Skip to content

Commit 88692d3

Browse files
kazuponkazupon
committed
chore: more secure github actions
1 parent a1c1814 commit 88692d3

File tree

7 files changed

+76
-54
lines changed

7 files changed

+76
-54
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 40 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,16 @@ jobs:
2626
runs-on: ${{ matrix.os }}
2727

2828
steps:
29-
- name: Checkout codes
30-
uses: actions/checkout@v4
29+
- name: Checkout
30+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
31+
with:
32+
fetch-depth: 0
3133

3234
- name: Install pnpm
33-
uses: pnpm/action-setup@v4
35+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
3436

3537
- name: Setup node
36-
uses: actions/setup-node@v4
38+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
3739
with:
3840
node-version: ${{ matrix.node }}
3941
cache: 'pnpm'
@@ -54,14 +56,16 @@ jobs:
5456
runs-on: ${{ matrix.os }}
5557

5658
steps:
57-
- name: Checkout codes
58-
uses: actions/checkout@v4
59+
- name: Checkout
60+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
61+
with:
62+
fetch-depth: 0
5963

6064
- name: Install pnpm
61-
uses: pnpm/action-setup@v4
65+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
6266

6367
- name: Setup node
64-
uses: actions/setup-node@v4
68+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
6569
with:
6670
node-version: ${{ matrix.node }}
6771
cache: 'pnpm'
@@ -75,7 +79,7 @@ jobs:
7579
npx tsx ./scripts/postprocess.ts
7680
7781
- name: Cache dist
78-
uses: actions/cache@v4
82+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
7983
with:
8084
path: packages/*/dist
8185
key: build-vue-i18n-os-${{ matrix.os }}-${{ github.sha }}
@@ -90,14 +94,16 @@ jobs:
9094
runs-on: ${{ matrix.os }}
9195

9296
steps:
93-
- name: Checkout codes
94-
uses: actions/checkout@v4
97+
- name: Checkout
98+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
99+
with:
100+
fetch-depth: 0
95101

96102
- name: Install pnpm
97-
uses: pnpm/action-setup@v4
103+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
98104

99105
- name: Setup node
100-
uses: actions/setup-node@v4
106+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
101107
with:
102108
node-version: ${{ matrix.node }}
103109
cache: 'pnpm'
@@ -110,7 +116,7 @@ jobs:
110116
pnpm build:rolldown --withTypes
111117
112118
- name: Cache dist
113-
uses: actions/cache@v4
119+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
114120
with:
115121
path: packages/*/dist
116122
key: build-rolldown-vue-i18n-os-${{ matrix.os }}-${{ github.sha }}
@@ -125,14 +131,16 @@ jobs:
125131
runs-on: ${{ matrix.os }}
126132

127133
steps:
128-
- name: Checkout codes
129-
uses: actions/checkout@v4
134+
- name: Checkout
135+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
136+
with:
137+
fetch-depth: 0
130138

131139
- name: Install pnpm
132-
uses: pnpm/action-setup@v4
140+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
133141

134142
- name: Setup node
135-
uses: actions/setup-node@v4
143+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
136144
with:
137145
node-version: ${{ matrix.node }}
138146
cache: 'pnpm'
@@ -158,14 +166,16 @@ jobs:
158166
runs-on: ${{ matrix.os }}
159167

160168
steps:
161-
- name: Checkout codes
162-
uses: actions/checkout@v4
169+
- name: Checkout
170+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
171+
with:
172+
fetch-depth: 0
163173

164174
- name: Install pnpm
165-
uses: pnpm/action-setup@v4
175+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
166176

167177
- name: Setup node
168-
uses: actions/setup-node@v4
178+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
169179
with:
170180
node-version: ${{ matrix.node }}
171181
cache: 'pnpm'
@@ -177,7 +187,7 @@ jobs:
177187
run: pnpm playwright-core install chromium
178188

179189
- name: Restore dist cache
180-
uses: actions/cache@v4
190+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
181191
with:
182192
path: packages/*/dist
183193
key: build-vue-i18n-os-${{ matrix.os }}-${{ github.sha }}
@@ -199,14 +209,16 @@ jobs:
199209
runs-on: ${{ matrix.os }}
200210

201211
steps:
202-
- name: Checkout codes
203-
uses: actions/checkout@v4
212+
- name: Checkout
213+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
214+
with:
215+
fetch-depth: 0
204216

205217
- name: Install pnpm
206-
uses: pnpm/action-setup@v4
218+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
207219

208220
- name: Setup node
209-
uses: actions/setup-node@v4
221+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
210222
with:
211223
node-version: ${{ matrix.node }}
212224
cache: 'pnpm'
@@ -218,7 +230,7 @@ jobs:
218230
run: pnpm playwright-core install chromium
219231

220232
- name: Restore dist cache
221-
uses: actions/cache@v4
233+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
222234
with:
223235
path: packages/*/dist
224236
key: build-rolldown-vue-i18n-os-${{ matrix.os }}-${{ github.sha }}

‎.github/workflows/github-label-sync.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,4 @@ jobs:
1313
build:
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: r7kamura/github-label-sync-action@v0
16+
- uses: r7kamura/github-label-sync-action@061649dd3b80eb5bafad0316466f72962e62c300 #v0.1.0

‎.github/workflows/nightly-release.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,16 @@ jobs:
1414
runs-on: ubuntu-latest
1515

1616
steps:
17-
- name: Checkout code
18-
uses: actions/checkout@v4
17+
- name: Checkout
18+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
19+
with:
20+
fetch-depth: 0
1921

2022
- name: Install pnpm
21-
uses: pnpm/action-setup@v4
23+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
2224

2325
- name: Setup node
24-
uses: actions/setup-node@v4
26+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
2527
with:
2628
node-version: 20
2729
cache: pnpm

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,16 @@ jobs:
1616
release:
1717
runs-on: ubuntu-latest
1818
steps:
19-
- name: Checkout codes
20-
uses: actions/checkout@v4
19+
- name: Checkout
20+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2121
with:
2222
ref: ${{ github.head_ref }}
2323

2424
- name: Install pnpm
25-
uses: pnpm/action-setup@v4
25+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
2626

2727
- name: Setup Node
28-
uses: actions/setup-node@v4
28+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
2929
with:
3030
node-version: 20
3131

@@ -34,7 +34,7 @@ jobs:
3434

3535
- name: Extract version tag
3636
if: startsWith( github.ref, 'refs/tags/v' )
37-
uses: jungwinter/split@v2
37+
uses: jungwinter/split@397a50dadb89335ec4ef406c53105c3c4d407c63 # v2.0.0
3838
id: split
3939
with:
4040
msg: ${{ github.ref }}
@@ -51,7 +51,7 @@ jobs:
5151
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5252

5353
- name: Commit changelog
54-
uses: stefanzweifel/git-auto-commit-action@v5
54+
uses: stefanzweifel/git-auto-commit-action@8756aa072ef5b4a080af5dc8fef36c5d586e521d # v5.0.0
5555
with:
5656
branch: master
5757
file_pattern: '*.md'

‎.github/workflows/reproduire.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ jobs:
1010
reproduire:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v4
13+
- name: Checkout
14+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
15+
with:
16+
fetch-depth: 0
1417
- uses: Hebilicious/reproduire@4b686ae9cbb72dad60f001d278b6e3b2ce40a9ac # v0.0.9-mp
1518
with:
1619
label: 'Status: Need More Info' # Optional, will default to this value.

‎.github/workflows/size-data.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,16 @@ jobs:
1717
runs-on: ubuntu-latest
1818

1919
steps:
20-
- name: Checkout codes
21-
uses: actions/checkout@v4
20+
- name: Checkout
21+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
22+
with:
23+
fetch-depth: 0
2224

2325
- name: Install pnpm
24-
uses: pnpm/[email protected]
26+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
2527

2628
- name: Setup node
27-
uses: actions/setup-node@v4
29+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
2830
with:
2931
node-version: 23
3032
cache: pnpm
@@ -42,7 +44,7 @@ jobs:
4244
echo ${{ github.base_ref }} > ./temp/size/base.txt
4345
4446
- name: Upload Size Data
45-
uses: actions/upload-artifact@v4
47+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
4648
with:
4749
name: size-data
4850
path: temp/size

‎.github/workflows/size-report.yml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,16 @@ jobs:
2020
github.event.workflow_run.event == 'pull_request' &&
2121
github.event.workflow_run.conclusion == 'success'
2222
steps:
23-
- uses: actions/checkout@v4
23+
- name: Checkout
24+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
25+
with:
26+
fetch-depth: 0
2427

2528
- name: Install pnpm
26-
uses: pnpm/[email protected]
29+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
2730

2831
- name: Install Node.js
29-
uses: actions/setup-node@v4
32+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
3033
with:
3134
node-version: 23
3235
cache: pnpm
@@ -35,26 +38,26 @@ jobs:
3538
run: pnpm install --frozen-lockfile
3639

3740
- name: Download Size Data
38-
uses: dawidd6/action-download-artifact@v8
41+
uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
3942
with:
4043
name: size-data
4144
run_id: ${{ github.event.workflow_run.id }}
4245
path: temp/size
4346

4447
- name: Read PR Number
4548
id: pr-number
46-
uses: juliangruber/read-file-action@v1
49+
uses: juliangruber/read-file-action@e0a316da496006ffd19142f0fd594a1783f3b512 # v1.0.0
4750
with:
4851
path: temp/size/number.txt
4952

5053
- name: Read base branch
5154
id: pr-base
52-
uses: juliangruber/read-file-action@v1
55+
uses: juliangruber/read-file-action@e0a316da496006ffd19142f0fd594a1783f3b512 # v1.0.0
5356
with:
5457
path: temp/size/base.txt
5558

5659
- name: Download Previous Size Data
57-
uses: dawidd6/action-download-artifact@v8
60+
uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
5861
with:
5962
branch: ${{ steps.pr-base.outputs.content }}
6063
workflow: size-data.yml
@@ -68,12 +71,12 @@ jobs:
6871

6972
- name: Read Size Report
7073
id: size-report
71-
uses: juliangruber/read-file-action@v1
74+
uses: juliangruber/read-file-action@e0a316da496006ffd19142f0fd594a1783f3b512 # v1.0.0
7275
with:
7376
path: ./size-report.md
7477

7578
- name: Create Comment
76-
uses: actions-cool/maintain-one-comment@v3
79+
uses: actions-cool/maintain-one-comment@de04bd2a3750d86b324829a3ff34d47e48e16f4b # v3.0.0
7780
with:
7881
token: ${{ secrets.GITHUB_TOKEN }}
7982
number: ${{ steps.pr-number.outputs.content }}

0 commit comments

Comments
 (0)