'
4444

4545
- name: Checkout repository
46-
uses: actions/checkout@v4
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4747

4848
# Initializes the CodeQL tools for scanning.
4949
- name: Initialize CodeQL
50-
uses: github/codeql-action/init@v3
50+
uses: github/codeql-action/init@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
5151
with:
5252
languages: ${{ matrix.language }}
5353
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
6161
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
6262
# If this step fails, then you should remove it and run the build manually (see below)
6363
- name: Autobuild
64-
uses: github/codeql-action/autobuild@v3
64+
uses: github/codeql-action/autobuild@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
6565

6666
# ℹ️ Command-line programs to run using the OS shell.
6767
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -74,6 +74,6 @@ jobs:
7474
# ./location_of_script_within_repo/buildscript.sh
7575

7676
- name: Perform CodeQL Analysis
77-
uses: github/codeql-action/analyze@v3
77+
uses: github/codeql-action/analyze@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
7878
with:
79-
category: "/language:${{matrix.language}}"
79+
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)