Skip to content

Commit dbbb7b8

Browse files
bussyjdOisinKyne
bussyjd
authored and
OisinKyne
committed
fix(actions): update sha-pinned workflow actions
1 parent 84ec935 commit dbbb7b8

8 files changed

Lines changed: 64 additions & 58 deletions

‎.github/workflows/docker-publish-openclaw.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242

4343
steps:
4444
- name: Checkout obol-stack
45-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4646

4747
- name: Resolve versions and check for updates
4848
id: check
@@ -103,31 +103,31 @@ jobs:
103103

104104
steps:
105105
- name: Checkout obol-stack
106-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
106+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
107107

108108
- name: Checkout upstream OpenClaw
109-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
109+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
110110
with:
111111
repository: openclaw/openclaw
112112
ref: ${{ needs.check-upstream.outputs.openclaw_version }}
113113
path: openclaw-src
114114

115115
- name: Set up Docker Buildx
116-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
116+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
117117

118118
- name: Set up QEMU
119-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
119+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
120120

121121
- name: Login to GitHub Container Registry
122-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
122+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
123123
with:
124124
registry: ${{ env.REGISTRY }}
125125
username: ${{ github.actor }}
126126
password: ${{ secrets.GITHUB_TOKEN }}
127127

128128
- name: Extract base image metadata
129129
id: meta
130-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
130+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
131131
with:
132132
images: ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}
133133
tags: |
@@ -142,7 +142,7 @@ jobs:
142142
org.opencontainers.image.version=${{ needs.check-upstream.outputs.openclaw_version }}
143143
144144
- name: Build and push base image
145-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
145+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
146146
with:
147147
context: openclaw-src
148148
platforms: linux/amd64,linux/arm64
@@ -164,24 +164,24 @@ jobs:
164164

165165
steps:
166166
- name: Checkout obol-stack
167-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
167+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
168168

169169
- name: Set up Docker Buildx
170-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
170+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
171171

172172
- name: Set up QEMU
173-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
173+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
174174

175175
- name: Login to GitHub Container Registry
176-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
176+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
177177
with:
178178
registry: ${{ env.REGISTRY }}
179179
username: ${{ github.actor }}
180180
password: ${{ secrets.GITHUB_TOKEN }}
181181

182182
- name: Extract final image metadata
183183
id: meta
184-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
184+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
185185
with:
186186
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
187187
tags: |
@@ -197,7 +197,7 @@ jobs:
197197
org.opencontainers.image.version=${{ needs.check-upstream.outputs.openclaw_version }}
198198
199199
- name: Build and push final image
200-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
200+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
201201
with:
202202
context: .
203203
file: docker/openclaw/Dockerfile
@@ -224,15 +224,15 @@ jobs:
224224

225225
steps:
226226
- name: Run Trivy vulnerability scanner
227-
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
227+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
228228
with:
229229
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
230230
format: 'sarif'
231231
output: 'trivy-results.sarif'
232232
severity: 'CRITICAL,HIGH'
233233

234234
- name: Upload Trivy scan results to GitHub Security tab
235-
uses: github/codeql-action/upload-sarif@b13d724d35ff0a814e21683638ed68ed34cf53d1 # main
235+
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
236236
with:
237237
sarif_file: 'trivy-results.sarif'
238238
if: always()

‎.github/workflows/docker-publish-storefront.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,24 +28,24 @@ jobs:
2828

2929
steps:
3030
- name: Checkout
31-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3232

3333
- name: Set up Docker Buildx
34-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
34+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
3535

3636
- name: Set up QEMU
37-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
37+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
3838

3939
- name: Login to GitHub Container Registry
40-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
40+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
4141
with:
4242
registry: ${{ env.REGISTRY }}
4343
username: ${{ github.actor }}
4444
password: ${{ secrets.GITHUB_TOKEN }}
4545

4646
- name: Extract image metadata
4747
id: meta
48-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
48+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
4949
with:
5050
images: ${{ env.REGISTRY }}/obolnetwork/obol-stack-public-storefront
5151
tags: |
@@ -68,7 +68,7 @@ jobs:
6868
org.opencontainers.image.source=https://github.com/ObolNetwork/obol-stack
6969
7070
- name: Build and push
71-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
71+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
7272
with:
7373
context: .
7474
file: Dockerfile.public-storefront
@@ -89,15 +89,15 @@ jobs:
8989

9090
steps:
9191
- name: Run Trivy vulnerability scanner
92-
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
92+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
9393
with:
9494
image-ref: ${{ env.REGISTRY }}/obolnetwork/obol-stack-public-storefront:${{ github.sha }}
9595
format: 'sarif'
9696
output: 'trivy-results.sarif'
9797
severity: 'CRITICAL,HIGH'
9898

9999
- name: Upload Trivy scan results to GitHub Security tab
100-
uses: github/codeql-action/upload-sarif@b13d724d35ff0a814e21683638ed68ed34cf53d1 # main
100+
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
101101
with:
102102
sarif_file: 'trivy-results.sarif'
103103
if: always()

‎.github/workflows/docker-publish-x402.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -63,24 +63,24 @@ jobs:
6363

6464
steps:
6565
- name: Checkout
66-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
66+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6767

6868
- name: Set up Docker Buildx
69-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
69+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
7070

7171
- name: Set up QEMU
72-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
72+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
7373

7474
- name: Login to GitHub Container Registry
75-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
75+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
7676
with:
7777
registry: ${{ env.REGISTRY }}
7878
username: ${{ github.actor }}
7979
password: ${{ secrets.GITHUB_TOKEN }}
8080

8181
- name: Extract image metadata
8282
id: meta
83-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
83+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
8484
with:
8585
images: ${{ env.REGISTRY }}/${{ matrix.image }}
8686
tags: |
@@ -105,7 +105,7 @@ jobs:
105105
106106
- name: Build and push
107107
id: build-push
108-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
108+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
109109
with:
110110
context: .
111111
file: ${{ matrix.dockerfile }}
@@ -141,15 +141,15 @@ jobs:
141141

142142
steps:
143143
- name: Run Trivy vulnerability scanner
144-
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
144+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
145145
with:
146146
image-ref: ${{ env.REGISTRY }}/${{ matrix.image }}:${{ github.sha }}
147147
format: 'sarif'
148148
output: 'trivy-results.sarif'
149149
severity: 'CRITICAL,HIGH'
150150

151151
- name: Upload Trivy scan results to GitHub Security tab
152-
uses: github/codeql-action/upload-sarif@b13d724d35ff0a814e21683638ed68ed34cf53d1 # main
152+
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
153153
with:
154154
sarif_file: 'trivy-results.sarif'
155155
if: always()

‎.github/workflows/gitleaks.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,17 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
1919
fetch-depth: 0
2020

2121
- name: Install gitleaks
2222
run: |
23-
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar xz
23+
GITLEAKS_VERSION=8.30.1
24+
GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
25+
curl -sSfL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
26+
echo "${GITLEAKS_SHA256} gitleaks.tar.gz" | sha256sum -c -
27+
tar xzf gitleaks.tar.gz gitleaks
2428
sudo mv gitleaks /usr/local/bin/
2529
2630
- name: Run gitleaks on PR diff

‎.github/workflows/helm-template-smoke.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ jobs:
2121
runs-on: ubuntu-latest
2222
steps:
2323
- name: Checkout
24-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525

2626
- name: Set up Helm
27-
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
27+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
2828
with:
2929
version: v3.20.1 # match obolup.sh pinned version
3030

‎.github/workflows/lint-test.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,17 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616
with:
1717
fetch-depth: 0
1818

1919
- name: Set up Helm
20-
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
20+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
2121
with:
2222
version: v3.12.0
2323

2424
- name: Set up Python
25-
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
25+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2626
with:
2727
python-version: "3.12"
2828

@@ -32,9 +32,9 @@ jobs:
3232
- name: Run chart-testing (list-changed)
3333
id: list-changed
3434
run: |
35-
changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
35+
changed=$(ct list-changed --target-branch "${{ github.event.repository.default_branch }}")
3636
if [[ -n "$changed" ]]; then
37-
echo "changed=true" >> $GITHUB_OUTPUT
37+
echo "changed=true" >> "$GITHUB_OUTPUT"
3838
fi
3939
4040
- name: Run chart-testing (lint)
@@ -52,15 +52,15 @@ jobs:
5252
runs-on: ubuntu-latest
5353
steps:
5454
- name: Checkout
55-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
55+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5656

5757
- name: Set up Go
58-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
58+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
5959
with:
6060
go-version-file: 'go.mod'
6161

6262
- name: Set up just
63-
uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2.0.2
63+
uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
6464

6565
- name: Regenerate CRDs + DeepCopy
6666
run: just generate

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,12 @@ jobs:
7474

7575
steps:
7676
- name: Checkout code
77-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
77+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7878
with:
7979
fetch-depth: 0
8080

8181
- name: Set up Go
82-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
82+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
8383
with:
8484
go-version-file: 'go.mod'
8585

@@ -107,10 +107,12 @@ jobs:
107107
GIT_DIRTY="false"
108108
fi
109109
110-
echo "version=$VERSION" >> $GITHUB_OUTPUT
111-
echo "git_commit=$GIT_COMMIT" >> $GITHUB_OUTPUT
112-
echo "build_time=$BUILD_TIME" >> $GITHUB_OUTPUT
113-
echo "git_dirty=$GIT_DIRTY" >> $GITHUB_OUTPUT
110+
{
111+
echo "version=$VERSION"
112+
echo "git_commit=$GIT_COMMIT"
113+
echo "build_time=$BUILD_TIME"
114+
echo "git_dirty=$GIT_DIRTY"
115+
} >> "$GITHUB_OUTPUT"
114116
115117
- name: Build binary
116118
env:
@@ -132,7 +134,7 @@ jobs:
132134
chmod +x "$OUTPUT"
133135
134136
- name: Upload artifact
135-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
137+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
136138
with:
137139
name: obol_${{ matrix.goos }}_${{ matrix.goarch }}
138140
path: obol_${{ matrix.goos }}_${{ matrix.goarch }}
@@ -145,10 +147,10 @@ jobs:
145147

146148
steps:
147149
- name: Checkout code
148-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
150+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
149151

150152
- name: Download all artifacts
151-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
153+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
152154
with:
153155
path: artifacts
154156
merge-multiple: true
@@ -157,9 +159,9 @@ jobs:
157159
id: tag
158160
run: |
159161
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
160-
echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
162+
echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
161163
else
162-
echo "tag=${{ github.ref_name }}" >> $GITHUB_OUTPUT
164+
echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
163165
fi
164166
165167
- name: Generate checksums
@@ -169,7 +171,7 @@ jobs:
169171
cat SHA256SUMS
170172
171173
- name: Create Release
172-
uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
174+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
173175
with:
174176
tag_name: ${{ steps.tag.outputs.tag }}
175177
name: Release ${{ steps.tag.outputs.tag }}

‎.github/workflows/renovate.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout
28-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929

3030
- name: Run Renovate
31-
uses: renovatebot/github-action@79dc0ba74dc3de28db0a7aeb1d0b95d5bf5fde2a # v46.1.13
31+
uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
3232
env:
3333
LOG_LEVEL: debug
3434
RENOVATE_DRY_RUN: ${{ github.event.inputs.dry_run == 'true' && 'full' || '' }}

0 commit comments

Comments
 (0)