Pin versions by diggest and add comments

Frawless · Frawless · commit b4a12059fdf9 · 2026-06-12T18:39:45.000+02:00
Signed-off-by: Jakub Stejskal &lt;xstejs24@gmail.com&gt;

# Conflicts:
#	.github/workflows/test-integrations.yml
diff --git a/.github/actions/security/snyk-container-scan/action.yml b/.github/actions/security/snyk-container-scan/action.yml
@@ -12,7 +12,7 @@ inputs:
     description: "Fail if any CVE has CVSS score above this value"
     required: false
     default: "8.0"
-  monitor:
+  snykMonitor:
     description: "Whether to also run 'snyk container monitor'"
     required: false
     default: "false"
@@ -28,7 +28,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Snyk CLI
-      uses: snyk/actions/setup@master
+      uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
 
     - name: Load and scan image
       shell: bash
@@ -57,6 +57,9 @@ runs:
           --sarif-file-output="snyk-container-${IMAGE_NAME}.sarif" \
           --json-file-output="snyk-container-${IMAGE_NAME}.json"
 
+    # This is used to set severity score to 0.0 for those results that has empty value for it.
+    # Empty value is not supported by GitHub Code Scanning page
+    # It also set tool.driver.name to distinguish between different tools within UI (different tool = different image)
     - name: Sanitize SARIF security-severity values
       shell: bash
       env:
@@ -73,21 +76,22 @@ runs:
         fi
 
     - name: Upload SARIF to GitHub Code Scanning
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       if: ${{ always() && inputs.uploadToCodeScanning == 'true' }}
       with:
         sarif_file: snyk-container-${{ inputs.image }}.sarif
         category: snyk-container-${{ inputs.image }}
         wait-for-processing: true
 
     - name: Upload SARIF as workflow artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always()
       with:
         name: snyk-container-sarif-${{ inputs.image }}
         path: snyk-container-${{ inputs.image }}.sarif
         retention-days: 30
 
+    # Monitor command is used for upload snapshot of the scan to Snyk App where Snyk will do daily scans and can generate reports
     - name: Run Snyk monitor
       if: ${{ inputs.monitor == 'true' }}
       shell: bash
diff --git a/.github/actions/security/snyk-maven-scan/action.yml b/.github/actions/security/snyk-maven-scan/action.yml
@@ -6,7 +6,7 @@ inputs:
     description: "Fail if any CVE has CVSS score above this value"
     required: false
     default: "8.0"
-  monitor:
+  snykMonitor:
     description: "Whether to also run 'snyk monitor'"
     required: false
     default: "false"
@@ -22,7 +22,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Snyk CLI
-      uses: snyk/actions/setup@master
+      uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
 
     - name: Run Snyk test
       shell: bash
@@ -32,6 +32,8 @@ runs:
           --sarif-file-output=snyk-maven-${{ inputs.projectPrefix }}.sarif \
           --json-file-output=snyk-results.json
 
+    # This is used to set severity score to 0.0 for those results that has empty value for it.
+    # Empty value is not supported by GitHub Code Scanning page
     - name: Sanitize SARIF security-severity values
       shell: bash
       run: |
@@ -44,21 +46,22 @@ runs:
         fi
 
     - name: Upload SARIF to GitHub Code Scanning
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       if: ${{ always() && inputs.uploadToCodeScanning == 'true' }}
       with:
         sarif_file: snyk-maven-${{ inputs.projectPrefix }}.sarif
         category: snyk-maven-${{ inputs.projectPrefix }}
         wait-for-processing: true
 
     - name: Upload SARIF as workflow artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always()
       with:
         name: snyk-maven-${{ inputs.projectPrefix }}.sarif
         path: snyk-maven-${{ inputs.projectPrefix }}.sarif
         retention-days: 30
 
+    # Monitor command is used for upload snapshot of the scan to Snyk App where Snyk will do daily scans and can generate reports
     - name: Run Snyk monitor
       if: ${{ inputs.monitor == 'true' }}
       shell: bash
diff --git a/.github/workflows/test-snyk.yml b/.github/workflows/test-snyk.yml
@@ -23,15 +23,15 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout github-actions
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.sha }}
 
       - name: Checkout strimzi/drain-cleaner
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: strimzi/drain-cleaner
-          ref: main
+          ref: 1.6.0
           path: drain-cleaner
 
       - name: Copy drain-cleaner project to workspace root
@@ -44,7 +44,7 @@ jobs:
         uses: ./.github/actions/dependencies/install-yq
 
       - name: Restore Maven cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.m2/repository
           key: maven-${{ hashFiles('**/pom.xml') }}
@@ -59,14 +59,16 @@ jobs:
         uses: ./.github/actions/security/snyk-maven-scan
         with:
           cvssThreshold: "99.0"
-          monitor: "false"
+          # Keep false to avoid uploading testing results to Snyk App
+          snykMonitor: "false"
+          # Keep false to avoid uploading results to GitHub Code Scanning page
+          uploadToCodeScanning: "false"
           projectPrefix: test-drain-cleaner
-          uploadToCodeScanning: "true"
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Download SARIF artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: snyk-maven-test-drain-cleaner.sarif
           path: sarif-output
@@ -86,6 +88,8 @@ jobs:
           jq empty "$SARIF_FILE"
           echo "SARIF file is valid JSON with $(jq '.runs | length' "$SARIF_FILE") run(s)"
 
+  # Test workflow loads image artifacts from test-integrations workflow.
+  # To avoid additional image build, the scan check will wait until integration workflow store the artifacts
   wait-for-container-artifact:
     name: Wait for Container Artifact
     runs-on: ubuntu-latest
@@ -95,7 +99,7 @@ jobs:
     steps:
       - name: Wait for container artifact
         id: find-build
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           INPUT_SHA: ${{ github.sha }}
           ARTIFACT_NAME: "containers-operators-amd64.tar"
@@ -174,22 +178,20 @@ jobs:
     strategy:
       matrix:
         image:
+          # Kafka images are not here to avoid need to change Kafka versions on multiple places when we bump operators repo versions for testing
           - buildah-latest-amd64
-          - kafka-build-kafka-4.1.0-amd64
-          - kafka-build-kafka-4.1.1-amd64
-          - kafka-build-kafka-4.2.0-amd64
           - kaniko-executor-latest-amd64
           - maven-builder-latest-amd64
           - operator-latest-amd64
     steps:
       - name: Checkout github-actions
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install Docker
         uses: ./.github/actions/dependencies/install-docker
 
       - name: Download container archive
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: containers-operators-amd64.tar
           run-id: ${{ needs.wait-for-container-artifact.outputs.run-id }}
@@ -204,7 +206,7 @@ jobs:
           imageFile: docker-images/container-archives/${{ matrix.image }}.tar.gz
           image: ${{ matrix.image }}
           cvssThreshold: "99.0"
-          monitor: "false"
+          snykMonitor: "false"
           uploadToCodeScanning: "false"
           projectPrefix: test-operators
         env:
@@ -233,13 +235,13 @@ jobs:
 
     steps:
       - name: Checkout github-actions
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install Docker
         uses: ./.github/actions/dependencies/install-docker
 
       - name: Download container archive
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: containers-drain-cleaner-amd64.tar
           run-id: ${{ needs.wait-for-container-artifact.outputs.run-id }}
@@ -254,7 +256,9 @@ jobs:
           imageFile: drain-cleaner-container-amd64.tar.gz
           image: drain-cleaner-amd64
           cvssThreshold: "99.0"
-          monitor: "true"
+          # Keep false to avoid uploading testing results to Snyk App
+          snykMonitor: "false"
+          # Keep false to avoid uploading results to GitHub Code Scanning page
           uploadToCodeScanning: "false"
           projectPrefix: test-drain-cleaner
         env:
