Skip to content

Commit f704cde

Browse files
step-security-botcquil11
step-security-bot
and
cquil11
authored
[StepSecurity] ci: Harden GitHub Actions (#198)
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Cameron Quilici <cjquilici@gmail.com>
1 parent b1df040 commit f704cde

11 files changed

Lines changed: 54 additions & 39 deletions

‎.github/workflows/benchmark-multinode-tmpl.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ env:
4949
RANDOM_RANGE_RATIO: ${{ inputs.random-range-ratio }}
5050
MTP_MODE: ${{ inputs.mtp-mode }}
5151

52+
permissions:
53+
contents: read
54+
5255
jobs:
5356
benchmark:
5457
runs-on: ${{ inputs.runner }}
@@ -65,7 +68,7 @@ jobs:
6568
sleep 5
6669
done
6770
68-
- uses: actions/checkout@v5
71+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
6972
with:
7073
token: ${{ secrets.REPO_PAT }}
7174
fetch-depth: 0
@@ -106,7 +109,7 @@ jobs:
106109
done
107110
108111
- name: Upload results
109-
uses: actions/upload-artifact@v5
112+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
110113
with:
111114
name: ${{ env.RESULT_FILENAME }}
112115
path: agg_${{ env.RESULT_FILENAME }}_*.json

‎.github/workflows/benchmark-tmpl.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ env:
6363
DP_ATTENTION: ${{ inputs.dp-attn }}
6464
CONC: ${{ inputs.conc }}
6565

66+
permissions:
67+
contents: read
68+
6669
jobs:
6770
benchmark:
6871
runs-on: ${{ inputs.runner }}
@@ -119,7 +122,7 @@ jobs:
119122
done
120123
fi
121124
122-
- uses: actions/checkout@v5
125+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
123126
with:
124127
token: ${{ secrets.REPO_PAT }}
125128
fetch-depth: 0
@@ -143,7 +146,7 @@ jobs:
143146
run: |
144147
python3 utils/process_result.py
145148
- name: Upload result
146-
uses: actions/upload-artifact@v5
149+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
147150
with:
148151
name: ${{ env.RESULT_FILENAME }}
149152
path: agg_${{ env.RESULT_FILENAME }}.json

‎.github/workflows/collect-results.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,16 @@ on:
88
type: string
99
default: ''
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
collect-results:
1316
runs-on: ubuntu-latest
1417

1518
steps:
1619
- name: Checkout code
17-
uses: actions/checkout@v5
20+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1821
with:
1922
token: ${{ secrets.REPO_PAT }}
2023
fetch-depth: 0
@@ -28,7 +31,7 @@ jobs:
2831
run: pip install -q matplotlib
2932

3033
- name: Download JSON artifacts
31-
uses: actions/download-artifact@v6
34+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
3235
with:
3336
path: results/
3437
pattern: ${{ inputs.exp-name && format('{0}_*', inputs.exp-name) || '*' }}
@@ -40,15 +43,15 @@ jobs:
4043
run: python3 utils/collect_results.py results/ ${{ inputs.exp-name || 'all' }}
4144

4245
- name: Upload aggregated results
43-
uses: actions/upload-artifact@v5
46+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
4447
with:
4548
name: results_${{ inputs.exp-name || 'all' }}
4649
path: agg_${{ inputs.exp-name || 'all' }}.json
4750

4851
- name: Plot performance
4952
run: python3 utils/plot_perf.py results/ ${{ inputs.exp-name || 'all' }}
5053
- name: Upload performance graphs
51-
uses: actions/upload-artifact@v5
54+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
5255
with:
5356
name: graphs_${{ inputs.exp-name || 'all' }}
5457
path: |

‎.github/workflows/e2e-tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
search-space-config: ${{ steps.get-jobs.outputs.search-space-config }}
1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v5
19+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2020

2121
- name: Set up Python
2222
uses: actions/setup-python@v6
@@ -72,7 +72,7 @@ jobs:
7272
GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
7373

7474
steps:
75-
- uses: actions/checkout@v5
75+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
7676
with:
7777
token: ${{ secrets.REPO_PAT }}
7878
fetch-depth: 0
@@ -86,15 +86,15 @@ jobs:
8686
run: pip install PyGithub
8787

8888
- name: Download results artifacts
89-
uses: actions/download-artifact@v6
89+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
9090
with:
9191
path: ${{ env.RESULTS_DIR }}
9292
pattern: results_*
9393

9494
- name: Calculate success rate
9595
run: python3 utils/calc_success_rate.py $STATS_FILENAME
9696

97-
- uses: actions/upload-artifact@v5
97+
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
9898
with:
9999
name: "run-stats"
100100
path: ${{ env.STATS_FILENAME }}.json

‎.github/workflows/full-sweep-1k1k-scheduler.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
search-space-config: ${{ steps.get-dsr1-configs.outputs.search-space-config }}
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v5
15+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1616

1717
- name: Set up Python
1818
uses: actions/setup-python@v6
@@ -33,7 +33,7 @@ jobs:
3333
search-space-config: ${{ steps.get-gptoss-configs.outputs.search-space-config }}
3434
steps:
3535
- name: Checkout code
36-
uses: actions/checkout@v5
36+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3737

3838
- name: Set up Python
3939
uses: actions/setup-python@v6
@@ -168,7 +168,7 @@ jobs:
168168
GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
169169

170170
steps:
171-
- uses: actions/checkout@v5
171+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
172172
with:
173173
token: ${{ secrets.REPO_PAT }}
174174
fetch-depth: 0
@@ -182,15 +182,15 @@ jobs:
182182
run: pip install PyGithub
183183

184184
- name: Download results artifacts
185-
uses: actions/download-artifact@v6
185+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
186186
with:
187187
path: ${{ env.RESULTS_DIR }}
188188
pattern: results_*
189189

190190
- name: Calculate success rate
191191
run: python3 utils/calc_success_rate.py $STATS_FILENAME
192192

193-
- uses: actions/upload-artifact@v5
193+
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
194194
with:
195195
name: "run-stats"
196196
path: ${{ env.STATS_FILENAME }}.json

‎.github/workflows/full-sweep-1k8k-scheduler.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
search-space-config: ${{ steps.get-dsr1-configs.outputs.search-space-config }}
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v5
15+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1616

1717
- name: Set up Python
1818
uses: actions/setup-python@v6
@@ -33,7 +33,7 @@ jobs:
3333
search-space-config: ${{ steps.get-gptoss-configs.outputs.search-space-config }}
3434
steps:
3535
- name: Checkout code
36-
uses: actions/checkout@v5
36+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3737

3838
- name: Set up Python
3939
uses: actions/setup-python@v6
@@ -123,7 +123,7 @@ jobs:
123123
GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
124124

125125
steps:
126-
- uses: actions/checkout@v5
126+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
127127
with:
128128
token: ${{ secrets.REPO_PAT }}
129129
fetch-depth: 0
@@ -137,15 +137,15 @@ jobs:
137137
run: pip install PyGithub
138138

139139
- name: Download results artifacts
140-
uses: actions/download-artifact@v6
140+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
141141
with:
142142
path: ${{ env.RESULTS_DIR }}
143143
pattern: results_*
144144

145145
- name: Calculate success rate
146146
run: python3 utils/calc_success_rate.py $STATS_FILENAME
147147

148-
- uses: actions/upload-artifact@v5
148+
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
149149
with:
150150
name: "run-stats"
151151
path: ${{ env.STATS_FILENAME }}.json

‎.github/workflows/full-sweep-8k1k-scheduler.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
search-space-config: ${{ steps.get-dsr1-configs.outputs.search-space-config }}
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v5
15+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1616

1717
- name: Set up Python
1818
uses: actions/setup-python@v6
@@ -33,7 +33,7 @@ jobs:
3333
search-space-config: ${{ steps.get-gptoss-configs.outputs.search-space-config }}
3434
steps:
3535
- name: Checkout code
36-
uses: actions/checkout@v5
36+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3737

3838
- name: Set up Python
3939
uses: actions/setup-python@v6
@@ -168,7 +168,7 @@ jobs:
168168
GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
169169

170170
steps:
171-
- uses: actions/checkout@v5
171+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
172172
with:
173173
token: ${{ secrets.REPO_PAT }}
174174
fetch-depth: 0
@@ -182,15 +182,15 @@ jobs:
182182
run: pip install PyGithub
183183

184184
- name: Download results artifacts
185-
uses: actions/download-artifact@v6
185+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
186186
with:
187187
path: ${{ env.RESULTS_DIR }}
188188
pattern: results_*
189189

190190
- name: Calculate success rate
191191
run: python3 utils/calc_success_rate.py $STATS_FILENAME
192192

193-
- uses: actions/upload-artifact@v5
193+
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
194194
with:
195195
name: "run-stats"
196196
path: ${{ env.STATS_FILENAME }}.json

‎.github/workflows/full-sweep-test.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
gptoss-8k1k: ${{ steps.generate-configs.outputs.gptoss-8k1k }}
4747
steps:
4848
- name: Checkout code
49-
uses: actions/checkout@v5
49+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5050

5151
- name: Set up Python
5252
uses: actions/setup-python@v6
@@ -429,7 +429,7 @@ jobs:
429429
GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
430430

431431
steps:
432-
- uses: actions/checkout@v5
432+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
433433
with:
434434
token: ${{ secrets.REPO_PAT }}
435435
fetch-depth: 0
@@ -443,15 +443,15 @@ jobs:
443443
run: pip install PyGithub
444444

445445
- name: Download results artifacts
446-
uses: actions/download-artifact@v6
446+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
447447
with:
448448
path: ${{ env.RESULTS_DIR }}
449449
pattern: results_*
450450

451451
- name: Calculate success rate
452452
run: python3 utils/calc_success_rate.py $STATS_FILENAME
453453

454-
- uses: actions/upload-artifact@v5
454+
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
455455
with:
456456
name: "run-stats"
457457
path: ${{ env.STATS_FILENAME }}.json

‎.github/workflows/label-validation.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
search-space-config: ${{ steps.get-jobs.outputs.search-space-config }}
1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v5
19+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
2020

2121
- name: Set up Python
2222
uses: actions/setup-python@v6
@@ -127,7 +127,7 @@ jobs:
127127
GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
128128

129129
steps:
130-
- uses: actions/checkout@v5
130+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
131131
with:
132132
token: ${{ secrets.REPO_PAT }}
133133
fetch-depth: 0
@@ -141,15 +141,15 @@ jobs:
141141
run: pip install PyGithub
142142

143143
- name: Download results artifacts
144-
uses: actions/download-artifact@v6
144+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
145145
with:
146146
path: ${{ env.RESULTS_DIR }}
147147
pattern: results_*
148148

149149
- name: Calculate success rate
150150
run: python3 utils/calc_success_rate.py $STATS_FILENAME
151151

152-
- uses: actions/upload-artifact@v5
152+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
153153
with:
154154
name: "run-stats"
155155
path: ${{ env.STATS_FILENAME }}.json

‎.github/workflows/pr-line-counter.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
paths:
77
- 'utils/matrix-logic/**'
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
count-lines:
1114
if: github.event.pull_request.draft != true
@@ -18,7 +21,7 @@ jobs:
1821

1922
steps:
2023
- name: Checkout code
21-
uses: actions/checkout@v5
24+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2225
with:
2326
fetch-depth: 0
2427

@@ -108,7 +111,7 @@ jobs:
108111
fi
109112
110113
- name: Comment on PR
111-
uses: actions/github-script@v8
114+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
112115
with:
113116
script: |
114117
const fileExists = '${{ steps.line-count.outputs.file_exists }}';

0 commit comments

Comments
 (0)