Skip to content

Commit 16ace55

Browse files
anujm1anujm1
committed
ci: pin all GitHub actions by hash
GitHub [1] and zizmor [2] recommend that actions, especially third party actions, should be pinned by hash instead of tags since tags are mutable and can introduce vulnerabilities if a malicious actor gains access to the action repository [3]. Change all actions to use hash instead of tag. [1] https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions [2] https://docs.zizmor.sh/audits/#unpinned-uses [3] https://nvd.nist.gov/vuln/detail/cve-2025-30066 Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
1 parent 93b2dbb commit 16ace55

File tree

8 files changed

+35
-35
lines changed

8 files changed

+35
-35
lines changed

‎.github/actions/lava-test-plans/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ inputs:
2323
runs:
2424
using: "composite"
2525
steps:
26-
- uses: actions/checkout@v6.0.2
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727
with:
2828
persist-credentials: false
2929
repository: qualcomm-linux/lava-test-plans

‎.github/workflows/build-yocto.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
wget -qO ${KAS_CONTAINER} https://raw.githubusercontent.com/siemens/kas/refs/tags/$LATEST/kas-container
3535
chmod +x ${KAS_CONTAINER}
3636
37-
- uses: actions/checkout@v6.0.2
37+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838
with:
3939
persist-credentials: false
4040

@@ -43,13 +43,13 @@ jobs:
4343
${KAS_CONTAINER} lock --update ci/base.yml:ci/qcom-distro.yml
4444
4545
- name: Upload kas lockfile
46-
uses: actions/upload-artifact@v6
46+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
4747
with:
4848
name: kas-lockfile
4949
path: ci/*.lock.yml
5050

5151
- name: Upload kas-container
52-
uses: actions/upload-artifact@v6
52+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
5353
with:
5454
name: kas-container
5555
path: ${{ env.KAS_CONTAINER }}
@@ -59,18 +59,18 @@ jobs:
5959
if: github.repository_owner == 'qualcomm-linux'
6060
runs-on: [self-hosted, qcom-u2404, amd64]
6161
steps:
62-
- uses: actions/checkout@v6.0.2
62+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6363
with:
6464
persist-credentials: false
6565

6666
- name: Download kas lockfile
67-
uses: actions/download-artifact@v7
67+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
6868
with:
6969
name: kas-lockfile
7070
path: ci
7171

7272
- name: Download kas-container
73-
uses: actions/download-artifact@v7
73+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
7474
with:
7575
name: kas-container
7676
path: ${{ runner.temp }}
@@ -120,7 +120,7 @@ jobs:
120120
yamlfile: ":ci/linux-qcom-rt-6.18.yml:ci/qcom-distro-kvm.yml"
121121
name: ${{ matrix.machine }}/${{ matrix.distro.name }}${{ matrix.kernel.dirname }}
122122
steps:
123-
- uses: actions/checkout@v6.0.2
123+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
124124
with:
125125
persist-credentials: false
126126

@@ -243,7 +243,7 @@ jobs:
243243
yamlfile: ":ci/linux-qcom-6.18.yml:ci/u-boot-qcom.yml"
244244
name: ${{ matrix.machine }}/${{ matrix.distro.name }}${{ matrix.kernel.dirname }}
245245
steps:
246-
- uses: actions/checkout@v6.0.2
246+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
247247
with:
248248
persist-credentials: false
249249

@@ -264,7 +264,7 @@ jobs:
264264
runs-on: [self-hosted, qcom-u2404, amd64]
265265
steps:
266266
- name: 'Download build URLs'
267-
uses: actions/download-artifact@v7
267+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
268268
with:
269269
github-token: ${{ secrets.GITHUB_TOKEN }}
270270
pattern: build-url*

‎.github/workflows/pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Upload
22-
uses: actions/upload-artifact@v6
22+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
2323
with:
2424
name: Event File
2525
path: ${{ github.event_path }}

‎.github/workflows/publish-results.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ jobs:
2828
runs-on: ubuntu-latest
2929
steps:
3030
- name: Download result files
31-
uses: actions/download-artifact@v7
31+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
3232
with:
3333
run-id: ${{ inputs.workflow_id }}
3434
path: artifacts
3535
github-token: ${{ github.token }}
3636

3737
- name: Download result files PR
3838
if: ${{ github.run_id != inputs.workflow_id }}
39-
uses: actions/download-artifact@v7
39+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
4040
with:
4141
path: artifacts
4242
github-token: ${{ github.token }}
@@ -52,14 +52,14 @@ jobs:
5252
fi
5353
5454
- id: app_token
55-
uses: actions/create-github-app-token@v2
55+
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.0
5656
if: always()
5757
with:
5858
app-id: 2291458
5959
private-key: ${{ secrets.TEST_REPORTING_APP_TOKEN }}
6060

6161
- name: Publish Test Results
62-
uses: EnricoMi/publish-unit-test-result-action@v2
62+
uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
6363
if: |
6464
always()
6565
&& contains(steps.listfiles.outcome, 'success')

‎.github/workflows/repolinter.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,22 @@ jobs:
1313
runs-on: ubuntu-latest
1414
steps:
1515
- name: Checkout Repo
16-
uses: actions/checkout@v6.0.2
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1717
with:
1818
persist-credentials: false
1919

2020
- name: Verify repolinter config file is present
2121
id: check_files
22-
uses: andstor/file-existence-action@v3
22+
uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3
2323
with:
2424
files: "repolint.json"
2525
- name: Run Repolinter with local repolint.json
2626
if: steps.check_files.outputs.files_exists == 'true'
27-
uses: todogroup/repolinter-action@v1
27+
uses: todogroup/repolinter-action@4d478dcd860571382da7d512d6dc6dd5f554fbb2 # v1.7.3
2828
with:
2929
config_file: "repolint.json"
3030
- name: Run Repolinter with default ruleset
3131
if: steps.check_files.outputs.files_exists == 'false'
32-
uses: todogroup/repolinter-action@v1
32+
uses: todogroup/repolinter-action@4d478dcd860571382da7d512d6dc6dd5f554fbb2 # v1.7.3
3333
with:
3434
config_url: "https://raw.githubusercontent.com/quic/.github/main/repolint.json"

‎.github/workflows/stales.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
stale:
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/stale@v9
14+
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
1515
with:
1616
stale-issue-message: 'This issue has been marked as stale due to 30 days of inactivity. Please add a comment and close if it is resolved or if it is no longer relevant.'
1717
stale-pr-message: 'This pull request has been marked as stale due to 30 days of inactivity. To prevent automatic closure in 5 days, remove the stale label or add a comment. You can reopen a closed pull request at any time.'

‎.github/workflows/test-pr.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@ jobs:
3030

3131
- name: Download Result Summary
3232
id: download-result-summary
33-
uses: actions/download-artifact@v7
33+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
3434
with:
3535
artifact-ids: ${{ needs.test.outputs.summary_id }}
3636
path: results_summary
3737

3838
- name: Download event file
39-
uses: actions/download-artifact@v7
39+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
4040
with:
4141
run-id: ${{ github.event.workflow_run.id }}
4242
path: artifacts
@@ -58,7 +58,7 @@ jobs:
5858
echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
5959
6060
- name: Comment on PR
61-
uses: thollander/actions-comment-pull-request@v3
61+
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3
6262
with:
6363
file-path: pr-comment.txt
6464
pr-number: ${{ steps.pr_comment_prep.outputs.pr_number }}

‎.github/workflows/test.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
- machine: qcom-armv7a
4141
kernel: _linux-qcom-6.18
4242
steps:
43-
- uses: actions/checkout@v6.0.2
43+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4444
with:
4545
fetch-depth: 0
4646
persist-credentials: false
@@ -61,7 +61,7 @@ jobs:
6161
outputs:
6262
jobmatrix: ${{ steps.listjobs.outputs.jobmatrix }}
6363
steps:
64-
- uses: actions/checkout@v6.0.2
64+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6565
with:
6666
fetch-depth: 0
6767
persist-credentials: false
@@ -83,14 +83,14 @@ jobs:
8383
matrix: ${{ fromJson(needs.prepare-boot-job-list.outputs.jobmatrix) }}
8484
steps:
8585
- name: 'Download job templates'
86-
uses: actions/download-artifact@v7
86+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
8787
with:
8888
name: ${{ matrix.target.artifact }}
8989

9090
- name: Submit ${{ matrix.target.name }}
9191
timeout-minutes: 20
9292
id: submit
93-
uses: foundriesio/lava-action@v9
93+
uses: foundriesio/lava-action@fe00b480d3b0f276cb4023052c7f6bc67e805953 # v9
9494
with:
9595
lava_token: ${{ secrets.LAVATOKEN }}
9696
lava_url: 'lava.infra.foundries.io'
@@ -101,7 +101,7 @@ jobs:
101101
save_result_as_artifact: true
102102
save_job_details: true
103103
result_file_name: "${{ matrix.target.result_file }}"
104-
- uses: mwasilew/github-action-matrix-outputs-write@v2
104+
- uses: mwasilew/github-action-matrix-outputs-write@f7202d2224ebed937f287a2e2813e47fddd12bc8 # v2
105105
if: always()
106106
id: out
107107
with:
@@ -118,7 +118,7 @@ jobs:
118118
outputs:
119119
boot_result: "${{ steps.print-boot-result.outputs.boot_result }}"
120120
steps:
121-
- uses: cloudposse/github-action-matrix-outputs-read@v1
121+
- uses: cloudposse/github-action-matrix-outputs-read@33cac12fa9282a7230a418d859b93fdbc4f27b5a # v1
122122
id: read
123123
with:
124124
matrix-step-name: "submit-boot-job"
@@ -167,7 +167,7 @@ jobs:
167167
run: |
168168
echo "${RESULT}"
169169
170-
- uses: actions/checkout@v6.0.2
170+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
171171
with:
172172
fetch-depth: 0
173173
persist-credentials: false
@@ -189,7 +189,7 @@ jobs:
189189
outputs:
190190
jobmatrix: ${{ steps.listjobs.outputs.jobmatrix }}
191191
steps:
192-
- uses: actions/checkout@v6.0.2
192+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
193193
with:
194194
fetch-depth: 0
195195
persist-credentials: false
@@ -211,13 +211,13 @@ jobs:
211211
matrix: ${{ fromJson(needs.prepare-premerge-job-list.outputs.jobmatrix) }}
212212
steps:
213213
- name: 'Download job templates'
214-
uses: actions/download-artifact@v7
214+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
215215
with:
216216
name: ${{ matrix.target.artifact}}
217217

218218
- name: Submit ${{ matrix.target.name }}
219219
timeout-minutes: 20
220-
uses: foundriesio/lava-action@v9
220+
uses: foundriesio/lava-action@fe00b480d3b0f276cb4023052c7f6bc67e805953 # v9
221221
with:
222222
lava_token: ${{ secrets.LAVATOKEN }}
223223
lava_url: 'lava.infra.foundries.io'
@@ -244,7 +244,7 @@ jobs:
244244
summary_id: ${{ steps.generate-summary.outputs.artifact_id }}
245245

246246
steps:
247-
- uses: actions/checkout@v6.0.2
247+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
248248
with:
249249
fetch-depth: 0
250250
persist-credentials: false
@@ -258,7 +258,7 @@ jobs:
258258
summary_file_name: test_job_summary
259259

260260
- name: Download Summary
261-
uses: actions/download-artifact@v7
261+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
262262
with:
263263
artifact-ids: ${{ steps.generate-summary.outputs.artifact_id }}
264264

0 commit comments

Comments
 (0)