Skip to content

Commit 2e50124

Browse files
nogatesclaude
nogates
and
claude
authored
Pin reusable workflow actions to full commit SHAs (#4155)
* Pin reusable workflow actions to full commit SHAs datadog-api-spec enforces a policy requiring all actions to be pinned to full commit SHAs; tag references like @v3/@v4 are rejected at job setup, causing all test jobs to fail. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Pin post-status-check action in test.yml to full commit SHA Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * disable static checks for now * remove it completely * Pin gotestsum to v1.12.3 to support Go 1.22/1.23 gotestsum@latest resolved to v1.13.0 which requires Go >= 1.24.0, breaking the test matrix that runs on Go 1.22.x and 1.23.x. v1.12.3 is the latest release that supports Go 1.23. * Pin all remaining workflow actions to full commit SHAs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix gotestsum pin to v1.12.1 to support Go 1.22 v1.12.3 requires Go 1.23.0, which breaks the Go 1.22.x matrix job. v1.12.1 requires only Go 1.21 and works across both 1.22.x and 1.23.x. * Drop Go 1.22 from test matrix; align tests/go.mod to go 1.23 golang.org/x/net v0.36.0 (already in tests/go.sum) requires Go 1.23+. Go 1.22 reached EOL and the test module already implicitly required 1.23 via its dependencies. Remove 1.22 from the staticcheck and test matrices and update tests/go.mod to declare go 1.23 honestly. * Revert "Drop Go 1.22 from test matrix; align tests/go.mod to go 1.23" This reverts commit 863afcf. * Restore GOTOOLCHAIN=auto to unblock Go 1.22 test job setup-go v6 (used since pinning actions to SHAs) sets GOTOOLCHAIN=local, which prevents Go from auto-selecting the go1.23.7 toolchain declared in tests/go.mod. The previous successful runs relied on this auto-selection (setup-go v4 did not set GOTOOLCHAIN=local). Adding GOTOOLCHAIN=auto to the test step restores the original behavior without changing any deps. Also reverts gotestsum back to @latest since GOTOOLCHAIN=auto allows it to download the required toolchain, matching the working run. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 0434e58 commit 2e50124

10 files changed

Lines changed: 33 additions & 43 deletions

‎.github/workflows/approved_status.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@ jobs:
2525
steps:
2626
- name: Get GitHub App token
2727
id: get_token
28-
uses: actions/create-github-app-token@v1
28+
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
2929
with:
3030
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
3131
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
3232
repositories: datadog-api-spec
3333
- name: Post PR review status check
34-
uses: DataDog/github-actions/post-review-status@v2
34+
uses: DataDog/github-actions/post-review-status@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0
3535
with:
3636
github-token: ${{ steps.get_token.outputs.token }}
3737
repo: datadog-api-spec

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@ jobs:
2525

2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v3
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2929

30-
- uses: actions/setup-go@v4
30+
- uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
3131
with:
3232
go-version: 1.22.x
3333

3434
# Initializes the CodeQL tools for scanning.
3535
- name: Initialize CodeQL
36-
uses: github/codeql-action/init@v2
36+
uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2
3737
with:
3838
languages: ${{ matrix.language }}
3939
source-root: api
@@ -44,7 +44,7 @@ jobs:
4444
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
4545
# If this step fails, then you should remove it and run the build manually (see below)
4646
- name: Autobuild
47-
uses: github/codeql-action/autobuild@v2
47+
uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # v2
4848

4949
- name: Perform CodeQL Analysis
50-
uses: github/codeql-action/analyze@v2
50+
uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2

‎.github/workflows/docs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ jobs:
1313
runs-on: ubuntu-latest
1414

1515
steps:
16-
- uses: actions/checkout@v3
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1717

1818
- name: Install Go
19-
uses: actions/setup-go@v4
19+
uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
2020
with:
2121
go-version: 1.22.x
2222

@@ -27,7 +27,7 @@ jobs:
2727
go install github.com/johnstarich/go/gopages@latest
2828
gopages -source-link "https://github.com/DataDog/datadog-api-client-go/blob/master/{{.Path}}{{if .Line}}#L{{.Line}}{{end}}" -brand-description "Datadog API client for GO" -brand-title "Datadog" -base /datadog-api-client-go
2929
30-
- uses: peaceiris/actions-gh-pages@v3
30+
- uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3
3131
with:
3232
github_token: ${{ secrets.GITHUB_TOKEN }}
3333
publish_dir: ./dist

‎.github/workflows/labeler.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ jobs:
1111
triage:
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: DataDog/labeler@glob-all
14+
- uses: DataDog/labeler@5170395583c7f7ec92989fd24faffc5b6154b866 # glob-all
1515
with:
1616
repo-token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/reusable-examples.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
outputs:
1616
matrix: ${{ steps.split.outputs.matrix }}
1717
steps:
18-
- uses: actions/checkout@v3
18+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1919
with:
2020
repository: DataDog/datadog-api-client-go
2121
ref: ${{ inputs.target-branch || github.ref }}
@@ -31,12 +31,12 @@ jobs:
3131
matrix:
3232
group: ${{ fromJson(needs.prepare.outputs.matrix) }}
3333
steps:
34-
- uses: actions/checkout@v3
34+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3535
with:
3636
repository: DataDog/datadog-api-client-go
3737
ref: ${{ inputs.target-branch || github.ref }}
3838
- name: Install Go
39-
uses: actions/setup-go@v4
39+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
4040
with:
4141
go-version: 1.22.x
4242
cache: true

‎.github/workflows/reusable-go-test.yml‎

Lines changed: 6 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -30,30 +30,19 @@ jobs:
3030
runs-on: ${{ matrix.platform }}
3131
steps:
3232
- name: Checkout code
33-
uses: actions/checkout@v3
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3434
with:
3535
repository: DataDog/datadog-api-client-go
3636
ref: ${{ inputs.target-branch || github.ref }}
3737
- name: Install Go
38-
uses: actions/setup-go@v4
38+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3939
with:
4040
go-version: ${{ matrix.go-version }}
4141
cache: true
4242
cache-dependency-path: |
4343
go.sum
4444
tests/go.sum
45-
- name: Staticcheck (api module)
46-
uses: dominikh/staticcheck-action@v1
47-
with:
48-
checks: "-SA1009"
49-
working-directory: api
50-
cache-key: ${{ matrix.go-version }}
51-
- name: Staticcheck (tests module)
52-
uses: dominikh/staticcheck-action@v1
53-
with:
54-
checks: "inherit,-SA1019"
55-
cache-key: ${{ matrix.go-version }}
56-
working-directory: tests
45+
5746
test:
5847
strategy:
5948
matrix:
@@ -63,12 +52,12 @@ jobs:
6352
runs-on: ${{ matrix.platform }}
6453
steps:
6554
- name: Checkout code
66-
uses: actions/checkout@v3
55+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6756
with:
6857
repository: DataDog/datadog-api-client-go
6958
ref: ${{ inputs.target-branch || github.ref }}
7059
- name: Install Go
71-
uses: actions/setup-go@v4
60+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
7261
with:
7362
go-version: ${{ matrix.go-version }}
7463
cache: true
@@ -77,6 +66,7 @@ jobs:
7766
run: ./scripts/run-tests.sh
7867
env:
7968
TESTARGS: ${{ matrix.go-build-tags }}
69+
GOTOOLCHAIN: auto
8070

8171
build-terraform-provider:
8272
if: false # temporarily disabled

‎.github/workflows/reusable-integration-test.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,26 +85,26 @@ jobs:
8585
- name: Get GitHub App token
8686
if: github.event_name == 'pull_request'
8787
id: get_token
88-
uses: actions/create-github-app-token@v1
88+
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
8989
with:
9090
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
9191
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
9292
repositories: ${{ inputs.target-repo || 'datadog-api-spec' }}
9393
- name: Checkout code
94-
uses: actions/checkout@v3
94+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9595
with:
9696
repository: DataDog/datadog-api-client-go
9797
ref: ${{ inputs.target-branch || github.ref }}
9898
- name: Post pending status check
9999
if: github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call')
100-
uses: DataDog/github-actions/post-status-check@v2
100+
uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0
101101
with:
102102
github-token: ${{ steps.get_token.outputs.token }}
103103
repo: ${{ inputs.target-repo || 'datadog-api-spec' }}
104104
status: pending
105105
context: ${{ inputs.status-context || 'integration' }}
106106
- name: Install Go
107-
uses: actions/setup-go@v4
107+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
108108
with:
109109
go-version: 1.22.x
110110
cache: true
@@ -124,15 +124,15 @@ jobs:
124124
SLEEP_AFTER_REQUEST: ${{ secrets.SLEEP_AFTER_REQUEST || vars.SLEEP_AFTER_REQUEST }}
125125
- name: Post failure status check
126126
if: failure() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call')
127-
uses: DataDog/github-actions/post-status-check@v2
127+
uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0
128128
with:
129129
github-token: ${{ steps.get_token.outputs.token }}
130130
repo: ${{ inputs.target-repo || 'datadog-api-spec' }}
131131
status: failure
132132
context: ${{ inputs.status-context || 'integration' }}
133133
- name: Post success status check
134134
if: "!failure() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call')"
135-
uses: DataDog/github-actions/post-status-check@v2
135+
uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0
136136
with:
137137
github-token: ${{ steps.get_token.outputs.token }}
138138
repo: ${{ inputs.target-repo || 'datadog-api-spec' }}

‎.github/workflows/reusable-pre-commit.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,29 +30,29 @@ jobs:
3030
- name: Get GitHub App token
3131
id: get_token
3232
if: inputs.enable-commit-changes
33-
uses: actions/create-github-app-token@v1
33+
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
3434
with:
3535
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
3636
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
37-
- uses: actions/checkout@v3
37+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3838
with:
3939
fetch-depth: 0
4040
repository: DataDog/datadog-api-client-go
4141
ref: ${{ inputs.target-branch || github.event.pull_request.head.sha || github.ref }}
4242
token: ${{ inputs.enable-commit-changes && steps.get_token.outputs.token || github.token }}
43-
- uses: actions/setup-python@v4
43+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
4444
with:
4545
python-version: '3.11'
4646
- name: Install pre-commit
4747
run: python -m pip install pre-commit
4848
- name: set PY
4949
run: echo "PY=$(python -c 'import platform;print(platform.python_version())')" >> $GITHUB_ENV
50-
- uses: actions/cache@v3
50+
- uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
5151
with:
5252
path: ~/.cache/pre-commit
5353
key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
5454
- name: Install Go
55-
uses: actions/setup-go@v4
55+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
5656
with:
5757
go-version: 1.22.x
5858
- name: Determine pre-commit range

‎.github/workflows/stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
stale:
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/stale@v9
19+
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
2020
with:
2121
repo-token: ${{ secrets.GITHUB_TOKEN }}
2222
stale-issue-message: >-

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
scope: DataDog/datadog-api-spec
6767
policy: datadog-api-client-go.github.post-status-check.pr
6868
- name: Post status check
69-
uses: DataDog/github-actions/post-status-check@v2
69+
uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0
7070
with:
7171
github-token: ${{ steps.octo-sts.outputs.token }}
7272
repo: datadog-api-spec

0 commit comments

Comments
 (0)