Skip to content

Commit 54cef87

Browse files
thomasleesethomasleese
authored
Merge pull request #6568 from NHSDigital/pin-github-actions
Pin all GitHub Actions to commit SHAs for security
2 parents 3790856 + 0c29f54 commit 54cef87

12 files changed

Lines changed: 77 additions & 75 deletions

‎.github/workflows/build-and-push-image.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
steps.check-prod-image.outputs.ops-build-needed }}
4242
steps:
4343
- name: Configure AWS Dev Credentials
44-
uses: aws-actions/configure-aws-credentials@v6
44+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
4545
with:
4646
role-to-assume: arn:aws:iam::393416225559:role/GithubDeployECSService
4747
aws-region: eu-west-2
@@ -57,7 +57,7 @@ jobs:
5757
fi
5858
- name: Configure AWS Production credentials
5959
if: env.PUSH_IMAGE_TO_PRODUCTION == 'true'
60-
uses: aws-actions/configure-aws-credentials@v6
60+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
6161
with:
6262
role-to-assume: arn:aws:iam::820242920762:role/GithubDeployECSService
6363
aws-region: eu-west-2
@@ -102,25 +102,25 @@ jobs:
102102
aws-role: ${{ fromJSON(needs.define-matrix.outputs.aws-roles) }}
103103
steps:
104104
- name: Checkout code
105-
uses: actions/checkout@v6
105+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
106106
with:
107107
ref: ${{ env.git_ref }}
108108
- name: Write build SHA
109109
run: git rev-parse HEAD > public/sha
110110
- name: Configure AWS Credentials
111-
uses: aws-actions/configure-aws-credentials@v6
111+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
112112
with:
113113
role-to-assume: ${{ matrix.aws-role }}
114114
aws-region: eu-west-2
115115
- name: Login to ECR
116116
id: login-ecr
117-
uses: aws-actions/amazon-ecr-login@v2
117+
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
118118
- name: Set up Docker Buildx
119-
uses: docker/setup-buildx-action@v4
119+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
120120
# yamllint disable rule:line-length
121121
- name: Build and push webapp image
122122
if: needs.check-image-presence.outputs.webapp-build-needed == 'true'
123-
uses: docker/build-push-action@v7
123+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
124124
with:
125125
context: .
126126
push: true
@@ -132,7 +132,7 @@ jobs:
132132
}}/mavis/webapp:buildcache,mode=max,image-manifest=true,oci-mediatypes=true
133133
- name: Build and push ops image
134134
if: needs.check-image-presence.outputs.ops-build-needed == 'true'
135-
uses: docker/build-push-action@v7
135+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
136136
with:
137137
context: .
138138
file: ops.Dockerfile

‎.github/workflows/create_dockerized_db.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,11 @@ jobs:
2929
RAILS_MASTER_KEY: intentionally-insecure-dev-key00
3030
SKIP_TEST_DATABASE: true
3131
steps:
32-
- uses: actions/checkout@v6
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3333
with:
3434
ref: ${{ inputs.github_ref || github.ref_name == 'next' && 'next' || github.ref_name }}
3535
repository: nhsuk/manage-vaccinations-in-schools
36-
- uses: actions/setup-node@v6
36+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3737
with:
3838
node-version-file: .tool-versions
3939
cache: yarn
@@ -56,7 +56,7 @@ jobs:
5656
sleep 2
5757
done
5858
'
59-
- uses: ruby/setup-ruby@v1
59+
- uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0
6060
with:
6161
bundler-cache: true
6262
- name: Populate database for testing
@@ -65,13 +65,13 @@ jobs:
6565
bin/rails feature_flags:enable_for_development
6666
bin/mavis gias import --input-file=spec/fixtures/dfe-schools.zip
6767
- name: Configure AWS Credentials
68-
uses: aws-actions/configure-aws-credentials@v6
68+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
6969
with:
7070
role-to-assume: arn:aws:iam::393416225559:role/GitHubAssuranceTestRole
7171
aws-region: eu-west-2
7272
- name: Login to ECR
7373
id: login-ecr
74-
uses: aws-actions/amazon-ecr-login@v2
74+
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
7575
# yamllint disable rule:line-length
7676
- name: get github ref short
7777
id: github-ref

‎.github/workflows/data-replication-pipeline.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
git-sha: ${{ steps.get-git-sha.outputs.git-sha }}
7171
steps:
7272
- name: Checkout code
73-
uses: actions/checkout@v6
73+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7474
with:
7575
ref: ${{ env.git_ref_to_deploy }}
7676
- name: Get git sha
@@ -93,11 +93,11 @@ jobs:
9393
id-token: write
9494
steps:
9595
- name: Checkout code
96-
uses: actions/checkout@v6
96+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9797
with:
9898
ref: ${{ env.git_ref_to_deploy }}
9999
- name: Configure AWS Credentials
100-
uses: aws-actions/configure-aws-credentials@v6
100+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
101101
with:
102102
role-to-assume: ${{ env.aws_role }}
103103
aws-region: eu-west-2
@@ -125,7 +125,7 @@ jobs:
125125
} >> "$GITHUB_OUTPUT"
126126
- name: Populate web task definition
127127
id: create-task-definition
128-
uses: aws-actions/amazon-ecs-render-task-definition@v1
128+
uses: aws-actions/amazon-ecs-render-task-definition@77954e213ba1f9f9cb016b86a1d4f6fcdea0d57e # v1.8.4
129129
with:
130130
task-definition-family:
131131
mavis-data-replication-task-definition-${{ inputs.environment }}-template
@@ -140,7 +140,7 @@ jobs:
140140
mv ${{ steps.create-task-definition.outputs.task-definition }} ${{ runner.temp
141141
}}/data-replication-task-definition.json
142142
- name: Upload artifact for data-replication task definition
143-
uses: actions/upload-artifact@v7
143+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
144144
with:
145145
name: ${{ inputs.environment }}-data-replication-task-definition
146146
path: ${{ runner.temp }}/data-replication-task-definition.json
@@ -189,12 +189,12 @@ jobs:
189189
id-token: write
190190
steps:
191191
- name: Configure AWS Credentials
192-
uses: aws-actions/configure-aws-credentials@v6
192+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
193193
with:
194194
role-to-assume: ${{ env.aws_role }}
195195
aws-region: eu-west-2
196196
- name: Download data-replication task definition artifact
197-
uses: actions/download-artifact@v8
197+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
198198
with:
199199
path: ${{ runner.temp }}
200200
name: ${{ inputs.environment }}-data-replication-task-definition
@@ -205,7 +205,7 @@ jobs:
205205
jq --arg f "$family_name" '.family = $f' "$file_path" > tmpfile && mv tmpfile "$file_path"
206206
- name: Deploy data-replication service
207207
id: ecs-deploy
208-
uses: aws-actions/amazon-ecs-deploy-task-definition@v2
208+
uses: aws-actions/amazon-ecs-deploy-task-definition@fc8fc60f3a60ffd500fcb13b209c59d221ac8c8c # v2.6.1
209209
with:
210210
task-definition: ${{ runner.temp }}/data-replication-task-definition.json
211211
cluster: mavis-${{ inputs.environment }}-data-replication

‎.github/workflows/deploy-documentation.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,16 @@ jobs:
1818
cancel-in-progress: true
1919

2020
steps:
21-
- uses: actions/checkout@v6
22-
- uses: ruby/setup-ruby@v1
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
- uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0
2323
with:
2424
bundler-cache: true
2525

2626
- name: Generate Documentation
2727
run: bundle exec rake rdoc:generate
2828

2929
- name: Deploy to GitHub Pages
30-
uses: JamesIves/github-pages-deploy-action@v4
30+
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
3131
with:
3232
branch: gh-pages
3333
folder: docs/rdoc

‎.github/workflows/deploy.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ jobs:
8080
fi
8181
fi
8282
- name: Checkout code
83-
uses: actions/checkout@v6
83+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8484
with:
8585
ref: ${{ inputs.git_ref_to_deploy || github.sha }}
8686
- name: Get git sha
@@ -109,12 +109,12 @@ jobs:
109109
repository_name: ${{ matrix.service == 'ops' && 'mavis/ops' || 'mavis/webapp' }}
110110
steps:
111111
- name: Checkout code
112-
uses: actions/checkout@v6
112+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
113113
id: checkout-code
114114
with:
115115
ref: ${{ needs.validate-and-resolve-sha.outputs.git-sha }}
116116
- name: Configure AWS Credentials
117-
uses: aws-actions/configure-aws-credentials@v6
117+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
118118
with:
119119
role-to-assume: arn:aws:iam::${{ env.aws_account_id }}:role/GithubDeployECSService
120120
aws-region: eu-west-2
@@ -131,7 +131,7 @@ jobs:
131131
echo "digest=$digest" >> "$GITHUB_OUTPUT"
132132
- name: Populate task definition
133133
id: create-task-definition
134-
uses: aws-actions/amazon-ecs-render-task-definition@v1
134+
uses: aws-actions/amazon-ecs-render-task-definition@77954e213ba1f9f9cb016b86a1d4f6fcdea0d57e # v1.8.4
135135
with:
136136
task-definition-family:
137137
mavis-${{ matrix.service }}-task-definition-${{ inputs.environment }}-template
@@ -147,7 +147,7 @@ jobs:
147147
mv ${{ steps.create-task-definition.outputs.task-definition }} ${{ runner.temp }}/${{
148148
matrix.service }}-task-definition.json
149149
- name: Upload artifact for ${{ matrix.service }} task definition
150-
uses: actions/upload-artifact@v7
150+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
151151
with:
152152
name: ${{ inputs.environment }}-${{ matrix.service }}-task-definition
153153
path: ${{ runner.temp }}/${{ matrix.service }}-task-definition.json
@@ -196,14 +196,14 @@ jobs:
196196
id-token: write
197197
steps:
198198
- name: Checkout code
199-
uses: actions/checkout@v6
199+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
200200
- name: Configure AWS Credentials
201-
uses: aws-actions/configure-aws-credentials@v6
201+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
202202
with:
203203
role-to-assume: arn:aws:iam::${{ env.aws_account_id }}:role/GithubDeployECSService
204204
aws-region: eu-west-2
205205
- name: Download ops task definition artifact
206-
uses: actions/download-artifact@v8
206+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
207207
with:
208208
path: ${{ runner.temp }}
209209
name: ${{ inputs.environment }}-ops-task-definition
@@ -332,12 +332,12 @@ jobs:
332332
fromJSON(format('["{0}"]', inputs.server_types)) }}
333333
steps:
334334
- name: Configure AWS Credentials
335-
uses: aws-actions/configure-aws-credentials@v6
335+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
336336
with:
337337
role-to-assume: arn:aws:iam::${{ env.aws_account_id }}:role/GithubDeployECSService
338338
aws-region: eu-west-2
339339
- name: Download ${{ matrix.service }} task definition artifact
340-
uses: actions/download-artifact@v8
340+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
341341
with:
342342
path: ${{ runner.temp }}
343343
name: ${{ inputs.environment }}-${{ matrix.service }}-task-definition
@@ -348,7 +348,7 @@ jobs:
348348
jq --arg f "$family_name" '.family = $f' "$file_path" > tmpfile && mv tmpfile "$file_path"
349349
- name: Deploy ${{ matrix.service }} service
350350
id: ecs-deploy
351-
uses: aws-actions/amazon-ecs-deploy-task-definition@v2
351+
uses: aws-actions/amazon-ecs-deploy-task-definition@fc8fc60f3a60ffd500fcb13b209c59d221ac8c8c # v2.6.1
352352
with:
353353
task-definition: ${{ runner.temp }}/${{ matrix.service }}-task-definition.json
354354
cluster: ${{ env.cluster_name }}
@@ -376,14 +376,14 @@ jobs:
376376
id-token: write
377377
steps:
378378
- name: Checkout code
379-
uses: actions/checkout@v6
379+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
380380
- name: Configure AWS Credentials
381-
uses: aws-actions/configure-aws-credentials@v6
381+
uses: aws-actions/configure-aws-credentials@a89a83ec143615402a01f672b6e172b7b1875000 # v6.1.0
382382
with:
383383
role-to-assume: arn:aws:iam::${{ env.aws_account_id }}:role/GithubDeployECSService
384384
aws-region: eu-west-2
385385
- name: Download ops task definition artifact
386-
uses: actions/download-artifact@v8
386+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
387387
with:
388388
path: ${{ runner.temp }}
389389
name: ${{ inputs.environment }}-ops-task-definition

‎.github/workflows/draft-new-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout repository
21-
uses: actions/checkout@v6
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222
with:
2323
fetch-depth: 0
2424
- name: Generate release notes

0 commit comments

Comments
 (0)