Skip to content

fix(ci): pin third-party actions to full commit SHAs #201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Sep 19, 2026
+85 −73
Merged

fix(ci): pin third-party actions to full commit SHAs #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/boj-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@v4.1.7
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Trigger BoJ Server (Casket/ssg-mcp)
run: |
# Send a secure trigger to boj-server to build this repository
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bridge-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 25
steps:
- uses: actions/checkout@v4.3.1
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: B3 gate -- nix bumps (no network)
env:
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/cargo-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
Expand All @@ -21,10 +21,12 @@
timeout-minutes: 20
steps:
- name: Checkout code
uses: actions/checkout@v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@v1
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: v1
with:
toolchain: stable

Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/casket-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,22 +23,22 @@ jobs:
timeout-minutes: 20
steps:
- name: Checkout
uses: actions/checkout@v4.1.1
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Checkout casket-ssg
uses: actions/checkout@v4.1.1
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
repository: hyperpolymath/casket-ssg
path: .casket-ssg

- name: Setup GHCup
uses: haskell-actions/setup@v2.7.5
uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2.7.5
with:
ghc-version: '9.8.2'
cabal-version: '3.10'

- name: Cache Cabal
uses: actions/cache@v4.3.0
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: |
~/.cabal/packages
Expand Down Expand Up @@ -100,10 +100,10 @@ jobs:
touch ../_site/.nojekyll

- name: Setup Pages
uses: actions/configure-pages@v5.0.0
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0

- name: Upload artifact
uses: actions/upload-pages-artifact@v3.0.1
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
with:
path: '_site'

Expand All @@ -117,4 +117,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4.0.5
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
36 changes: 19 additions & 17 deletions .github/workflows/chapel-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ jobs:
outputs:
relevant: ${{ steps.f.outputs.relevant }}
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 2
- id: f
Expand Down Expand Up @@ -104,7 +104,7 @@ jobs:
runs-on: ubuntu-22.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
run: |
set -euo pipefail
Expand All @@ -127,7 +127,7 @@ jobs:
runs-on: ubuntu-22.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
run: |
set -euo pipefail
Expand All @@ -143,7 +143,7 @@ jobs:
chpl src/MassPanic.chpl src/Protocol.chpl src/Imaging.chpl src/Temporal.chpl -o mass-panic
chpl smoke/two_repo_smoke.chpl src/Protocol.chpl src/Imaging.chpl -o smoke/two_repo_smoke
- name: Upload Chapel artefacts
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: chapel-binaries
path: |
Expand All @@ -158,7 +158,7 @@ jobs:
runs-on: ubuntu-22.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
run: |
set -euo pipefail
Expand All @@ -167,7 +167,7 @@ jobs:
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
sudo apt-get install -y /tmp/chapel.deb
- name: Download Chapel artefacts
uses: actions/download-artifact@v4.1.8
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: chapel-binaries
path: chapel/
Expand All @@ -183,7 +183,7 @@ jobs:
runs-on: ubuntu-22.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
run: |
set -euo pipefail
Expand All @@ -192,7 +192,7 @@ jobs:
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
sudo apt-get install -y /tmp/chapel.deb
- name: Download Chapel artefacts
uses: actions/download-artifact@v4.1.8
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: chapel-binaries
path: chapel/
Expand Down Expand Up @@ -220,9 +220,11 @@ jobs:
runs-on: ubuntu-22.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v6.0.2
- uses: dtolnay/rust-toolchain@v1
- uses: actions/cache@v4.3.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: v1
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: |
~/.cargo/registry
Expand All @@ -241,9 +243,9 @@ jobs:
runs-on: ubuntu-22.04
timeout-minutes: 45
steps:
- uses: actions/checkout@v6.0.2
- uses: dtolnay/rust-toolchain@v1
- uses: actions/cache@v4.3.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: |
~/.cargo/registry
Expand All @@ -258,7 +260,7 @@ jobs:
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
sudo apt-get install -y /tmp/chapel.deb
- name: Download Chapel artefacts
uses: actions/download-artifact@v4.1.8
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: chapel-binaries
path: chapel/
Expand All @@ -278,15 +280,15 @@ jobs:
env:
CHPL_HOME: /opt/chapel-multilocale
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

# Cache the entire built-from-source Chapel tree. Key is stable across
# PRs as long as the version, conduit, launcher and cache-gen marker
# don't change. Cold build is ~30-40 min on a 2-core runner; warm
# restore is ~30s.
- name: Cache multilocale Chapel ($CHPL_HOME)
id: chapel-cache
uses: actions/cache@v4.3.0
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: ${{ env.CHAPEL_MULTILOCALE_HOME }}
key: ${{ runner.os }}-chapel-multilocale-${{ env.CHAPEL_VERSION }}-gasnet-smp-${{ env.CHAPEL_MULTILOCALE_CACHE_GEN }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,15 +42,15 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6.0.2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Initialize CodeQL
uses: github/codeql-action/init@v4.34.0
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4.34.0
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
with:
category: "/language:${{ matrix.language }}"
8 changes: 5 additions & 3 deletions .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
Expand All @@ -19,10 +19,12 @@
timeout-minutes: 20
steps:
- name: Checkout code
uses: actions/checkout@v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@v1
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: v1
with:
toolchain: stable
components: llvm-tools-preview
Expand All @@ -34,7 +36,7 @@
run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info

- name: Upload to codecov
uses: codecov/codecov-action@v5.5.2
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
with:
files: lcov.info
fail_ci_if_error: false
4 changes: 2 additions & 2 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ jobs:
timeout-minutes: 10
steps:
- name: Checkout code
uses: actions/checkout@v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

- name: Dependency Review
uses: actions/dependency-review-action@v4.3.4
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
with:
fail-on-severity: moderate
10 changes: 5 additions & 5 deletions .github/workflows/dogfood-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Check for A2ML files
id: detect
Expand Down Expand Up @@ -69,7 +69,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Check for K9 files
id: detect
Expand Down Expand Up @@ -115,7 +115,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Scan for invisible characters
id: lint
Expand Down Expand Up @@ -180,7 +180,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Check for Groove manifest
id: groove
Expand Down Expand Up @@ -241,7 +241,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Generate dogfooding scorecard
run: |
Expand Down
30 changes: 16 additions & 14 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,13 +39,15 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@v1
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: v1

- name: Rust cache
uses: Swatinem/rust-cache@v2.8.2
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

- name: Build release binary
run: cargo build --release
Expand All @@ -60,13 +62,13 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@v1
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1

- name: Rust cache
uses: Swatinem/rust-cache@v2.8.2
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

- name: Build release binary
run: cargo build --release
Expand Down Expand Up @@ -110,7 +112,7 @@ jobs:

- name: Upload E2E artifacts
if: always()
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: e2e-scan-results
path: /tmp/*-scan.json
Expand All @@ -124,13 +126,13 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@v1
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1

- name: Rust cache
uses: Swatinem/rust-cache@v2.8.2
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

- name: Run readiness tests (Grade D/C/B)
run: cargo test --test readiness -- --nocapture
Expand All @@ -143,20 +145,20 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@v1
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1

- name: Rust cache
uses: Swatinem/rust-cache@v2.8.2
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

- name: Run benchmarks
run: cargo bench 2>&1 | tee /tmp/bench-results.txt

- name: Upload benchmark results
if: always()
uses: actions/upload-artifact@v4.6.2
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: benchmark-results
path: /tmp/bench-results.txt
Expand Down
Loading
Loading