From f2db53b59a66c53d73c6b022be5f444990f1abb2 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Mon, 7 Apr 2025 21:34:59 +0000 Subject: [PATCH 1/6] [StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot --- .github/workflows/benchmark.yml | 8 ++-- .github/workflows/ci.yml | 48 +++++++++++------------ .github/workflows/integration_tests.yml | 6 +-- .github/workflows/markdown-link-check.yml | 2 +- .github/workflows/pr_naming.yml | 2 +- .github/workflows/semver.yml | 6 +-- 6 files changed, 36 insertions(+), 36 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index d49293d09d..7b63e55679 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -35,15 +35,15 @@ jobs: # For pushes to main, compare against the previous commit BRANCH_NAME: ${{ github.event_name == 'pull_request' && github.base_ref || github.event.before }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 10 # Fetch current commit and its parent - - uses: arduino/setup-protoc@v3 + - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master with: toolchain: stable - - uses: boa-dev/criterion-compare-action@v3 + - uses: boa-dev/criterion-compare-action@adfd3a94634fe2041ce5613eb7df09d247555b87 # v3.2.4 with: branchName: ${{ env.BRANCH_NAME }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb94d8e787..96851a1e70 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,16 +36,16 @@ jobs: sudo rm -rf /usr/local/lib/android sudo rm -rf /usr/share/dotnet df -h - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master with: toolchain: ${{ matrix.rust }} components: rustfmt - name: "Set rustup profile" run: rustup set profile minimal - - uses: arduino/setup-protoc@v3 + - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Test @@ -53,16 +53,16 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable with: components: rustfmt, clippy - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45 with: tool: cargo-hack - - uses: arduino/setup-protoc@v3 + - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Format @@ -75,8 +75,8 @@ jobs: example: [opentelemetry, opentelemetry-sdk, opentelemetry-otlp, opentelemetry-zipkin] runs-on: ubuntu-latest # TODO: Check if this could be covered for Windows. The step used currently fails on Windows. steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@nightly + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: dtolnay/rust-toolchain@a02741459ec5e501b9843ed30b535ca0a0376ae4 # nightly with: toolchain: nightly-2024-06-30 components: rustfmt @@ -93,11 +93,11 @@ jobs: runs-on: ${{ matrix.os }} continue-on-error: true steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - name: Set up Rust ${{ matrix.rust }} - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master with: toolchain: ${{ matrix.rust }} - name: Patch dependencies versions @@ -108,19 +108,19 @@ jobs: runs-on: ubuntu-latest # This uses the step `EmbarkStudios/cargo-deny-action@v1` which is only supported on Linux continue-on-error: true # Prevent sudden announcement of a new advisory from failing ci steps: - - uses: actions/checkout@v4 - - uses: EmbarkStudios/cargo-deny-action@v2 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.11 with: command: check advisories docs: continue-on-error: true runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable with: components: rustfmt - - uses: arduino/setup-protoc@v3 + - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: doc @@ -133,25 +133,25 @@ jobs: runs-on: ubuntu-latest if: ${{ ! contains(github.event.pull_request.labels.*.name, 'dependencies') }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable with: toolchain: stable components: rustfmt,llvm-tools-preview - - uses: arduino/setup-protoc@v3 + - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: cargo install cargo-llvm-cov - uses: taiki-e/install-action@cargo-llvm-cov + uses: taiki-e/install-action@5075451c95db43b063f20f0c8fef04c04d5bf0ba # cargo-llvm-cov - name: cargo generate-lockfile if: hashFiles('Cargo.lock') == '' run: cargo generate-lockfile - name: cargo llvm-cov run: cargo llvm-cov --locked --all-features --workspace --lcov --lib --output-path lcov.info - name: Upload to codecov.io - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -160,13 +160,13 @@ jobs: continue-on-error: true runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master with: toolchain: stable - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45 with: tool: cargo-machete - name: cargo machete diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml index 076871508b..bd82b5a0f6 100644 --- a/.github/workflows/integration_tests.yml +++ b/.github/workflows/integration_tests.yml @@ -16,13 +16,13 @@ jobs: sudo rm -rf /usr/local/lib/android sudo rm -rf /usr/share/dotnet df -h - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable with: components: rustfmt - - uses: arduino/setup-protoc@v3 + - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Run integration tests diff --git a/.github/workflows/markdown-link-check.yml b/.github/workflows/markdown-link-check.yml index a262512c2d..cc7d88f37e 100644 --- a/.github/workflows/markdown-link-check.yml +++ b/.github/workflows/markdown-link-check.yml @@ -15,7 +15,7 @@ jobs: markdown-link-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install markdown-link-check run: npm install -g markdown-link-check@3.11.2 diff --git a/.github/workflows/pr_naming.yml b/.github/workflows/pr_naming.yml index 97f62abfaf..340f28136b 100644 --- a/.github/workflows/pr_naming.yml +++ b/.github/workflows/pr_naming.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: PR Conventional Commit Validation - uses: ytanikin/pr-conventional-commits@1.4.1 + uses: ytanikin/pr-conventional-commits@8267db1bacc237419f9ed0228bb9d94e94271a1d # 1.4.1 with: task_types: '["build","chore","ci","docs","feat","fix","perf","refactor","revert","test"]' add_label: 'false' diff --git a/.github/workflows/semver.yml b/.github/workflows/semver.yml index caf85c03d3..5c165a5336 100644 --- a/.github/workflows/semver.yml +++ b/.github/workflows/semver.yml @@ -10,12 +10,12 @@ jobs: timeout-minutes: 10 if: ${{ github.event.label.name == 'semver-check' || contains(github.event.pull_request.labels.*.name, 'semver-check') }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - name: Install stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable with: components: rustfmt - name: cargo-semver-checks - uses: obi1kenobi/cargo-semver-checks-action@v2.6 + uses: obi1kenobi/cargo-semver-checks-action@7272cc2caa468d3e009a2b0a9cc366839348237b # v2.6 From 9d493848ab87657c779d3f5e215fa3bfc9912bd8 Mon Sep 17 00:00:00 2001 From: Utkarsh Umesan Pillai <66651184+utpilla@users.noreply.github.com> Date: Mon, 7 Apr 2025 15:31:21 -0700 Subject: [PATCH 2/6] Update .github/workflows/benchmark.yml --- .github/workflows/benchmark.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 7b63e55679..d9715573f0 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -41,7 +41,7 @@ jobs: - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master + - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 with: toolchain: stable - uses: boa-dev/criterion-compare-action@adfd3a94634fe2041ce5613eb7df09d247555b87 # v3.2.4 From a311c57735569d8e6fb6b7214ca8be3939184365 Mon Sep 17 00:00:00 2001 From: Utkarsh Umesan Pillai <66651184+utpilla@users.noreply.github.com> Date: Mon, 7 Apr 2025 15:31:28 -0700 Subject: [PATCH 3/6] Update .github/workflows/ci.yml --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 96851a1e70..033b451690 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master + - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 with: toolchain: ${{ matrix.rust }} components: rustfmt From e30d73fba2ff27fbbe9753d1a1af3db7ef254622 Mon Sep 17 00:00:00 2001 From: Utkarsh Umesan Pillai <66651184+utpilla@users.noreply.github.com> Date: Mon, 7 Apr 2025 15:31:34 -0700 Subject: [PATCH 4/6] Update .github/workflows/ci.yml --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 033b451690..fd665f7a54 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: components: rustfmt, clippy - uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45 From e146a1f6b88641d461f76be6dd4b0082cb82aac7 Mon Sep 17 00:00:00 2001 From: Utkarsh Umesan Pillai <66651184+utpilla@users.noreply.github.com> Date: Mon, 7 Apr 2025 22:35:58 +0000 Subject: [PATCH 5/6] Address PR comments --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/integration_tests.yml | 2 +- .github/workflows/semver.yml | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fd665f7a54..a679898a75 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -76,7 +76,7 @@ jobs: runs-on: ubuntu-latest # TODO: Check if this could be covered for Windows. The step used currently fails on Windows. steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@a02741459ec5e501b9843ed30b535ca0a0376ae4 # nightly + - uses: dtolnay/rust-toolchain@a02741459ec5e501b9843ed30b535ca0a0376ae4 with: toolchain: nightly-2024-06-30 components: rustfmt @@ -97,7 +97,7 @@ jobs: with: submodules: true - name: Set up Rust ${{ matrix.rust }} - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master + uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 with: toolchain: ${{ matrix.rust }} - name: Patch dependencies versions @@ -117,7 +117,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: components: rustfmt - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 @@ -136,7 +136,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: toolchain: stable components: rustfmt,llvm-tools-preview @@ -163,7 +163,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master + - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 with: toolchain: stable - uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45 diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml index bd82b5a0f6..ce40952e78 100644 --- a/.github/workflows/integration_tests.yml +++ b/.github/workflows/integration_tests.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: submodules: true - - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: components: rustfmt - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 diff --git a/.github/workflows/semver.yml b/.github/workflows/semver.yml index 5c165a5336..3b455a9ef9 100644 --- a/.github/workflows/semver.yml +++ b/.github/workflows/semver.yml @@ -14,7 +14,7 @@ jobs: with: submodules: true - name: Install stable - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable + uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: components: rustfmt - name: cargo-semver-checks From 2ba575c2726ea1bd582c28ebfd30b1db862bdae0 Mon Sep 17 00:00:00 2001 From: Utkarsh Umesan Pillai <66651184+utpilla@users.noreply.github.com> Date: Tue, 8 Apr 2025 00:07:36 +0000 Subject: [PATCH 6/6] Address PR comments --- .github/workflows/ci.yml | 2 ++ .github/workflows/integration_tests.yml | 1 + .github/workflows/semver.yml | 1 + 3 files changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8546835b3f..2bb319317e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -59,6 +59,7 @@ jobs: submodules: true - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: + toolchain: stable components: rustfmt, clippy - uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45 with: @@ -120,6 +121,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: + toolchain: stable components: rustfmt - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml index 2f3ddfb723..c26e0578fd 100644 --- a/.github/workflows/integration_tests.yml +++ b/.github/workflows/integration_tests.yml @@ -23,6 +23,7 @@ jobs: submodules: true - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: + toolchain: stable components: rustfmt - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 with: diff --git a/.github/workflows/semver.yml b/.github/workflows/semver.yml index f9cc349306..98475ab264 100644 --- a/.github/workflows/semver.yml +++ b/.github/workflows/semver.yml @@ -17,6 +17,7 @@ jobs: - name: Install stable uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: + toolchain: stable components: rustfmt - name: cargo-semver-checks uses: obi1kenobi/cargo-semver-checks-action@7272cc2caa468d3e009a2b0a9cc366839348237b # v2.6