Skip to content

[PRM-933] Pin GitHub Actions to a specific SHA #657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chrisbloe wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[PRM-933] Pin GitHub Actions to a specific SHA #657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/actions/tf-plan-apply/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ runs:
using: "composite"
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ inputs.aws_assume_role }}
role-skip-session-tagging: true
Expand All @@ -72,7 +72,7 @@ runs:
shell: bash

- name: Setup Terraform
uses: hashicorp/setup-terraform@v4
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
with:
terraform_version: ${{ inputs.terraform_version }}
terraform_wrapper: false
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/automated-deploy-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
environment: development
steps:
- name: Checkout branch
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Apply base_iam
uses: ./.github/actions/tf-plan-apply
Expand All @@ -47,18 +47,18 @@ jobs:
environment: development
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
aws-region: ${{ vars.AWS_REGION }}
mask-aws-account-id: true

- name: Setup Terraform
uses: hashicorp/setup-terraform@v4
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
with:
terraform_version: 1.14.7
terraform_wrapper: true
Expand Down Expand Up @@ -163,7 +163,7 @@ jobs:
shell: bash

- name: Add PR Comment
uses: actions/github-script@v8
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
if: github.event_name == 'pull_request' && (success() || failure())
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Expand Down Expand Up @@ -256,7 +256,7 @@ jobs:
if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
Expand All @@ -270,7 +270,7 @@ jobs:
echo "SLACK_BOT_TOKEN=$slack_bot_token" >> $GITHUB_ENV

- name: Send Slack Notification
uses: slackapi/slack-github-action@v3.0.1
uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
with:
method: chat.postMessage
token: ${{ env.SLACK_BOT_TOKEN }}
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/automated-pr-validator.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,17 +17,17 @@ jobs:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- uses: anchore/sbom-action@v0
- uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
path: "."
format: cyclonedx-json
output-file: sbom-repo-${{ github.event.repository.name }}-${{ github.sha }}.cdx.json

- uses: anchore/scan-action@v7
- uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
id: sbom-scan
with:
sbom: sbom-repo-${{ github.event.repository.name }}-${{ github.sha }}.cdx.json
Expand All @@ -37,13 +37,13 @@ jobs:
output-format: sarif

- name: Upload Anchore scan SARIF report
uses: github/codeql-action/upload-sarif@v4
uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
if: always()
with:
sarif_file: ${{ steps.sbom-scan.outputs.sarif }}

- name: Add/Update SBOM failure comment
uses: actions/github-script@v8
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
if: always() && failure()
with:
script: |
Expand Down Expand Up @@ -81,7 +81,7 @@ jobs:
})

- name: Delete SBOM failure comment
uses: actions/github-script@v8
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
if: always() && success()
with:
script: |
Expand Down Expand Up @@ -112,7 +112,7 @@ jobs:
contents: read
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

Expand All @@ -130,10 +130,10 @@ jobs:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Set up Python 3.11
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: 3.11

Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/automated-sonarqube-cloud-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis

- name: Set up Node.js
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '24'

Expand All @@ -33,7 +33,7 @@ jobs:
npm test

- name: SonarQube Cloud Scan
uses: SonarSource/sonarqube-scan-action@v7
uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
Expand All @@ -46,7 +46,7 @@ jobs:
if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
Expand All @@ -60,7 +60,7 @@ jobs:
echo "SLACK_BOT_TOKEN=$slack_bot_token" >> $GITHUB_ENV

- name: Send Slack Notification
uses: slackapi/slack-github-action@v3.0.1
uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
with:
method: chat.postMessage
token: ${{ env.SLACK_BOT_TOKEN }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/base-cleanup-lambda-edge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,19 +31,19 @@ jobs:
environment: ${{ inputs.environment }}
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: 'NHSDigital/national-document-repository-infrastructure'
ref: ${{ inputs.git_ref }}
fetch-depth: '0'

- name: Setup Python 3.11
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: 3.11

- name: Configure AWS Credentials for ${{ vars.AWS_REGION }}
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/base-cleanup-workspace.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,14 @@ jobs:
environment: ${{ inputs.environment }}
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: 'NHSDigital/national-document-repository-infrastructure'
ref: ${{ inputs.git_ref }}
fetch-depth: '0'

- name: Setup Python 3.11
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: 3.11

Expand All @@ -49,7 +49,7 @@ jobs:
./venv/bin/pip3 install boto3==1.42.68

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/cron-daily-health-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: NHSDigital/national-document-repository

Expand All @@ -75,7 +75,7 @@ jobs:
working-directory: ./app

- name: Cypress Build
uses: cypress-io/github-action@v7
uses: cypress-io/github-action@c495c3ddffba403ba11be95fffb67e25203b3799 # v7.1.10
with:
install: false
runTests: false
Expand All @@ -90,7 +90,7 @@ jobs:
run: npm install serve -g

- name: Run Cypress Tests (Chrome)
uses: cypress-io/github-action@v7
uses: cypress-io/github-action@c495c3ddffba403ba11be95fffb67e25203b3799 # v7.1.10
with:
install: false
start: serve -s dist
Expand All @@ -103,15 +103,15 @@ jobs:
CYPRESS_BASE_URL: http://localhost:3000

- name: Upload Artifacts (Screenshots)
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: failure()
with:
name: cypress-screenshots-chrome
path: /home/runner/work/national-document-repository/national-document-repository/app/cypress/screenshots
if-no-files-found: ignore

- name: Upload Artifacts (Videos)
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: failure()
with:
name: cypress-videos-chrome
Expand Down Expand Up @@ -173,7 +173,7 @@ jobs:
if: failure()
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
Expand All @@ -187,7 +187,7 @@ jobs:
echo "SLACK_BOT_TOKEN=$slack_bot_token" >> $GITHUB_ENV

- name: Send Slack Notification
uses: slackapi/slack-github-action@v3.0.1
uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
with:
method: chat.postMessage
token: ${{ env.SLACK_BOT_TOKEN }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/cron-tear-down-sandbox.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,20 +16,20 @@ jobs:
environment: development
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: main

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-skip-session-tagging: true
aws-region: ${{ vars.AWS_REGION }}
mask-aws-account-id: true

- name: Setup Python 3.11
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: 3.11

Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/cron-tear-down-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,12 @@ jobs:
sandbox-name: [ndr-test]
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: main

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_WORKSPACE }}-github-actions-role
role-skip-session-tagging: true
Expand All @@ -55,7 +55,7 @@ jobs:


- name: Setup Terraform
uses: hashicorp/setup-terraform@v4
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
with:
terraform_version: 1.14.7
terraform_wrapper: false
Expand Down Expand Up @@ -109,19 +109,19 @@ jobs:
environment: test
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: main

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/test-github-bootstrap
aws-region: ${{ vars.AWS_REGION }}
mask-aws-account-id: true

- name: Setup Terraform
uses: hashicorp/setup-terraform@v4
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
with:
terraform_version: 1.14.3

Expand Down
Loading
Loading