From 3b6519f1695d449080692255ecea3b512d8daa3c Mon Sep 17 00:00:00 2001 From: Ruakij Date: Wed, 21 Oct 2026 03:40:52 +0000 Subject: [PATCH] Pin GitHub Actions to commit SHAs --- .github/workflows/ci.yaml | 20 ++++++++++---------- .github/workflows/release.yaml | 14 +++++++------- .github/workflows/upstream-sync.yaml | 6 +++--- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d14e430..7537dab 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -22,8 +22,8 @@ jobs: go: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-go@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod - run: gofmt -l cmd lib | tee /dev/stderr | (! read -r) @@ -35,23 +35,23 @@ jobs: # token carrying the workflow scope. - id: lint-version run: echo "version=$(cat hack/golangci-lint.version)" >> "$GITHUB_OUTPUT" - - uses: golangci/golangci-lint-action@v9 + - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: ${{ steps.lint-version.outputs.version }} security: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Reachability-aware, so it only fails on vulnerabilities we actually call. # It installs its own Go, hence no setup-go step; go-version-input must be # cleared or it collides with go-version-file. - - uses: golang/govulncheck-action@v1.1.0 + - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0 with: repo-checkout: false go-version-file: go.mod go-version-input: "" - - uses: aquasecurity/trivy-action@v0.36.0 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: fs scan-ref: . @@ -64,9 +64,9 @@ jobs: image: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: docker/setup-buildx-action@v4 - - uses: docker/build-push-action@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . push: false @@ -74,7 +74,7 @@ jobs: tags: routingtabletowg:ci cache-from: type=gha cache-to: type=gha,mode=max - - uses: aquasecurity/trivy-action@v0.36.0 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: image-ref: routingtabletowg:ci format: table diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index c6c4ff7..61e7539 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,11 +15,11 @@ jobs: image: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Emulation for the RUN steps of the non-native platforms. - - uses: docker/setup-qemu-action@v4 - - uses: docker/setup-buildx-action@v4 - - uses: docker/login-action@v4 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -27,14 +27,14 @@ jobs: # The tag is v-less already, so {{version}} is the tag itself. major.minor and # major are skipped for prereleases by the action itself. - id: meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ghcr.io/${{ github.repository }} tags: | type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} - - uses: docker/build-push-action@v7 + - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . platforms: linux/amd64,linux/arm64,linux/arm/v7 @@ -48,7 +48,7 @@ jobs: runs-on: ubuntu-latest needs: image steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Create the GitHub release diff --git a/.github/workflows/upstream-sync.yaml b/.github/workflows/upstream-sync.yaml index 52be3c0..5f922ee 100644 --- a/.github/workflows/upstream-sync.yaml +++ b/.github/workflows/upstream-sync.yaml @@ -25,7 +25,7 @@ jobs: group: upstream-sync-golangci-lint cancel-in-progress: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ssh-key: ${{ secrets.AUTOMATION_SSH_KEY }} @@ -47,13 +47,13 @@ jobs: - if: steps.detect.outputs.changed == 'true' id: lint continue-on-error: true - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: ${{ steps.detect.outputs.latest }} - if: steps.detect.outputs.changed == 'true' id: pr - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: branch: automation/golangci-lint-version-sync delete-branch: true