Skip to content

Commit e677127

Browse files
ChrisGe4ChrisGe4
committed
pin tool versions
1 parent 4889929 commit e677127

File tree

3 files changed

+93
-93
lines changed

3 files changed

+93
-93
lines changed

‎.github/workflows/actionlint.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ jobs:
1515
lint:
1616
runs-on: ubuntu-latest
1717
steps:
18-
- uses: actions/checkout@v6
19-
- name: 'Run actionlint with reviewdog'
20-
uses: reviewdog/action-actionlint@v1.72.0
21-
with:
22-
fail_on_error: true
23-
reporter: 'github-pr-check'
18+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
19+
- name: 'Run actionlint with reviewdog'
20+
uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # ratchet:reviewdog/action-actionlint@v1.72.0
21+
with:
22+
fail_on_error: true
23+
reporter: 'github-pr-check'

‎.github/workflows/centralized-stale.yml‎

Lines changed: 72 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: 'Centralized Organization Stale Bot'
2-
2+
permissions: {}
33
on:
44
schedule:
5-
# Run daily at 01:00 UTC
6-
- cron: '0 1 * * *'
5+
# Run daily at 01:00 UTC
6+
- cron: '0 1 * * *'
77
workflow_dispatch:
88

99
jobs:
@@ -13,38 +13,38 @@ jobs:
1313
outputs:
1414
matrix: ${{ steps.set-matrix.outputs.repos }}
1515
steps:
16-
- id: 'auth-minty'
17-
name: 'Authenticate to Google Cloud'
18-
uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # ratchet:google-github-actions/auth@v2
19-
with:
20-
create_credentials_file: false
21-
export_environment_variables: false
22-
workload_identity_provider: '${{ vars.TOKEN_MINTER_WIF_PROVIDER }}'
23-
service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
24-
token_format: 'id_token'
25-
id_token_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
26-
id_token_include_email: true
16+
- id: 'auth-minty'
17+
name: 'Authenticate to Google Cloud'
18+
uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # ratchet:google-github-actions/auth@v2
19+
with:
20+
create_credentials_file: false
21+
export_environment_variables: false
22+
workload_identity_provider: '${{ vars.TOKEN_MINTER_WIF_PROVIDER }}'
23+
service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
24+
token_format: 'id_token'
25+
id_token_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
26+
id_token_include_email: true
2727

28-
- id: 'mint-github-token'
29-
uses: 'abcxyz/github-token-minter/.github/actions/minty@45c29ca3418ff3bb3ad5815d88a80536efeba21b' # ratchet:abcxyz/github-token-minter/.github/actions/minty@main
30-
with:
31-
id_token: '${{ steps.auth-minty.outputs.id_token }}'
32-
service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
33-
requested_permissions: |-
34-
{
35-
"scope": "stale-bot",
36-
"repositories": ["*"],
37-
"org_name": "google-github-actions"
38-
}
28+
- id: 'mint-github-token'
29+
uses: 'abcxyz/github-token-minter/.github/actions/minty@45c29ca3418ff3bb3ad5815d88a80536efeba21b' # ratchet:abcxyz/github-token-minter/.github/actions/minty@main
30+
with:
31+
id_token: '${{ steps.auth-minty.outputs.id_token }}'
32+
service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
33+
requested_permissions: |-
34+
{
35+
"scope": "stale-bot",
36+
"repositories": ["*"],
37+
"org_name": "google-github-actions"
38+
}
3939
40-
- name: 'List active repositories'
41-
id: set-matrix
42-
env:
43-
GH_TOKEN: ${{ steps.mint-github-token.outputs.token }}
44-
run: |
45-
# Query GitHub API for active, public, non-forked repositories and force single-line JSON to prevent GITHUB_OUTPUT truncation
46-
REPOS=$(gh api --paginate /orgs/google-github-actions/repos -q '[.[] | select(.archived == false and .private == false and .fork == false) | .name]' | jq -c .)
47-
echo "repos=${REPOS}" >> $GITHUB_OUTPUT
40+
- name: 'List active repositories'
41+
id: set-matrix
42+
env:
43+
GH_TOKEN: ${{ steps.mint-github-token.outputs.token }}
44+
run: |
45+
# Query GitHub API for active, public, non-forked repositories and force single-line JSON to prevent GITHUB_OUTPUT truncation
46+
REPOS=$(gh api --paginate /orgs/google-github-actions/repos -q '[.[] | select(.archived == false and .private == false and .fork == false) | .name]' | jq -c .)
47+
echo "repos=${REPOS}" >> $GITHUB_OUTPUT
4848
4949
# Stage 2: Fan out official actions/stale across all discovered repositories
5050
apply-stale-rules:
@@ -56,46 +56,46 @@ jobs:
5656
repo: ${{ fromJson(needs.fetch-repositories.outputs.matrix) }}
5757

5858
steps:
59-
- id: 'auth-minty'
60-
name: 'Authenticate to Google Cloud'
61-
uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # ratchet:google-github-actions/auth@v2
62-
with:
63-
create_credentials_file: false
64-
export_environment_variables: false
65-
workload_identity_provider: '${{ vars.TOKEN_MINTER_WIF_PROVIDER }}'
66-
service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
67-
token_format: 'id_token'
68-
id_token_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
69-
id_token_include_email: true
59+
- id: 'auth-minty'
60+
name: 'Authenticate to Google Cloud'
61+
uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # ratchet:google-github-actions/auth@v2
62+
with:
63+
create_credentials_file: false
64+
export_environment_variables: false
65+
workload_identity_provider: '${{ vars.TOKEN_MINTER_WIF_PROVIDER }}'
66+
service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
67+
token_format: 'id_token'
68+
id_token_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
69+
id_token_include_email: true
7070

71-
- id: 'mint-github-token'
72-
uses: 'abcxyz/github-token-minter/.github/actions/minty@45c29ca3418ff3bb3ad5815d88a80536efeba21b' # ratchet:abcxyz/github-token-minter/.github/actions/minty@main
73-
with:
74-
id_token: '${{ steps.auth-minty.outputs.id_token }}'
75-
service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
76-
requested_permissions: |-
77-
{
78-
"scope": "stale-bot",
79-
"repositories": ["${{ matrix.repo }}"],
80-
"org_name": "google-github-actions"
81-
}
71+
- id: 'mint-github-token'
72+
uses: 'abcxyz/github-token-minter/.github/actions/minty@45c29ca3418ff3bb3ad5815d88a80536efeba21b' # ratchet:abcxyz/github-token-minter/.github/actions/minty@main
73+
with:
74+
id_token: '${{ steps.auth-minty.outputs.id_token }}'
75+
service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
76+
requested_permissions: |-
77+
{
78+
"scope": "stale-bot",
79+
"repositories": ["${{ matrix.repo }}"],
80+
"org_name": "google-github-actions"
81+
}
8282
83-
- name: 'Run official stale bot'
84-
uses: actions/stale@v10.2.0
85-
env:
86-
GITHUB_REPOSITORY: 'google-github-actions/${{ matrix.repo }}'
87-
with:
88-
repo-token: ${{ steps.mint-github-token.outputs.token }}
89-
operations-per-run: 300 # Increased burndown limit for first execution
83+
- name: 'Run official stale bot'
84+
uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # ratchet:actions/stale@v10.2.0
85+
env:
86+
GITHUB_REPOSITORY: 'google-github-actions/${{ matrix.repo }}'
87+
with:
88+
repo-token: ${{ steps.mint-github-token.outputs.token }}
89+
operations-per-run: 300 # Increased burndown limit for first execution
9090

91-
# Issue configuration (60 days total: 53 inactive + 7 warning)
92-
days-before-issue-stale: 53
93-
days-before-issue-close: 7
94-
stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.'
95-
stale-issue-label: 'stale'
91+
# Issue configuration (60 days total: 53 inactive + 7 warning)
92+
days-before-issue-stale: 53
93+
days-before-issue-close: 7
94+
stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.'
95+
stale-issue-label: 'stale'
9696

97-
# PR configuration (30 days total: 23 inactive + 7 warning)
98-
days-before-pr-stale: 23
99-
days-before-pr-close: 7
100-
stale-pr-message: 'This pull request has been automatically marked as stale because it has not had recent activity. Please leave a comment to remove this status.'
101-
stale-pr-label: 'stale'
97+
# PR configuration (30 days total: 23 inactive + 7 warning)
98+
days-before-pr-stale: 23
99+
days-before-pr-close: 7
100+
stale-pr-message: 'This pull request has been automatically marked as stale because it has not had recent activity. Please leave a comment to remove this status.'
101+
stale-pr-label: 'stale'

‎.github/workflows/scorecard.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ jobs:
1313
runs-on: ubuntu-latest
1414
timeout-minutes: 20
1515
steps:
16-
- uses: actions/checkout@v6
17-
with:
18-
# Checkout the base repository ref, not the PR's head commit
19-
ref: ${{ github.event.pull_request.base.sha }}
20-
persist-credentials: false
21-
- name: 'Run Scorecard'
22-
uses: ossf/scorecard-action@v2.4.3
23-
with:
24-
results_file: 'results.sarif'
25-
results_format: 'sarif'
26-
publish_results: false
27-
- name: 'Upload to GitHub Security Tab'
28-
uses: github/codeql-action/upload-sarif@v4.35.1
29-
with:
30-
sarif_file: 'results.sarif'
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
17+
with:
18+
# Checkout the base repository ref, not the PR's head commit
19+
ref: ${{ github.event.pull_request.base.sha }}
20+
persist-credentials: false
21+
- name: 'Run Scorecard'
22+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # ratchet:ossf/scorecard-action@v2.4.3
23+
with:
24+
results_file: 'results.sarif'
25+
results_format: 'sarif'
26+
publish_results: false
27+
- name: 'Upload to GitHub Security Tab'
28+
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # ratchet:github/codeql-action/upload-sarif@v4.35.1
29+
with:
30+
sarif_file: 'results.sarif'

0 commit comments

Comments
 (0)