Skip to content
This repository was archived by the owner on Jul 31, 2026. It is now read-only.
/ WebUI Public archive

Commit 55f0a45

Browse files
hhvrchhvrc
authored
security: Pin Github Actions (#195)
1 parent 0e3fe75 commit 55f0a45

3 files changed

Lines changed: 35 additions & 35 deletions

File tree

‎.github/workflows/ci-develop.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@ jobs:
2525
runs-on: ubuntu-latest
2626

2727
steps:
28-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929

30-
- uses: actions/setup-node@v4
30+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
3131
with:
3232
node-version: 17.x
3333

34-
- uses: actions/cache@v4
34+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
3535
with:
3636
path: |
3737
~/.npm
@@ -52,7 +52,7 @@ jobs:
5252
mv dist/${{ env.ARTIFACT_NAME }} .
5353
5454
- name: Upload internal artifacts
55-
uses: actions/upload-artifact@v4
55+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5656
with:
5757
name: ${{ env.ARTIFACT_NAME }}
5858
path: ${{ github.workspace }}/${{ env.ARTIFACT_NAME }}
@@ -63,31 +63,31 @@ jobs:
6363
needs: build
6464

6565
steps:
66-
- uses: actions/checkout@v4
66+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6767
with:
6868
sparse-checkout: |
6969
Dockerfile
7070
7171
- name: Download internal artifacts
72-
uses: actions/download-artifact@v4
72+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
7373
with:
7474
name: ${{ env.ARTIFACT_NAME }}
7575

7676
- name: Extract artifacts
7777
run: unzip ${{ env.ARTIFACT_NAME }} -d dist
7878

7979
- name: Set up Docker Buildx
80-
uses: docker/setup-buildx-action@v3
80+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
8181

8282
- name: Log in to Container Registry
83-
uses: docker/login-action@v3
83+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
8484
with:
8585
registry: ${{ env.REGISTRY }}
8686
username: ${{ github.actor }}
8787
password: ${{ secrets.GITHUB_TOKEN }}
8888

8989
- name: Find latest tag
90-
uses: oprypin/find-latest-tag@v1
90+
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
9191
id: latest-tag
9292
with:
9393
repository: ${{ github.repository }}
@@ -96,7 +96,7 @@ jobs:
9696

9797
- name: Extract metadata (tags, labels) for Docker
9898
id: meta
99-
uses: docker/metadata-action@v5
99+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
100100
with:
101101
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
102102
flavor: |
@@ -111,7 +111,7 @@ jobs:
111111
type=semver,pattern={{major}}.{{minor}}.{{patch}}
112112
113113
- name: Build image
114-
uses: docker/build-push-action@v6
114+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
115115
with:
116116
context: .
117117
push: ${{ github.event_name != 'pull_request' }}

‎.github/workflows/ci-master.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@ jobs:
2525
runs-on: ubuntu-latest
2626

2727
steps:
28-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929

30-
- uses: actions/setup-node@v4
30+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
3131
with:
3232
node-version: 17.x
3333

34-
- uses: actions/cache@v4
34+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
3535
with:
3636
path: |
3737
~/.npm
@@ -55,7 +55,7 @@ jobs:
5555
mv dist/${{ env.ARTIFACT_NAME }} .
5656
5757
- name: Upload internal artifacts
58-
uses: actions/upload-artifact@v4
58+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5959
with:
6060
name: ${{ env.ARTIFACT_NAME }}
6161
path: ${{ github.workspace }}/${{ env.ARTIFACT_NAME }}
@@ -66,31 +66,31 @@ jobs:
6666
needs: build
6767

6868
steps:
69-
- uses: actions/checkout@v4
69+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7070
with:
7171
sparse-checkout: |
7272
Dockerfile
7373
7474
- name: Download internal artifacts
75-
uses: actions/download-artifact@v4
75+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
7676
with:
7777
name: ${{ env.ARTIFACT_NAME }}
7878

7979
- name: Extract artifacts
8080
run: unzip ${{ env.ARTIFACT_NAME }} -d dist
8181

8282
- name: Set up Docker Buildx
83-
uses: docker/setup-buildx-action@v3
83+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
8484

8585
- name: Log in to Container Registry
86-
uses: docker/login-action@v3
86+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
8787
with:
8888
registry: ${{ env.REGISTRY }}
8989
username: ${{ github.actor }}
9090
password: ${{ secrets.GITHUB_TOKEN }}
9191

9292
- name: Find latest tag
93-
uses: oprypin/find-latest-tag@v1
93+
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
9494
id: latest-tag
9595
with:
9696
repository: ${{ github.repository }}
@@ -99,7 +99,7 @@ jobs:
9999

100100
- name: Extract metadata (tags, labels) for Docker
101101
id: meta
102-
uses: docker/metadata-action@v5
102+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
103103
with:
104104
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
105105
flavor: |
@@ -114,7 +114,7 @@ jobs:
114114
type=semver,pattern={{major}}.{{minor}}.{{patch}}
115115
116116
- name: Build image
117-
uses: docker/build-push-action@v6
117+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
118118
with:
119119
context: .
120120
push: ${{ github.event_name != 'pull_request' }}

‎.github/workflows/ci-tag.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@ jobs:
2121
runs-on: ubuntu-latest
2222

2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525

26-
- uses: actions/setup-node@v4
26+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2727
with:
2828
node-version: 17.x
2929

30-
- uses: actions/cache@v4
30+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
3131
with:
3232
path: |
3333
~/.npm
@@ -50,7 +50,7 @@ jobs:
5050
mv dist/${{ env.ARTIFACT_NAME }} .
5151
5252
- name: Upload internal artifacts
53-
uses: actions/upload-artifact@v4
53+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5454
with:
5555
name: ${{ env.ARTIFACT_NAME }}
5656
path: ${{ github.workspace }}/${{ env.ARTIFACT_NAME }}
@@ -61,30 +61,30 @@ jobs:
6161
needs: build
6262

6363
steps:
64-
- uses: actions/checkout@v4
64+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6565
with:
6666
sparse-checkout: |
6767
Dockerfile
6868
6969
- name: Download internal artifacts
70-
uses: actions/download-artifact@v4
70+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
7171
with:
7272
name: ${{ env.ARTIFACT_NAME }}
7373

7474
- name: Extract artifacts
7575
run: unzip ${{ env.ARTIFACT_NAME }} -d dist
7676

7777
- name: Set up Docker Buildx
78-
uses: docker/setup-buildx-action@v3
78+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
7979

8080
- name: Log in to Container Registry
81-
uses: docker/login-action@v3
81+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
8282
with:
8383
registry: ${{ env.REGISTRY }}
8484
username: ${{ github.actor }}
8585
password: ${{ secrets.GITHUB_TOKEN }}
8686

87-
- uses: oprypin/find-latest-tag@v1
87+
- uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
8888
id: latest-tag
8989
with:
9090
repository: ${{ github.repository }}
@@ -93,7 +93,7 @@ jobs:
9393

9494
- name: Extract metadata (tags, labels) for Docker
9595
id: meta
96-
uses: docker/metadata-action@v5
96+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
9797
with:
9898
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
9999
flavor: |
@@ -108,7 +108,7 @@ jobs:
108108
type=semver,pattern={{major}}.{{minor}}.{{patch}}
109109
110110
- name: Build image
111-
uses: docker/build-push-action@v6
111+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
112112
with:
113113
context: .
114114
push: true
@@ -121,12 +121,12 @@ jobs:
121121

122122
steps:
123123
- name: Download internal artifacts
124-
uses: actions/download-artifact@v4
124+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
125125
with:
126126
name: ${{ env.ARTIFACT_NAME }}
127127

128128
- name: Upload artifacts to tag
129-
uses: svenstaro/upload-release-action@v2
129+
uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
130130
with:
131131
repo_token: ${{ secrets.GITHUB_TOKEN }}
132132
file: ${{ env.ARTIFACT_NAME }}

0 commit comments

Comments
 (0)