Skip to content

Commit 292e135

Browse files
github-security-botgithub-security-bot
committed
Pin GitHub Actions to commit SHAs
1 parent 7d13a7a commit 292e135

13 files changed

Lines changed: 36 additions & 34 deletions

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,5 @@ updates:
1717
directory: "/"
1818
schedule:
1919
interval: "weekly"
20+
cooldown:
21+
default-days: 7

‎.github/workflows/ai-issue-assessment.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v7
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1818

1919
- name: Run AI assessment
2020
uses: github/ai-assessment-comment-labeler@e3bedc38cfffa9179fe4cee8f7ecc93bffb3fee7 # v1.0.1

‎.github/workflows/close-inactive-issues.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
issues: write
1515
pull-requests: write
1616
steps:
17-
- uses: actions/stale@v11
17+
- uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
1818
with:
1919
days-before-issue-stale: ${{ env.PR_DAYS_BEFORE_STALE }}
2020
days-before-issue-close: ${{ env.PR_DAYS_BEFORE_CLOSE }}

‎.github/workflows/code-scanning.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@ jobs:
4141
runner: '["ubuntu-22.04"]'
4242
steps:
4343
- name: Checkout repository
44-
uses: actions/checkout@v7
44+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4545

4646
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@v4.37.9
47+
uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
4848
with:
4949
languages: ${{ matrix.language }}
5050
build-mode: ${{ matrix.build-mode }}
@@ -61,26 +61,26 @@ jobs:
6161
threat-models: [ ]
6262
- name: Setup proxy for registries
6363
id: proxy
64-
uses: github/codeql-action/start-proxy@v4.37.9
64+
uses: github/codeql-action/start-proxy@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
6565
with:
6666
registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }}
6767
language: ${{ matrix.language }}
6868

6969
- name: Configure
70-
uses: github/codeql-action/resolve-environment@v4.37.9
70+
uses: github/codeql-action/resolve-environment@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
7171
id: resolve-environment
7272
with:
7373
language: ${{ matrix.language }}
7474
- name: Setup Go
75-
uses: actions/setup-go@v7
75+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
7676
if: matrix.language == 'go' && fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version
7777
with:
7878
go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }}
7979
cache: false
8080

8181
- name: Set up Node.js (for JavaScript CodeQL)
8282
if: matrix.language == 'javascript'
83-
uses: actions/setup-node@v7
83+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
8484
with:
8585
node-version: "20"
8686
cache: "npm"
@@ -91,10 +91,10 @@ jobs:
9191
uses: ./.github/actions/build-ui
9292

9393
- name: Autobuild
94-
uses: github/codeql-action/autobuild@v4.37.9
94+
uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
9595

9696
- name: Perform CodeQL Analysis
97-
uses: github/codeql-action/analyze@v4.37.9
97+
uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
9898
env:
9999
CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
100100
CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}

‎.github/workflows/docker-publish.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040

4141
steps:
4242
- name: Checkout repository
43-
uses: actions/checkout@v7
43+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4444

4545
# Install the cosign tool except on PR
4646
# https://github.com/sigstore/cosign-installer
@@ -87,7 +87,7 @@ jobs:
8787
type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
8888
8989
- name: Go Build Cache for Docker
90-
uses: actions/cache@v6
90+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
9191
with:
9292
path: go-build-cache
9393
key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}

‎.github/workflows/docs-check.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@v7
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1818

1919
- name: Build UI
2020
uses: ./.github/actions/build-ui
2121

2222
- name: Set up Go
23-
uses: actions/setup-go@v7
23+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
2424
with:
2525
go-version-file: 'go.mod'
2626

‎.github/workflows/go.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ jobs:
2323
git config --global core.eol lf
2424
2525
- name: Check out code
26-
uses: actions/checkout@v7
26+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2727

2828
- name: Build UI
2929
uses: ./.github/actions/build-ui
3030

3131
- name: Set up Go
32-
uses: actions/setup-go@v7
32+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
3333
with:
3434
go-version-file: "go.mod"
3535

‎.github/workflows/goreleaser.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ jobs:
1414

1515
steps:
1616
- name: Check out code
17-
uses: actions/checkout@v7
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1818

1919
- name: Build UI
2020
uses: ./.github/actions/build-ui
2121

2222
- name: Set up Go
23-
uses: actions/setup-go@v7
23+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
2424
with:
2525
go-version-file: "go.mod"
2626

@@ -42,7 +42,7 @@ jobs:
4242
OAUTH_CLIENT_SECRET: ${{ secrets.OAUTH_CLIENT_SECRET }}
4343

4444
- name: Generate signed build provenance attestations for workflow artifacts
45-
uses: actions/attest-build-provenance@v4
45+
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
4646
with:
4747
subject-path: |
4848
dist/*.tar.gz

‎.github/workflows/license-check.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424

2525
steps:
2626
- name: Check out code
27-
uses: actions/checkout@v7
27+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2828

2929
# Check out the actual PR branch so we can push changes back if needed
3030
- name: Check out PR branch
@@ -36,7 +36,7 @@ jobs:
3636
uses: ./.github/actions/build-ui
3737

3838
- name: Set up Go
39-
uses: actions/setup-go@v7
39+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
4040
with:
4141
go-version-file: "go.mod"
4242

@@ -70,7 +70,7 @@ jobs:
7070
- name: Check if already commented
7171
if: steps.changes.outcome == 'failure' && steps.push.outcome == 'failure'
7272
id: check_comment
73-
uses: actions/github-script@v9
73+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
7474
with:
7575
script: |
7676
const { data: comments } = await github.rest.issues.listComments({
@@ -88,7 +88,7 @@ jobs:
8888
8989
- name: Comment with instructions if cannot push
9090
if: steps.changes.outcome == 'failure' && steps.push.outcome == 'failure' && steps.check_comment.outputs.already_commented == 'false'
91-
uses: actions/github-script@v9
91+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
9292
with:
9393
script: |
9494
await github.rest.issues.createComment({

‎.github/workflows/lint.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ jobs:
1313
name: lint
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@v7
16+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1717
- name: Build UI
1818
uses: ./.github/actions/build-ui
19-
- uses: actions/setup-go@v7
19+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
2020
with:
2121
go-version: '1.25'
2222
- name: golangci-lint
23-
uses: golangci/golangci-lint-action@v9
23+
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
2424
with:
2525
# sync with script/lint
2626
version: v2.9

0 commit comments

Comments
 (0)