Skip to content

Commit 784a443

Browse files
arturcicarturcic
authored
Merge pull request #4995 from arturcic/fix/sonar-s7637-pin-actions
ci: pin GitHub Actions to full commit SHAs (S7637)
2 parents 23d4bc5 + ecf7698 commit 784a443

28 files changed

Lines changed: 128 additions & 84 deletions

‎.github/actions/artifacts-attest/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ runs:
55
using: 'composite'
66
steps:
77
- name: 'Attestation'
8-
uses: actions/attest-build-provenance@v4.1.0
8+
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
99
with:
1010
subject-path: |
1111
${{ github.workspace }}/artifacts/packages/native

‎.github/actions/artifacts-restore/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,25 +4,25 @@ description: 'Artifacts restore'
44
runs:
55
using: 'composite'
66
steps:
7-
- uses: actions/download-artifact@v8
7+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
88
name: Download native linux packages
99
with:
1010
name: native-Linux
1111
path: ${{ github.workspace }}/artifacts/packages/native
1212

13-
- uses: actions/download-artifact@v8
13+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1414
name: Download native windows packages
1515
with:
1616
name: native-Windows
1717
path: ${{ github.workspace }}/artifacts/packages/native
1818

19-
- uses: actions/download-artifact@v8
19+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
2020
name: Download native macos packages
2121
with:
2222
name: native-macOS
2323
path: ${{ github.workspace }}/artifacts/packages/native
2424

25-
- uses: actions/download-artifact@v8
25+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
2626
name: Download nuget packages
2727
with:
2828
name: nuget

‎.github/actions/cache-restore/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,19 @@ runs:
66
steps:
77
- name: Use cached cake frosting
88
id: cache-cake
9-
uses: actions/cache@v5
9+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
1010
with:
1111
path: run
1212
key: run-${{ runner.os }}-${{ hashFiles('./build/**') }}
1313

1414
- name: Use cached tools
1515
id: cache-tools
16-
uses: actions/cache@v5
16+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
1717
with:
1818
path: tools
1919
key: tools-${{ runner.os }}-${{ hashFiles('./build/**') }}
2020

2121
- name: Setup .NET SDK
22-
uses: actions/setup-dotnet@v5
22+
uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
2323
with:
2424
global-json-file: global.json

‎.github/actions/docker-manifests/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ runs:
2424
using: 'composite'
2525
steps:
2626
- name: Login to DockerHub
27-
uses: docker/login-action@v4
27+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
2828
with:
2929
username: ${{ inputs.docker_registry_username }}
3030
password: ${{ inputs.docker_registry_password }}
@@ -40,7 +40,7 @@ runs:
4040
--docker_distro=$env:DOCKER_DISTRO --docker_registry dockerhub
4141
4242
- name: Login to GitHub
43-
uses: docker/login-action@v4
43+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
4444
with:
4545
registry: ghcr.io
4646
username: ${{ inputs.github_registry_username }}

‎.github/actions/docker-publish/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ runs:
2727
using: 'composite'
2828
steps:
2929
- name: Login to DockerHub
30-
uses: docker/login-action@v4
30+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
3131
with:
3232
username: ${{ inputs.docker_registry_username }}
3333
password: ${{ inputs.docker_registry_password }}
@@ -44,7 +44,7 @@ runs:
4444
--docker_distro=$env:DOCKER_DISTRO --docker_registry dockerhub --verbosity=diagnostic
4545
4646
- name: Login to GitHub
47-
uses: docker/login-action@v4
47+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
4848
with:
4949
registry: ghcr.io
5050
username: ${{ inputs.github_registry_username }}

‎.github/actions/docker-setup/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ runs:
55
using: 'composite'
66
steps:
77
- name: Set up Docker
8-
uses: docker/setup-docker-action@v5
8+
uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23 # v5.2.0
99
with:
1010
daemon-config: '{ "features": { "containerd-snapshotter": true } }'

‎.github/actions/docker-test/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ runs:
1515
using: 'composite'
1616
steps:
1717
- name: '[Docker Build & Test] DockerHub'
18-
uses: nick-fields/retry@v4
18+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
1919
with:
2020
shell: pwsh
2121
timeout_minutes: 30
@@ -27,7 +27,7 @@ runs:
2727
--docker_distro=${{ inputs.docker_distro }} --docker_registry dockerhub --verbosity=diagnostic
2828
2929
- name: '[Docker Build & Test] GitHub'
30-
uses: nick-fields/retry@v4
30+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
3131
with:
3232
shell: pwsh
3333
timeout_minutes: 30

‎.github/workflows/_artifacts_linux.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,20 @@ jobs:
2929
dotnet_version: ${{ fromJson(inputs.dotnet_versions) }}
3030
steps:
3131
- name: Checkout
32-
uses: actions/checkout@v7
32+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3333
with:
3434
fetch-depth: 0
3535

3636
- name: Restore State
3737
uses: ./.github/actions/cache-restore
3838

39-
- uses: actions/download-artifact@v8
39+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4040
name: Download nuget packages
4141
with:
4242
name: nuget
4343
path: ${{ github.workspace }}/artifacts/packages/nuget
4444

45-
- uses: actions/download-artifact@v8
45+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4646
name: Download native packages
4747
with:
4848
name: native-Linux
@@ -52,7 +52,7 @@ jobs:
5252
uses: ./.github/actions/docker-setup
5353

5454
- name: '[Test Artifacts]'
55-
uses: nick-fields/retry@v4
55+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
5656
with:
5757
shell: pwsh
5858
timeout_minutes: 30

‎.github/workflows/_artifacts_windows.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,21 @@ jobs:
1616

1717
steps:
1818
- name: Checkout
19-
uses: actions/checkout@v7
19+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2020
with:
2121
fetch-depth: 0
2222

2323
- name: Restore State
2424
uses: ./.github/actions/cache-restore
2525

26-
- uses: actions/download-artifact@v8
26+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
2727
name: Download nuget packages
2828
with:
2929
name: nuget
3030
path: ${{ github.workspace }}/artifacts/packages/nuget
3131

3232
- name: '[Test Artifacts]'
33-
uses: nick-fields/retry@v4
33+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
3434
with:
3535
shell: pwsh
3636
timeout_minutes: 30

‎.github/workflows/_build.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
runs-on: ${{ matrix.os }}
1717
steps:
1818
- name: Checkout
19-
uses: actions/checkout@v7
19+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2020
with:
2121
fetch-depth: 0
2222

@@ -28,21 +28,21 @@ jobs:
2828
run: dotnet run/build.dll --target=Package
2929

3030
- name: 'Upload nuget packages'
31-
uses: actions/upload-artifact@v7
31+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3232
if: matrix.os == 'windows-2025-vs2026'
3333
with:
3434
name: nuget
3535
path: ${{ github.workspace }}/artifacts/packages/nuget
3636

3737
- name: 'Upload native packages'
38-
uses: actions/upload-artifact@v7
38+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3939
if: matrix.os == 'windows-2025-vs2026'
4040
with:
4141
name: native-${{ runner.os }}
4242
path: ${{ github.workspace }}/artifacts/packages/native/*.zip
4343

4444
- name: 'Upload native packages'
45-
uses: actions/upload-artifact@v7
45+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
4646
if: matrix.os != 'windows-2025-vs2026'
4747
with:
4848
name: native-${{ runner.os }}

0 commit comments

Comments
 (0)