Skip to content

Commit d6305f1

Browse files
marcelklehrmarcelklehr
authored
Merge pull request #1259 from nextcloud/fix/actions-security
fix(ci): Always use sha hashes for referencing actions
2 parents 1c41a79 + 4872dcf commit d6305f1

File tree

6 files changed

+30
-30
lines changed

6 files changed

+30
-30
lines changed

‎.github/workflows/classifier-faces-test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,17 @@ jobs:
2020

2121
steps:
2222
- name: Checkout app
23-
uses: actions/checkout@v2
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2424

2525
- name: Read package.json node and npm engines version
26-
uses: skjnldsv/read-package-engines-version-actions@v1.1
26+
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
2727
id: versions
2828
with:
2929
fallbackNode: '^12'
3030
fallbackNpm: '^6'
3131

3232
- name: Set up node ${{ steps.versions.outputs.nodeVersion }}
33-
uses: actions/setup-node@v2
33+
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
3434
with:
3535
node-version: ${{ steps.versions.outputs.nodeVersion }}
3636

‎.github/workflows/classifier-landmarks-test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,17 +27,17 @@ jobs:
2727

2828
steps:
2929
- name: Checkout app
30-
uses: actions/checkout@v2
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3131

3232
- name: Read package.json node and npm engines version
33-
uses: skjnldsv/read-package-engines-version-actions@v1.1
33+
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
3434
id: versions
3535
with:
3636
fallbackNode: '^12'
3737
fallbackNpm: '^6'
3838

3939
- name: Set up node ${{ steps.versions.outputs.nodeVersion }}
40-
uses: actions/setup-node@v2
40+
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
4141
with:
4242
node-version: ${{ steps.versions.outputs.nodeVersion }}
4343

‎.github/workflows/classifier-test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,17 @@ jobs:
2020

2121
steps:
2222
- name: Checkout app
23-
uses: actions/checkout@v2
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2424

2525
- name: Read package.json node and npm engines version
26-
uses: skjnldsv/read-package-engines-version-actions@v1.1
26+
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
2727
id: versions
2828
with:
2929
fallbackNode: '^12'
3030
fallbackNpm: '^6'
3131

3232
- name: Set up node ${{ steps.versions.outputs.nodeVersion }}
33-
uses: actions/setup-node@v2
33+
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
3434
with:
3535
node-version: ${{ steps.versions.outputs.nodeVersion }}
3636

‎.github/workflows/cluster-faces-test.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454

5555
steps:
5656
- name: Checkout server
57-
uses: actions/checkout@v2
57+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5858
with:
5959
repository: nextcloud/server
6060
ref: ${{ matrix.server-versions }}
@@ -71,27 +71,27 @@ jobs:
7171
run: sudo apt update && sudo apt install -y ssl-cert
7272

7373
- name: Set up php ${{ matrix.php-versions }}
74-
uses: shivammathur/setup-php@v2
74+
uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # v2.31.1
7575
with:
7676
php-version: ${{ matrix.php-versions }}
7777
tools: phpunit
7878
extensions: mbstring, iconv, fileinfo, intl, sqlite, pdo_mysql, pdo_sqlite, pgsql, pdo_pgsql, gd, zip
7979

8080
- name: Checkout app
81-
uses: actions/checkout@v2
81+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8282
with:
8383
path: apps/${{ env.APP_NAME }}
8484

8585
- name: Read package.json node and npm engines version
86-
uses: skjnldsv/read-package-engines-version-actions@v1.1
86+
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
8787
id: versions
8888
with:
8989
path: apps/${{ env.APP_NAME }}
9090
fallbackNode: '^12'
9191
fallbackNpm: '^6'
9292

9393
- name: Set up node ${{ steps.versions.outputs.nodeVersion }}
94-
uses: actions/setup-node@v2
94+
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
9595
with:
9696
node-version: ${{ steps.versions.outputs.nodeVersion }}
9797

@@ -136,7 +136,7 @@ jobs:
136136
run: |
137137
rm -rf apps/recognize/models
138138
139-
- uses: actions/cache/restore@v3
139+
- uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
140140
id: photos-cache
141141
with:
142142
path: data/admin/files/
@@ -151,7 +151,7 @@ jobs:
151151
unzip IMDb-Face.zip
152152
rm IMDb-Face.zip
153153
154-
- uses: actions/cache/save@v3
154+
- uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
155155
with:
156156
path: data/admin/files/
157157
key: https://cloud.nextcloud.com/public.php/dav/files/wfDk23DBsXYrd4S/IMDb-Face.zip
@@ -163,7 +163,7 @@ jobs:
163163
# only use one core. GH actions has 2
164164
./occ config:app:set --value 1 recognize tensorflow.cores
165165
166-
- uses: actions/cache/restore@v3
166+
- uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
167167
id: db-cache
168168
with:
169169
path: data/nextcloud.db
@@ -177,7 +177,7 @@ jobs:
177177
./occ files:scan admin
178178
./occ recognize:classify
179179
180-
- uses: actions/cache/save@v3
180+
- uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
181181
with:
182182
path: data/nextcloud.db
183183
key: ${{ steps.db-cache.outputs.cache-primary-key }}
@@ -194,7 +194,7 @@ jobs:
194194
run: |
195195
sqlite3 data/nextcloud.db "select x, y, path from oc_recognize_face_detections d LEFT JOIN oc_filecache c ON c.fileid = d.file_id where user_id = 'admin' ORDER BY path;" > out.txt
196196
197-
- uses: actions/cache/restore@v3
197+
- uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
198198
id: clustering-cache
199199
with:
200200
path: out.json
@@ -251,7 +251,7 @@ jobs:
251251
cat out.xml | xq '.["d:multistatus"]["d:response"] | map(select(.["d:href"] | test("faces/.+?/.+?"))) | map({"href": .["d:href"], "realpath": .["d:propstat"][0]["d:prop"]["nc:realpath"], "face-detections": .["d:propstat"][0]["d:prop"]["nc:face-detections"] | fromjson | map({userId, x, y, height, width, clusterId}) })' > out.json
252252
cat out.json
253253
254-
- uses: actions/cache/save@v3
254+
- uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
255255
with:
256256
path: out.json
257257
key: ${{ steps.clustering-cache.outputs.cache-primary-key }}

‎.github/workflows/files-scan-test.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353

5454
steps:
5555
- name: Checkout server
56-
uses: actions/checkout@v2
56+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5757
with:
5858
repository: nextcloud/server
5959
ref: ${{ matrix.server-versions }}
@@ -66,27 +66,27 @@ jobs:
6666
git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1
6767
6868
- name: Set up php ${{ matrix.php-versions }}
69-
uses: shivammathur/setup-php@v2
69+
uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # v2.31.1
7070
with:
7171
php-version: ${{ matrix.php-versions }}
7272
tools: phpunit
7373
extensions: mbstring, iconv, fileinfo, intl, sqlite, pdo_mysql, pdo_sqlite, pgsql, pdo_pgsql, gd, zip
7474

7575
- name: Checkout app
76-
uses: actions/checkout@v2
76+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7777
with:
7878
path: apps/${{ env.APP_NAME }}
7979

8080
- name: Read package.json node and npm engines version
81-
uses: skjnldsv/read-package-engines-version-actions@v1.1
81+
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
8282
id: versions
8383
with:
8484
path: apps/${{ env.APP_NAME }}
8585
fallbackNode: '^12'
8686
fallbackNpm: '^6'
8787

8888
- name: Set up node ${{ steps.versions.outputs.nodeVersion }}
89-
uses: actions/setup-node@v2
89+
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
9090
with:
9191
node-version: ${{ steps.versions.outputs.nodeVersion }}
9292

‎.github/workflows/full-run-test.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ jobs:
7575

7676
steps:
7777
- name: Checkout server
78-
uses: actions/checkout@v2
78+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7979
with:
8080
repository: nextcloud/server
8181
ref: ${{ matrix.server-versions }}
@@ -88,27 +88,27 @@ jobs:
8888
git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1
8989
9090
- name: Set up php ${{ matrix.php-versions }}
91-
uses: shivammathur/setup-php@v2
91+
uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # v2.31.1
9292
with:
9393
php-version: ${{ matrix.php-versions }}
9494
tools: phpunit
9595
extensions: mbstring, iconv, fileinfo, intl, sqlite, pdo_mysql, pdo_sqlite, pgsql, pdo_pgsql, gd, zip
9696

9797
- name: Checkout app
98-
uses: actions/checkout@v2
98+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9999
with:
100100
path: apps/${{ env.APP_NAME }}
101101

102102
- name: Read package.json node and npm engines version
103-
uses: skjnldsv/read-package-engines-version-actions@v1.1
103+
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
104104
id: versions
105105
with:
106106
path: apps/${{ env.APP_NAME }}
107107
fallbackNode: '^12'
108108
fallbackNpm: '^6'
109109

110110
- name: Set up node ${{ steps.versions.outputs.nodeVersion }}
111-
uses: actions/setup-node@v2
111+
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
112112
with:
113113
node-version: ${{ steps.versions.outputs.nodeVersion }}
114114

0 commit comments

Comments
 (0)