From 81c727338f0571fb3b3dc93bf3c82c7ba0bf8487 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:05:18 +0200 Subject: [PATCH 1/2] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/check.yaml | 36 +++++++++++++-------------- .github/workflows/docs.yaml | 10 ++++---- .github/workflows/e2e.yaml | 4 +-- .github/workflows/issue_labeling.yaml | 2 +- .github/workflows/pre_release.yaml | 22 ++++++++-------- .github/workflows/publish_to_npm.yaml | 4 +-- .github/workflows/release.yaml | 30 +++++++++++----------- .github/workflows/version_docs.yaml | 4 +-- 8 files changed, 56 insertions(+), 56 deletions(-) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index 85b73c70e..f7fa5b16d 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -25,10 +25,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ env.LATEST_NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.LATEST_NODE_VERSION }} @@ -49,10 +49,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ env.LATEST_NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.LATEST_NODE_VERSION }} @@ -85,10 +85,10 @@ jobs: run: | echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} @@ -97,7 +97,7 @@ jobs: - name: Set up Python (Windows) if: ${{ matrix.os == 'windows-2025' }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.14 @@ -118,10 +118,10 @@ jobs: run: | echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ env.LATEST_NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.LATEST_NODE_VERSION }} @@ -153,10 +153,10 @@ jobs: run: | echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ env.LATEST_NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.LATEST_NODE_VERSION }} @@ -164,7 +164,7 @@ jobs: uses: apify/actions/pnpm-install@v1.3.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} @@ -201,10 +201,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ env.LATEST_NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.LATEST_NODE_VERSION }} @@ -237,10 +237,10 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ env.LATEST_NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.LATEST_NODE_VERSION }} @@ -248,7 +248,7 @@ jobs: uses: apify/actions/pnpm-install@v1.3.1 - name: Install bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version no-cache: true @@ -269,7 +269,7 @@ jobs: run: pnpm run insert-cli-metadata && pnpm run build-bundles - name: Upload Bundles - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: apify-cli-bundles-${{ matrix.label }} path: bundles/** diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index de7758a3d..edb62e2c2 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -21,12 +21,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -53,15 +53,15 @@ jobs: github-token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Set up GitHub Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload GitHub Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: ./website/build - name: Deploy artifact to GitHub Pages - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Invalidate CloudFront cache run: | diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 7a22ee569..ade6e6336 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -44,10 +44,10 @@ jobs: run: | echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 diff --git a/.github/workflows/issue_labeling.yaml b/.github/workflows/issue_labeling.yaml index eec08886a..c26f8e066 100644 --- a/.github/workflows/issue_labeling.yaml +++ b/.github/workflows/issue_labeling.yaml @@ -14,7 +14,7 @@ jobs: steps: # Add the "t-builders" label to all new issues - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | github.rest.issues.addLabels({ diff --git a/.github/workflows/pre_release.yaml b/.github/workflows/pre_release.yaml index 7eca10ec6..ad237e36a 100644 --- a/.github/workflows/pre_release.yaml +++ b/.github/workflows/pre_release.yaml @@ -33,7 +33,7 @@ jobs: name: Wait for code checks to pass runs-on: ubuntu-latest steps: - - uses: lewagon/wait-on-check-action@v1.8.0 + - uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0 with: ref: ${{ github.sha }} repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -50,12 +50,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: https://registry.npmjs.org @@ -104,13 +104,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.update_changelog.outputs.changelog_commitish }} fetch-depth: 0 - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: https://registry.npmjs.org @@ -119,7 +119,7 @@ jobs: uses: apify/actions/pnpm-install@v1.3.1 - name: Install bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version @@ -142,7 +142,7 @@ jobs: run: pnpm run insert-cli-metadata && pnpm run build-bundles - name: Upload bundles - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: apify-cli-bundles-${{ matrix.label }} path: bundles/** @@ -157,13 +157,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.update_changelog.outputs.changelog_commitish }} # This step also deals with unzipping the archive from GitHub, so we get a big folder with all the bundles! - name: Download bundles - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: apify-cli-bundles-* merge-multiple: true @@ -174,7 +174,7 @@ jobs: ls -la bundles - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -189,7 +189,7 @@ jobs: run: node scripts/report-install-size.mjs - name: Create release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: v${{ needs.update_changelog.outputs.pre_release_version }} name: ${{ needs.update_changelog.outputs.pre_release_version }} diff --git a/.github/workflows/publish_to_npm.yaml b/.github/workflows/publish_to_npm.yaml index 3f7e64285..714c504af 100644 --- a/.github/workflows/publish_to_npm.yaml +++ b/.github/workflows/publish_to_npm.yaml @@ -25,12 +25,12 @@ jobs: name: Publish to NPM runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref }} - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 23649c298..5e114d5cf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -51,7 +51,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check if the head commit contains [skip ci] id: check_skip run: | @@ -61,7 +61,7 @@ jobs: echo 'skipped=false' >> $GITHUB_OUTPUT fi - - uses: lewagon/wait-on-check-action@v1.8.0 + - uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0 if: ${{ steps.check_skip.outputs.skipped == 'false' }} with: ref: ${{ github.sha }} @@ -78,12 +78,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -97,7 +97,7 @@ jobs: run: pnpm pack - name: Update CHANGELOG.md - uses: DamianReeves/write-file-action@master + uses: DamianReeves/write-file-action@{"message":"Not # master with: path: CHANGELOG.md write-mode: overwrite @@ -139,13 +139,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.update_changelog.outputs.changelog_commitish }} fetch-depth: 0 - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: https://registry.npmjs.org @@ -154,7 +154,7 @@ jobs: uses: apify/actions/pnpm-install@v1.3.1 - name: Install bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version @@ -177,7 +177,7 @@ jobs: run: pnpm run insert-cli-metadata && pnpm run build-bundles - name: Upload bundles - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: apify-cli-bundles-${{ matrix.label }} path: bundles/** @@ -192,13 +192,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.update_changelog.outputs.changelog_commitish }} # This step also deals with unzipping the archive from GitHub, so we get a big folder with all the bundles! - name: Download bundles - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: apify-cli-bundles-* merge-multiple: true @@ -209,7 +209,7 @@ jobs: ls -la bundles - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -221,7 +221,7 @@ jobs: run: node scripts/report-install-size.mjs - name: Create release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ needs.release_metadata.outputs.tag_name }} name: ${{ needs.release_metadata.outputs.version_number }} @@ -260,7 +260,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.update_changelog.outputs.changelog_commitish }} @@ -270,7 +270,7 @@ jobs: git config --global user.email 'apify-service-account@users.noreply.github.com' - name: Set up Homebrew - uses: Homebrew/actions/setup-homebrew@master + uses: Homebrew/actions/setup-homebrew@{"message":"Not # master # It can happen that the updated package version is not available right after the `npm publish` command finishes # Try waiting 3 minutes until the updated package version is available diff --git a/.github/workflows/version_docs.yaml b/.github/workflows/version_docs.yaml index e4c47852e..bdfbc2268 100644 --- a/.github/workflows/version_docs.yaml +++ b/.github/workflows/version_docs.yaml @@ -11,13 +11,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 From 28c4f9b6dce9d67ca1d252a211b0a6c1f4173783 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:19:08 +0200 Subject: [PATCH 2/2] ci: pin branch-referenced actions to commit SHAs --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 5e114d5cf..bc7383be8 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -97,7 +97,7 @@ jobs: run: pnpm pack - name: Update CHANGELOG.md - uses: DamianReeves/write-file-action@{"message":"Not # master + uses: DamianReeves/write-file-action@d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7 # master with: path: CHANGELOG.md write-mode: overwrite @@ -270,7 +270,7 @@ jobs: git config --global user.email 'apify-service-account@users.noreply.github.com' - name: Set up Homebrew - uses: Homebrew/actions/setup-homebrew@{"message":"Not # master + uses: Homebrew/actions/setup-homebrew@8f3d1ec8a696b3b9d9a6c3696b6c73033cab69e4 # master # It can happen that the updated package version is not available right after the `npm publish` command finishes # Try waiting 3 minutes until the updated package version is available