Skip to content

Commit 86000a5

Browse files
dageckodagecko
committed
fix: pin 17 unpinned action(s),extract 7 unsafe expression(s) to env vars
Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard). Changes: .github/workflows/build.yaml | 8 ++++---- .github/workflows/publish.yaml | 28 +++++++++++++++++----------- .github/workflows/release.yaml | 26 +++++++++++++++++--------- 3 files changed, 38 insertions(+), 24 deletions(-)
1 parent ada3489 commit 86000a5

File tree

3 files changed

+38
-24
lines changed

3 files changed

+38
-24
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
- name: Checkout repo
3535
uses: actions/checkout@v6
3636
- name: Check changed files
37-
uses: dorny/paths-filter@v3
37+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
3838
id: filter
3939
with:
4040
filters: |
@@ -98,7 +98,7 @@ jobs:
9898
if: needs.changes.outputs.helm == 'true'
9999
steps:
100100
- uses: actions/checkout@v6
101-
- uses: azure/setup-helm@v4
101+
- uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
102102
with:
103103
token: ${{ secrets.GITHUB_TOKEN }}
104104
- run: helm plugin install https://github.com/instrumenta/helm-kubeval
@@ -151,7 +151,7 @@ jobs:
151151
test/package-lock.json
152152
- run: SKIP_SUBMODULE_DEPS=1 npm ci
153153
- run: npm run test:unit
154-
- uses: codecov/codecov-action@v5
154+
- uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
155155
if: success()
156156
with:
157157
token: ${{ secrets.CODECOV_TOKEN }}
@@ -167,7 +167,7 @@ jobs:
167167
with:
168168
submodules: true
169169
- run: sudo apt update && sudo apt install -y libkrb5-dev
170-
- uses: awalsh128/cache-apt-pkgs-action@latest
170+
- uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
171171
with:
172172
packages: quilt
173173
version: 1.0

‎.github/workflows/publish.yaml‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
node-version-file: .node-version
3434

3535
- name: Download npm package from release artifacts
36-
uses: robinraju/release-downloader@v1.12
36+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
3737
with:
3838
repository: "coder/code-server"
3939
tag: ${{ github.event.inputs.version || github.ref_name }}
@@ -43,9 +43,11 @@ jobs:
4343
# Strip out the v (v4.9.1 -> 4.9.1).
4444
- name: Get and set VERSION
4545
run: |
46-
TAG="${{ github.event.inputs.version || github.ref_name }}"
46+
TAG="${INPUT_VERSION}"
4747
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
4848
49+
env:
50+
INPUT_VERSION: ${{ github.event.inputs.version || github.ref_name }}
4951
- run: npm run publish:npm
5052
env:
5153
VERSION: ${{ env.VERSION }}
@@ -88,11 +90,13 @@ jobs:
8890
# Strip out the v (v4.9.1 -> 4.9.1).
8991
- name: Get and set VERSION
9092
run: |
91-
TAG="${{ github.event.inputs.version || github.ref_name }}"
93+
TAG="${INPUT_VERSION}"
9294
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
9395
96+
env:
97+
INPUT_VERSION: ${{ github.event.inputs.version || github.ref_name }}
9498
- name: Validate package
95-
uses: heyhusen/archlinux-package-action@v3.0.0
99+
uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
96100
env:
97101
VERSION: ${{ env.VERSION }}
98102
with:
@@ -119,19 +123,19 @@ jobs:
119123
uses: actions/checkout@v6
120124

121125
- name: Set up QEMU
122-
uses: docker/setup-qemu-action@v3
126+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
123127

124128
- name: Set up Docker Buildx
125-
uses: docker/setup-buildx-action@v3
129+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
126130

127131
- name: Login to Docker Hub
128-
uses: docker/login-action@v3
132+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
129133
with:
130134
username: ${{ secrets.DOCKER_USERNAME }}
131135
password: ${{ secrets.DOCKER_PASSWORD }}
132136

133137
- name: Login to GHCR
134-
uses: docker/login-action@v3
138+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
135139
with:
136140
registry: ghcr.io
137141
username: ${{ github.actor }}
@@ -140,19 +144,21 @@ jobs:
140144
# Strip out the v (v4.9.1 -> 4.9.1).
141145
- name: Get and set VERSION
142146
run: |
143-
TAG="${{ github.event.inputs.version || github.ref_name }}"
147+
TAG="${INPUT_VERSION}"
144148
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
145149
150+
env:
151+
INPUT_VERSION: ${{ github.event.inputs.version || github.ref_name }}
146152
- name: Download deb artifacts
147-
uses: robinraju/release-downloader@v1.12
153+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
148154
with:
149155
repository: "coder/code-server"
150156
tag: v${{ env.VERSION }}
151157
fileName: "*.deb"
152158
out-file-path: "release-packages"
153159

154160
- name: Download rpm artifacts
155-
uses: robinraju/release-downloader@v1.12
161+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
156162
with:
157163
repository: "coder/code-server"
158164
tag: v${{ env.VERSION }}

‎.github/workflows/release.yaml‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,16 @@ jobs:
111111
# Strip out the v (v4.9.1 -> 4.9.1).
112112
- name: Get and set VERSION
113113
run: |
114-
TAG="${{ inputs.version || github.ref_name }}"
114+
TAG="${REF_NAME}"
115115
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
116116
117+
env:
118+
REF_NAME: ${{ inputs.version || github.ref_name }}
117119
- env:
118120
VERSION: ${{ env.VERSION }}
119121
run: npm run package $PKG_ARCH
120122

121-
- uses: softprops/action-gh-release@v1
123+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
122124
with:
123125
draft: true
124126
discussion_category_name: "📣 Announcements"
@@ -171,15 +173,17 @@ jobs:
171173
# Strip out the v (v4.9.1 -> 4.9.1).
172174
- name: Get and set VERSION
173175
run: |
174-
TAG="${{ inputs.version || github.ref_name }}"
176+
TAG="${REF_NAME}"
175177
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
176178
179+
env:
180+
REF_NAME: ${{ inputs.version || github.ref_name }}
177181
- name: Build packages with nfpm
178182
env:
179183
VERSION: ${{ env.VERSION }}
180184
run: npm run package
181185

182-
- uses: softprops/action-gh-release@v1
186+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
183187
with:
184188
draft: true
185189
discussion_category_name: "📣 Announcements"
@@ -232,15 +236,17 @@ jobs:
232236
# Strip out the v (v4.9.1 -> 4.9.1).
233237
- name: Get and set VERSION
234238
run: |
235-
TAG="${{ inputs.version || github.ref_name }}"
239+
TAG="${REF_NAME}"
236240
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
237241
242+
env:
243+
REF_NAME: ${{ inputs.version || github.ref_name }}
238244
- name: Build packages with nfpm
239245
env:
240246
VERSION: ${{ env.VERSION }}
241247
run: npm run package
242248

243-
- uses: softprops/action-gh-release@v1
249+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
244250
with:
245251
draft: true
246252
discussion_category_name: "📣 Announcements"
@@ -257,7 +263,7 @@ jobs:
257263
with:
258264
name: npm-release-package
259265

260-
- uses: softprops/action-gh-release@v1
266+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
261267
with:
262268
draft: true
263269
discussion_category_name: "📣 Announcements"
@@ -269,7 +275,7 @@ jobs:
269275
timeout-minutes: 15
270276
steps:
271277
- name: Download artifacts
272-
uses: dawidd6/action-download-artifact@v16
278+
uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
273279
id: download
274280
with:
275281
branch: ${{ github.ref }}
@@ -284,9 +290,11 @@ jobs:
284290
# Strip out the v (v4.9.1 -> 4.9.1).
285291
- name: Get and set VERSION
286292
run: |
287-
TAG="${{ inputs.version || github.ref_name }}"
293+
TAG="${REF_NAME}"
288294
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
289295
296+
env:
297+
REF_NAME: ${{ inputs.version || github.ref_name }}
290298
- name: Modify version
291299
env:
292300
VERSION: ${{ env.VERSION }}

0 commit comments

Comments
 (0)