Skip to content

Commit ff7a7a2

Browse files
cwayne18cwayne18
authored
Merge pull request #91 from cwayne18/pin-actions-to-sha
Pin GH Actions to commit sha
2 parents 019918f + f3d26fa commit ff7a7a2

File tree

5 files changed

+34
-34
lines changed

5 files changed

+34
-34
lines changed

‎.github/workflows/build.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -12,29 +12,29 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v6
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1616

1717
- name: Set the TAG value
1818
id: get-TAG
1919
run: |
2020
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
2121
2222
- name: Set up QEMU
23-
uses: docker/setup-qemu-action@v4
23+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
2424

2525
- name: Set up Docker Buildx
26-
uses: docker/setup-buildx-action@v4
26+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
2727

2828
- name: Build container image
29-
uses: docker/build-push-action@v7
29+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
3030
with:
3131
context: .
3232
push: false
3333
tags: rancher/hardened-containerd:${{ env.TAG }}-amd64
3434
file: Dockerfile
3535

3636
- name: Run Trivy vulnerability scanner
37-
uses: aquasecurity/trivy-action@0.35.0
37+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
3838
with:
3939
image-ref: rancher/hardened-containerd:${{ env.TAG }}-amd64
4040
format: 'table'
@@ -48,21 +48,21 @@ jobs:
4848
runs-on: ubuntu-latest
4949
steps:
5050
- name: Check out code
51-
uses: actions/checkout@v6
51+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5252

5353
- name: Set up QEMU
54-
uses: docker/setup-qemu-action@v4
54+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
5555

5656
- name: Set up Docker Buildx
57-
uses: docker/setup-buildx-action@v4
57+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
5858

5959
- name: Set the TAG value
6060
id: get-TAG
6161
run: |
6262
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
6363
6464
- name: Build container image
65-
uses: docker/build-push-action@v7
65+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
6666
with:
6767
context: .
6868
push: false
@@ -74,7 +74,7 @@ jobs:
7474
ARCH=arm64
7575
7676
- name: Run Trivy vulnerability scanner
77-
uses: aquasecurity/trivy-action@0.35.0
77+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
7878
with:
7979
image-ref: rancher/hardened-containerd:${{ env.TAG }}-arm64
8080
format: 'table'
@@ -88,20 +88,20 @@ jobs:
8888
runs-on: ubuntu-latest
8989
steps:
9090
- name: Check out code
91-
uses: actions/checkout@v6
91+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9292

9393
- name: Set up QEMU
94-
uses: docker/setup-qemu-action@v4
94+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
9595

9696
- name: Set up Docker Buildx
97-
uses: docker/setup-buildx-action@v4
97+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
9898

9999
- name: Set the TAG value
100100
id: get-TAG
101101
run: |
102102
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
103103
- name: Build container image
104-
uses: docker/build-push-action@v7
104+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
105105
with:
106106
context: .
107107
push: false
@@ -111,7 +111,7 @@ jobs:
111111
platforms: linux/amd64
112112

113113
- name: Run Trivy vulnerability scanner
114-
uses: aquasecurity/trivy-action@0.35.0
114+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
115115
with:
116116
image-ref: rancher/hardened-containerd:${{ env.TAG }}-amd64-windows
117117
format: 'table'
@@ -120,4 +120,4 @@ jobs:
120120
vuln-type: 'os,library'
121121
severity: 'CRITICAL,HIGH'
122122
continue-on-error: true
123-
123+

‎.github/workflows/image-push.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ jobs:
1313
runs-on: ubuntu-latest
1414
steps:
1515
- name: Check out code
16-
uses: actions/checkout@v6
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1717

1818
- name: Set the TAG value
1919
id: get-TAG
2020
run: |
2121
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
2222
2323
- name: Set up QEMU
24-
uses: docker/setup-qemu-action@v4
24+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
2525

2626
- name: "Read secrets"
27-
uses: rancher-eio/read-vault-secrets@main
27+
uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
2828
with:
2929
secrets: |
3030
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
@@ -37,30 +37,30 @@ jobs:
3737
secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials password | STAGING_REGISTRY_PASSWORD ;
3838
3939
- name: Set up Docker Buildx
40-
uses: docker/setup-buildx-action@v4
40+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
4141

4242
- name: Login to Container Registry
43-
uses: docker/login-action@v4
43+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
4444
with:
4545
username: ${{ env.DOCKER_USERNAME }}
4646
password: ${{ env.DOCKER_PASSWORD }}
4747

4848
- name: Login to Staging Registry
49-
uses: docker/login-action@v4
49+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
5050
with:
5151
registry: ${{ env.STAGING_REGISTRY }}
5252
username: ${{ env.STAGING_REGISTRY_USERNAME }}
5353
password: ${{ env.STAGING_REGISTRY_PASSWORD }}
5454

5555
- name: Login to Prime Registry
56-
uses: docker/login-action@v4
56+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
5757
with:
5858
registry: ${{ env.PRIME_REGISTRY }}
5959
username: ${{ env.PRIME_REGISTRY_USERNAME }}
6060
password: ${{ env.PRIME_REGISTRY_PASSWORD }}
6161

6262
- name: Build container image
63-
uses: docker/build-push-action@v7
63+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
6464
with:
6565
context: .
6666
push: true
@@ -71,7 +71,7 @@ jobs:
7171
TAG=${{ env.TAG }}
7272
7373
- name: Build container image for Windows
74-
uses: docker/build-push-action@v7
74+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
7575
with:
7676
context: .
7777
push: true

‎.github/workflows/republish-latest.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,21 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: "Read Secrets"
19-
uses: rancher-eio/read-vault-secrets@main
19+
uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
2020
with:
2121
secrets: |
2222
secret/data/github/repo/${{ github.repository }}/github/rancher-release-team-auto-tagger/app-credentials appId | APP_ID ;
2323
secret/data/github/repo/${{ github.repository }}/github/rancher-release-team-auto-tagger/app-credentials privateKey | PRIVATE_KEY
2424
2525
- name: Generate GitHub App token
2626
id: generate-token
27-
uses: actions/create-github-app-token@v2
27+
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
2828
with:
2929
app-id: ${{ env.APP_ID }}
3030
private-key: ${{ env.PRIVATE_KEY }}
3131

3232
- name: Republish Latest Release
33-
uses: rancher/ecm-distro-tools/actions/republish-latest@master
33+
uses: rancher/ecm-distro-tools/actions/republish-latest@10ab39987d39be83da6a252c1c3b540e496e0287 # v0.66.0
3434
with:
3535
owner: ${{ github.repository_owner }}
3636
repo: ${{ github.event.repository.name }}

‎.github/workflows/sync-upstream.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,21 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: "Read Secrets"
17-
uses: rancher-eio/read-vault-secrets@main
17+
uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
1818
with:
1919
secrets: |
2020
secret/data/github/repo/${{ github.repository }}/github/rancher-release-team-auto-tagger/app-credentials appId | APP_ID ;
2121
secret/data/github/repo/${{ github.repository }}/github/rancher-release-team-auto-tagger/app-credentials privateKey | PRIVATE_KEY
2222
2323
- name: Generate GitHub App token
2424
id: generate-token
25-
uses: actions/create-github-app-token@v2
25+
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
2626
with:
2727
app-id: ${{ env.APP_ID }}
2828
private-key: ${{ env.PRIVATE_KEY }}
2929

3030
- name: Sync Upstream Releases
31-
uses: rancher/ecm-distro-tools/actions/sync-upstream-release@master
31+
uses: rancher/ecm-distro-tools/actions/sync-upstream-release@10ab39987d39be83da6a252c1c3b540e496e0287 # v0.66.0
3232
with:
3333
upstream-owner: 'k3s-io'
3434
upstream-repo: 'containerd'

‎.github/workflows/updatecli.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@ jobs:
1818
if: github.ref == 'refs/heads/master'
1919
steps:
2020
- name: Checkout
21-
uses: actions/checkout@v6
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2222

2323
- name: Install Go
24-
uses: actions/setup-go@v6
24+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
2525
with:
2626
go-version: 'stable'
2727

2828
- name: Install Updatecli
29-
uses: updatecli/updatecli-action@v2
29+
uses: updatecli/updatecli-action@4b17f4ea784de29f71f85f9bc4955402ba1ae53c # v2.100.0
3030

3131
- name: Delete leftover UpdateCLI branches
3232
run: |

0 commit comments

Comments
 (0)