Skip to content

Commit 123d809

Browse files
CybotTMCybotTM
committed
[TASK] Pin all GitHub Actions to commit SHAs
Pin all GitHub Actions to their exact commit SHAs for supply chain security. Version comments are included for maintainability.
1 parent 8b3cbd3 commit 123d809

7 files changed

Lines changed: 28 additions & 28 deletions

File tree

‎.github/workflows/deploy-azure-assets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
build:
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v6
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222

2323
- name: Get the version
2424
id: get-version

‎.github/workflows/docker-test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: "ubuntu-latest"
2020
steps:
2121
- name: "Checkout"
22-
uses: "actions/checkout@v6"
22+
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
2323

2424
- name: "Prepare action (adjust configure-guides-step)"
2525
##################################################################

‎.github/workflows/docker.yaml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- linux/amd64
2121
- linux/arm64
2222
steps:
23-
- uses: actions/checkout@v6
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2424

2525
- name: Prepare image name
2626
run: |
@@ -31,7 +31,7 @@ jobs:
3131

3232
- name: Docker meta
3333
id: meta
34-
uses: docker/metadata-action@v5
34+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
3535
with:
3636
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
3737
tags: |
@@ -42,24 +42,24 @@ jobs:
4242
type=semver,pattern={{major}}
4343
4444
- name: Log in to the Container registry
45-
uses: docker/login-action@v3
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
4646
with:
4747
registry: ${{ env.REGISTRY }}
4848
username: ${{ github.actor }}
4949
password: ${{ secrets.GITHUB_TOKEN }}
5050

5151
- name: Set up QEMU
52-
uses: docker/setup-qemu-action@v3
52+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
5353

5454
- name: Set up Docker Buildx
5555
id: buildx
56-
uses: docker/setup-buildx-action@v3
56+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
5757

5858
- name: Build and push
5959
id: build
6060
env:
6161
TYPO3AZUREEDGEURIVERSION: ${{ env.DOCKER_METADATA_OUTPUT_VERSION }}
62-
uses: docker/build-push-action@v6
62+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
6363
with:
6464
context: .
6565
push: ${{ github.event_name != 'pull_request' }}
@@ -77,7 +77,7 @@ jobs:
7777
touch "/tmp/digests/${digest#sha256:}"
7878
-
7979
name: Upload digest
80-
uses: actions/upload-artifact@v6
80+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
8181
with:
8282
name: digests-${{ env.PLATFORM_NAME }}
8383
overwrite: true
@@ -97,18 +97,18 @@ jobs:
9797
9898
-
9999
name: Download digests
100-
uses: actions/download-artifact@v7
100+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
101101
with:
102102
pattern: digests-*
103103
merge-multiple: true
104104
path: /tmp/digests
105105
-
106106
name: Set up Docker Buildx
107-
uses: docker/setup-buildx-action@v3
107+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
108108
-
109109
name: Docker meta
110110
id: meta
111-
uses: docker/metadata-action@v5
111+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
112112
with:
113113
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
114114
tags: |
@@ -118,7 +118,7 @@ jobs:
118118
type=raw,value=latest,enable=true
119119
120120
- name: Log in to the Container registry
121-
uses: docker/login-action@v3
121+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
122122
with:
123123
registry: ${{ env.REGISTRY }}
124124
username: ${{ github.actor }}

‎.github/workflows/main.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,17 @@ jobs:
2525
- '8.5'
2626
steps:
2727
- name: Checkout
28-
uses: actions/checkout@v6
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929

3030
- name: "Install PHP"
31-
uses: "shivammathur/setup-php@v2"
31+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2.36.0
3232
with:
3333
coverage: "none"
3434
php-version: "${{ matrix.php }}"
3535
extensions: 'inotify, pcntl'
3636

3737
- name: "Install dependencies with Composer"
38-
uses: "ramsey/composer-install@v3"
38+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
3939
with:
4040
dependency-versions: "locked"
4141

@@ -50,17 +50,17 @@ jobs:
5050
runs-on: ubuntu-latest
5151
steps:
5252
- name: Checkout
53-
uses: actions/checkout@v6
53+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5454

5555
- name: "Install PHP"
56-
uses: "shivammathur/setup-php@v2"
56+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2.36.0
5757
with:
5858
coverage: "none"
5959
php-version: "${{ env.DEFAULT_PHP_VERSION }}"
6060
extensions: 'inotify, pcntl'
6161

6262
- name: "Install dependencies with Composer"
63-
uses: "ramsey/composer-install@v3"
63+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
6464
with:
6565
dependency-versions: "locked"
6666

@@ -87,17 +87,17 @@ jobs:
8787
runs-on: "ubuntu-latest"
8888
steps:
8989
- name: "Checkout"
90-
uses: "actions/checkout@v6"
90+
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
9191

9292
- name: "Install PHP"
93-
uses: "shivammathur/setup-php@v2"
93+
uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2.36.0
9494
with:
9595
coverage: "none"
9696
php-version: "${{ env.DEFAULT_PHP_VERSION }}"
9797
extensions: 'inotify, pcntl'
9898

9999
- name: "Install dependencies with Composer"
100-
uses: "ramsey/composer-install@v3"
100+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
101101
with:
102102
dependency-versions: "locked"
103103

‎.github/workflows/pr-auto-approve.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
steps:
1919
- name: Dependabot metadata
2020
id: metadata
21-
uses: dependabot/fetch-metadata@v2
21+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
2222
with:
2323
github-token: "${{ secrets.GITHUB_TOKEN }}"
2424

‎.github/workflows/pr-auto-merge.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
steps:
1818
- name: Dependabot metadata
1919
id: metadata
20-
uses: dependabot/fetch-metadata@v2
20+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
2121
with:
2222
github-token: "${{ secrets.GITHUB_TOKEN }}"
2323

‎.github/workflows/split-repositories.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,22 +20,22 @@ jobs:
2020
runs-on: "ubuntu-latest"
2121
name: "Publish Sub-split"
2222
steps:
23-
- uses: "actions/checkout@v6"
23+
- uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
2424
with:
2525
fetch-depth: "0"
2626
persist-credentials: "false"
27-
- uses: "frankdejonge/use-github-token@1.1.0"
27+
- uses: "frankdejonge/use-github-token@15e6289d07c12b3b1603268a628bb74f2e9765f4" # 1.1.0
2828
with:
2929
authentication: "typo3-documentation-team:${{ secrets.BOT_TOKEN }}"
3030
user_name: "TYPO3 Documentation Team"
3131
user_email: "documentation-automation@typo3.com"
3232
- name: "Cache splitsh-lite"
3333
id: "splitsh-cache"
34-
uses: "actions/cache@v5"
34+
uses: "actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306" # v5.0.3
3535
with:
3636
path: "./.splitsh"
3737
key: "${{ runner.os }}-splitsh-d-101"
38-
- uses: "frankdejonge/use-subsplit-publish@1.1.0"
38+
- uses: "frankdejonge/use-subsplit-publish@0001015147267203898034927e8cccad3a7a9aa7" # 1.1.0
3939
with:
4040
source-branch: "main"
4141
config-path: "./config.subsplit-publish.json"

0 commit comments

Comments
 (0)