Skip to content

Commit 4a40490

Browse files
silamonsilamon
authored
Pin SHA for all Github Actions (#6186)
1 parent 0a46e03 commit 4a40490

File tree

8 files changed

+61
-58
lines changed

8 files changed

+61
-58
lines changed

‎.github/workflows/builder.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
requirements: ${{ steps.requirements.outputs.changed }}
5454
steps:
5555
- name: Checkout the repository
56-
uses: actions/[email protected]
56+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5757
with:
5858
fetch-depth: 0
5959

@@ -70,7 +70,7 @@ jobs:
7070
- name: Get changed files
7171
id: changed_files
7272
if: steps.version.outputs.publish == 'false'
73-
uses: masesgroup/[email protected]
73+
uses: masesgroup/retrieve-changed-files@491e80760c0e28d36ca6240a27b1ccb8e1402c13 # v3.0.0
7474

7575
- name: Check if requirements files changed
7676
id: requirements
@@ -92,7 +92,7 @@ jobs:
9292
arch: ${{ fromJson(needs.init.outputs.architectures) }}
9393
steps:
9494
- name: Checkout the repository
95-
uses: actions/[email protected]
95+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
9696
with:
9797
fetch-depth: 0
9898

@@ -104,6 +104,7 @@ jobs:
104104
echo "CARGO_NET_GIT_FETCH_WITH_CLI=true"
105105
) > .env_file
106106
107+
# home-assistant/wheels doesn't support sha pinning
107108
- name: Build wheels
108109
if: needs.init.outputs.requirements == 'true'
109110
uses: home-assistant/[email protected]
@@ -125,13 +126,13 @@ jobs:
125126

126127
- name: Set up Python ${{ env.DEFAULT_PYTHON }}
127128
if: needs.init.outputs.publish == 'true'
128-
uses: actions/[email protected]
129+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
129130
with:
130131
python-version: ${{ env.DEFAULT_PYTHON }}
131132

132133
- name: Install Cosign
133134
if: needs.init.outputs.publish == 'true'
134-
uses: sigstore/[email protected]
135+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
135136
with:
136137
cosign-release: "v2.4.3"
137138

@@ -149,7 +150,7 @@ jobs:
149150
150151
- name: Login to GitHub Container Registry
151152
if: needs.init.outputs.publish == 'true'
152-
uses: docker/[email protected]
153+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
153154
with:
154155
registry: ghcr.io
155156
username: ${{ github.repository_owner }}
@@ -159,6 +160,7 @@ jobs:
159160
if: needs.init.outputs.publish == 'false'
160161
run: echo "BUILD_ARGS=--test" >> $GITHUB_ENV
161162

163+
# home-assistant/builder doesn't support sha pinning
162164
- name: Build supervisor
163165
uses: home-assistant/[email protected]
164166
with:
@@ -178,7 +180,7 @@ jobs:
178180
steps:
179181
- name: Checkout the repository
180182
if: needs.init.outputs.publish == 'true'
181-
uses: actions/[email protected]
183+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
182184

183185
- name: Initialize git
184186
if: needs.init.outputs.publish == 'true'
@@ -203,8 +205,9 @@ jobs:
203205
timeout-minutes: 60
204206
steps:
205207
- name: Checkout the repository
206-
uses: actions/[email protected]
208+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
207209

210+
# home-assistant/builder doesn't support sha pinning
208211
- name: Build the Supervisor
209212
if: needs.init.outputs.publish != 'true'
210213
uses: home-assistant/[email protected]

‎.github/workflows/ci.yaml‎

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,15 @@ jobs:
2626
name: Prepare Python dependencies
2727
steps:
2828
- name: Check out code from GitHub
29-
uses: actions/[email protected]
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3030
- name: Set up Python
3131
id: python
32-
uses: actions/[email protected]
32+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
3333
with:
3434
python-version: ${{ env.DEFAULT_PYTHON }}
3535
- name: Restore Python virtual environment
3636
id: cache-venv
37-
uses: actions/[email protected]
37+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
3838
with:
3939
path: venv
4040
key: |
@@ -48,7 +48,7 @@ jobs:
4848
pip install -r requirements.txt -r requirements_tests.txt
4949
- name: Restore pre-commit environment from cache
5050
id: cache-precommit
51-
uses: actions/[email protected]
51+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
5252
with:
5353
path: ${{ env.PRE_COMMIT_CACHE }}
5454
lookup-only: true
@@ -68,15 +68,15 @@ jobs:
6868
needs: prepare
6969
steps:
7070
- name: Check out code from GitHub
71-
uses: actions/[email protected]
71+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
7272
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
73-
uses: actions/[email protected]
73+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
7474
id: python
7575
with:
7676
python-version: ${{ needs.prepare.outputs.python-version }}
7777
- name: Restore Python virtual environment
7878
id: cache-venv
79-
uses: actions/[email protected]
79+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
8080
with:
8181
path: venv
8282
key: |
@@ -88,7 +88,7 @@ jobs:
8888
exit 1
8989
- name: Restore pre-commit environment from cache
9090
id: cache-precommit
91-
uses: actions/[email protected]
91+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
9292
with:
9393
path: ${{ env.PRE_COMMIT_CACHE }}
9494
key: |
@@ -111,15 +111,15 @@ jobs:
111111
needs: prepare
112112
steps:
113113
- name: Check out code from GitHub
114-
uses: actions/[email protected]
114+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
115115
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
116-
uses: actions/[email protected]
116+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
117117
id: python
118118
with:
119119
python-version: ${{ needs.prepare.outputs.python-version }}
120120
- name: Restore Python virtual environment
121121
id: cache-venv
122-
uses: actions/[email protected]
122+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
123123
with:
124124
path: venv
125125
key: |
@@ -131,7 +131,7 @@ jobs:
131131
exit 1
132132
- name: Restore pre-commit environment from cache
133133
id: cache-precommit
134-
uses: actions/[email protected]
134+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
135135
with:
136136
path: ${{ env.PRE_COMMIT_CACHE }}
137137
key: |
@@ -154,7 +154,7 @@ jobs:
154154
needs: prepare
155155
steps:
156156
- name: Check out code from GitHub
157-
uses: actions/[email protected]
157+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
158158
- name: Register hadolint problem matcher
159159
run: |
160160
echo "::add-matcher::.github/workflows/matchers/hadolint.json"
@@ -169,15 +169,15 @@ jobs:
169169
needs: prepare
170170
steps:
171171
- name: Check out code from GitHub
172-
uses: actions/[email protected]
172+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
173173
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
174-
uses: actions/[email protected]
174+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
175175
id: python
176176
with:
177177
python-version: ${{ needs.prepare.outputs.python-version }}
178178
- name: Restore Python virtual environment
179179
id: cache-venv
180-
uses: actions/[email protected]
180+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
181181
with:
182182
path: venv
183183
key: |
@@ -189,7 +189,7 @@ jobs:
189189
exit 1
190190
- name: Restore pre-commit environment from cache
191191
id: cache-precommit
192-
uses: actions/[email protected]
192+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
193193
with:
194194
path: ${{ env.PRE_COMMIT_CACHE }}
195195
key: |
@@ -213,15 +213,15 @@ jobs:
213213
needs: prepare
214214
steps:
215215
- name: Check out code from GitHub
216-
uses: actions/[email protected]
216+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
217217
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
218-
uses: actions/[email protected]
218+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
219219
id: python
220220
with:
221221
python-version: ${{ needs.prepare.outputs.python-version }}
222222
- name: Restore Python virtual environment
223223
id: cache-venv
224-
uses: actions/[email protected]
224+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
225225
with:
226226
path: venv
227227
key: |
@@ -233,7 +233,7 @@ jobs:
233233
exit 1
234234
- name: Restore pre-commit environment from cache
235235
id: cache-precommit
236-
uses: actions/[email protected]
236+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
237237
with:
238238
path: ${{ env.PRE_COMMIT_CACHE }}
239239
key: |
@@ -257,15 +257,15 @@ jobs:
257257
needs: prepare
258258
steps:
259259
- name: Check out code from GitHub
260-
uses: actions/[email protected]
260+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
261261
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
262-
uses: actions/[email protected]
262+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
263263
id: python
264264
with:
265265
python-version: ${{ needs.prepare.outputs.python-version }}
266266
- name: Restore Python virtual environment
267267
id: cache-venv
268-
uses: actions/[email protected]
268+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
269269
with:
270270
path: venv
271271
key: |
@@ -293,9 +293,9 @@ jobs:
293293
needs: prepare
294294
steps:
295295
- name: Check out code from GitHub
296-
uses: actions/[email protected]
296+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
297297
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
298-
uses: actions/[email protected]
298+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
299299
id: python
300300
with:
301301
python-version: ${{ needs.prepare.outputs.python-version }}
@@ -307,7 +307,7 @@ jobs:
307307
echo "key=mypy-${{ env.MYPY_CACHE_VERSION }}-$mypy_version-$(date -u '+%Y-%m-%dT%H:%M:%s')" >> $GITHUB_OUTPUT
308308
- name: Restore Python virtual environment
309309
id: cache-venv
310-
uses: actions/[email protected]
310+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
311311
with:
312312
path: venv
313313
key: >-
@@ -318,7 +318,7 @@ jobs:
318318
echo "Failed to restore Python virtual environment from cache"
319319
exit 1
320320
- name: Restore mypy cache
321-
uses: actions/[email protected]
321+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
322322
with:
323323
path: .mypy_cache
324324
key: >-
@@ -339,19 +339,19 @@ jobs:
339339
name: Run tests Python ${{ needs.prepare.outputs.python-version }}
340340
steps:
341341
- name: Check out code from GitHub
342-
uses: actions/[email protected]
342+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
343343
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
344-
uses: actions/[email protected]
344+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
345345
id: python
346346
with:
347347
python-version: ${{ needs.prepare.outputs.python-version }}
348348
- name: Install Cosign
349-
uses: sigstore/[email protected]
349+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
350350
with:
351351
cosign-release: "v2.4.3"
352352
- name: Restore Python virtual environment
353353
id: cache-venv
354-
uses: actions/[email protected]
354+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
355355
with:
356356
path: venv
357357
key: |
@@ -386,7 +386,7 @@ jobs:
386386
-o console_output_style=count \
387387
tests
388388
- name: Upload coverage artifact
389-
uses: actions/[email protected]
389+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
390390
with:
391391
name: coverage
392392
path: .coverage
@@ -398,15 +398,15 @@ jobs:
398398
needs: ["pytest", "prepare"]
399399
steps:
400400
- name: Check out code from GitHub
401-
uses: actions/[email protected]
401+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
402402
- name: Set up Python ${{ needs.prepare.outputs.python-version }}
403-
uses: actions/[email protected]
403+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
404404
id: python
405405
with:
406406
python-version: ${{ needs.prepare.outputs.python-version }}
407407
- name: Restore Python virtual environment
408408
id: cache-venv
409-
uses: actions/[email protected]
409+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
410410
with:
411411
path: venv
412412
key: |
@@ -417,7 +417,7 @@ jobs:
417417
echo "Failed to restore Python virtual environment from cache"
418418
exit 1
419419
- name: Download all coverage artifacts
420-
uses: actions/[email protected]
420+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
421421
with:
422422
name: coverage
423423
path: coverage/
@@ -428,4 +428,4 @@ jobs:
428428
coverage report
429429
coverage xml
430430
- name: Upload coverage to Codecov
431-
uses: codecov/[email protected]
431+
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1

‎.github/workflows/lock.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
lock:
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: dessant/[email protected]
12+
- uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
1313
with:
1414
github-token: ${{ github.token }}
1515
issue-inactive-days: "30"

‎.github/workflows/release-drafter.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
name: Release Drafter
1212
steps:
1313
- name: Checkout the repository
14-
uses: actions/[email protected]
14+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1515
with:
1616
fetch-depth: 0
1717

@@ -36,7 +36,7 @@ jobs:
3636
echo "version=$datepre.$newpost" >> "$GITHUB_OUTPUT"
3737
3838
- name: Run Release Drafter
39-
uses: release-drafter/[email protected]
39+
uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
4040
with:
4141
tag: ${{ steps.version.outputs.version }}
4242
name: ${{ steps.version.outputs.version }}

‎.github/workflows/restrict-task-creation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
if: github.event.issue.type.name == 'Task'
1313
steps:
1414
- name: Check if user is authorized
15-
uses: actions/github-script@v8
15+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
1616
with:
1717
script: |
1818
const issueAuthor = context.payload.issue.user.login;

0 commit comments

Comments
 (0)