Skip to content

Commit 801f967

Browse files
chadlwilsonjeremylong
chadlwilson
and
jeremylong
authored
chore: pin GitHub actions to specific SHAs rather than mutable tags (#8381)
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com> Co-authored-by: Jeremy Long <jeremy.long@gmail.com>
1 parent 2bb98c2 commit 801f967

12 files changed

Lines changed: 96 additions & 93 deletions

‎.github/dependabot.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@ updates:
77
- package-ecosystem: "github-actions"
88
directory: "/"
99
schedule:
10-
interval: "daily"
10+
interval: "monthly"
11+
groups:
12+
actions-deps:
13+
patterns: [ "*" ]
1114
- package-ecosystem: "docker"
1215
directory: "/"
1316
schedule:

‎.github/workflows/build-pull-requests.yml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,18 @@ jobs:
2323
contents: read
2424
runs-on: ubuntu-latest
2525
steps:
26-
- uses: actions/checkout@v6
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727
- name: Check ODC Data Cache
2828
id: odc-data-cache
29-
uses: actions/cache@v5
29+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
3030
with:
3131
path: core/target/data
3232
key: odc-data
33-
- uses: actions/setup-dotnet@v5.2.0
33+
- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
3434
with:
3535
dotnet-version: '8.0.x'
3636
- name: Set up JDKs
37-
uses: actions/setup-java@v5
37+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
3838
with:
3939
java-version: | # last version takes precedence as default
4040
${{ matrix.jdk_test_version }}
@@ -56,34 +56,34 @@ jobs:
5656
${{ matrix.jdk_test_version == matrix.jdk_default_version && 'source:jar javadoc:jar site' || '' }}
5757
--no-transfer-progress --batch-mode -Dstyle.color=always
5858
- name: SARIF Multitool
59-
uses: microsoft/sarif-actions@v0.2
59+
uses: microsoft/sarif-actions@c8dd8ba66449523fe92a68cbe13aab3c271efe3c # v0.2
6060
with:
6161
# Command to be sent to SARIF Multitool
6262
command: 'validate core/target/test-reports/Report.sarif'
6363
- name: Upload SARIF file
64-
uses: github/codeql-action/upload-sarif@v4
64+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
6565
with:
6666
sarif_file: utils/target/spotbugsSarif.json
6767
category: spotbugs-utils
6868
- name: Upload SARIF file
69-
uses: github/codeql-action/upload-sarif@v4
69+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
7070
with:
7171
sarif_file: cli/target/spotbugsSarif.json
7272
category: spotbugs-cli
7373
- name: Upload SARIF file
74-
uses: github/codeql-action/upload-sarif@v4
74+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
7575
with:
7676
sarif_file: ant/target/spotbugsSarif.json
7777
category: spotbugs-ant
7878
- name: Upload SARIF file
79-
uses: github/codeql-action/upload-sarif@v4
79+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
8080
with:
8181
sarif_file: core/target/spotbugsSarif.json
8282
category: spotbugs-core
8383
- name: Archive Snapshot
8484
if: matrix.jdk_test_version == matrix.jdk_default_version
8585
id: archive-snapshot
86-
uses: actions/upload-artifact@v7
86+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
8787
with:
8888
name: archive-snapshot
8989
retention-days: 1
@@ -107,24 +107,24 @@ jobs:
107107
contents: read
108108
runs-on: ubuntu-latest
109109
steps:
110-
- uses: actions/checkout@v6
110+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
111111
- name: Maven Integration Test Cache
112112
id: maven-it-cache
113-
uses: actions/cache@v5
113+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
114114
with:
115115
path: maven/target/local-repo
116116
key: mvn-it-repo
117117
- name: Check ODC Data Cache
118118
id: odc-data-cache
119-
uses: actions/cache@v5
119+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
120120
with:
121121
path: core/target/data
122122
key: odc-data
123-
- uses: actions/setup-dotnet@v5.2.0
123+
- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
124124
with:
125125
dotnet-version: '8.0.x'
126126
- name: Set up JDKs
127-
uses: actions/setup-java@v5
127+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
128128
with:
129129
java-version: | # last version takes precedence as default
130130
${{ matrix.jdk_test_version }}
@@ -149,13 +149,13 @@ jobs:
149149
- name: Archive IT test logs
150150
id: archive-logs
151151
if: always()
152-
uses: actions/upload-artifact@v7
152+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
153153
with:
154154
name: it-test-logs-jdk-${{ matrix.jdk_test_version }}
155155
retention-days: 7
156156
path: maven/target/it/**/build.log
157157
- name: Upload SARIF file
158-
uses: github/codeql-action/upload-sarif@v4
158+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
159159
with:
160160
sarif_file: maven/target/spotbugsSarif.json
161161
category: spotbugs-maven
@@ -167,9 +167,9 @@ jobs:
167167
contents: read
168168
runs-on: ubuntu-latest
169169
steps:
170-
- uses: actions/checkout@v6
170+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
171171
- name: Set up JDK
172-
uses: actions/setup-java@v5
172+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
173173
with:
174174
java-version: '25'
175175
distribution: 'zulu'
@@ -181,7 +181,7 @@ jobs:
181181
run: |
182182
mvn -V -s settings.xml checkstyle:checkstyle-aggregate --no-transfer-progress --batch-mode -Dstyle.color=always
183183
- name: Upload SARIF file
184-
uses: github/codeql-action/upload-sarif@v4
184+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
185185
with:
186186
sarif_file: target/checkstyle-result.sarif
187187
category: checkstyle
@@ -195,23 +195,23 @@ jobs:
195195
needs: build
196196
steps:
197197
- name: Checkout code
198-
uses: actions/checkout@v6
198+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
199199
- name: Set up JDK
200-
uses: actions/setup-java@v5
200+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
201201
with:
202202
java-version: '25'
203203
distribution: 'zulu'
204204
check-latest: true
205205
cache: 'maven'
206206
cache-dependency-path: '**/pom.xml'
207207
- name: Download release build
208-
uses: actions/download-artifact@v8
208+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
209209
with:
210210
name: archive-snapshot
211211
- name: Set up Docker
212-
uses: docker/setup-docker-action@v5
212+
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5.0.0
213213
- name: Set up Docker Buildx
214-
uses: docker/setup-buildx-action@v4
214+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
215215
- name: Build Docker Image
216216
run: ./docker-build.sh
217217
- name: build scan target

‎.github/workflows/build-release.yml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -27,24 +27,24 @@ jobs:
2727
run: |
2828
cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --batch --import
2929
gpg --list-secret-keys --keyid-format LONG
30-
- uses: actions/checkout@v6
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131
- name: Maven Integration Test Cache
3232
id: maven-it-cache
33-
uses: actions/cache@v5
33+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
3434
with:
3535
path: maven/target/local-repo
3636
key: mvn-it-repo
3737
- name: Check ODC Data Cache
3838
id: odc-data-cache
39-
uses: actions/cache@v5
39+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
4040
with:
4141
path: core/target/data
4242
key: odc-data
43-
- uses: actions/setup-dotnet@v5.2.0
43+
- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
4444
with:
4545
dotnet-version: '8.0.x'
4646
- name: Set up JDK
47-
uses: actions/setup-java@v5
47+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4848
with:
4949
java-version: '25'
5050
distribution: 'zulu'
@@ -82,7 +82,7 @@ jobs:
8282
--no-transfer-progress --batch-mode -Dstyle.color=always
8383
- name: Archive code coverage results
8484
id: archive-coverage
85-
uses: actions/upload-artifact@v7
85+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
8686
with:
8787
name: code-coverage-report
8888
retention-days: 7
@@ -91,7 +91,7 @@ jobs:
9191
**/target/jacoco-results/**/*.html
9292
- name: Archive Release
9393
id: archive-release
94-
uses: actions/upload-artifact@v7
94+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
9595
with:
9696
name: archive-release
9797
retention-days: 7
@@ -104,7 +104,7 @@ jobs:
104104
target/*.buildinfo
105105
- name: Archive Site
106106
id: archive-site
107-
uses: actions/upload-artifact@v7
107+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
108108
with:
109109
name: archive-site
110110
retention-days: 7
@@ -120,28 +120,28 @@ jobs:
120120
steps:
121121
- name: Check Docker ODC Cache
122122
id: docker-odc-cache
123-
uses: actions/cache@v5
123+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
124124
with:
125125
path: ~/OWASP-Dependency-Check
126126
key: docker-repo
127127
- name: Checkout code
128-
uses: actions/checkout@v6
128+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
129129
- name: Set up JDK
130-
uses: actions/setup-java@v5
130+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
131131
with:
132132
java-version: '25'
133133
distribution: 'zulu'
134134
check-latest: true
135135
cache: 'maven'
136136
cache-dependency-path: '**/pom.xml'
137137
- name: Download release build
138-
uses: actions/download-artifact@v8
138+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
139139
with:
140140
name: archive-release
141141
- name: Set up Docker
142-
uses: docker/setup-docker-action@v5
142+
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5.0.0
143143
- name: Set up Docker Buildx
144-
uses: docker/setup-buildx-action@v4
144+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
145145
- name: Build Docker Image
146146
run: ./docker-build.sh
147147
- name: build scan target
@@ -162,19 +162,19 @@ jobs:
162162
needs: build
163163
steps:
164164
- name: Checkout code
165-
uses: actions/checkout@v6
165+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
166166
- name: Get version
167167
id: get-version
168168
run: |
169169
VERSION=$( mvn help:evaluate -Dexpression=project.version -q -DforceStdout )
170170
echo "VERSION=$VERSION" >> $GITHUB_ENV
171171
- name: Download release build
172-
uses: actions/download-artifact@v8
172+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
173173
with:
174174
name: archive-release
175175
- name: Create Release
176176
id: create_release
177-
uses: actions/create-release@v1.1.4
177+
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 Deprecated/EOL - needs replacement
178178
env:
179179
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
180180
with:
@@ -187,7 +187,7 @@ jobs:
187187
188188
- name: Upload CLI
189189
id: upload-release-cli
190-
uses: actions/upload-release-asset@v1.0.2
190+
uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 Deprecated/EOL - needs replacement
191191
env:
192192
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
193193
with:
@@ -197,7 +197,7 @@ jobs:
197197
asset_content_type: application/zip
198198
- name: Upload CLI signature
199199
id: upload-release-cli-sig
200-
uses: actions/upload-release-asset@v1.0.2
200+
uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 Deprecated/EOL - needs replacement
201201
env:
202202
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
203203
with:
@@ -207,7 +207,7 @@ jobs:
207207
asset_content_type: text/plain
208208
- name: Upload ANT
209209
id: upload-release-ant
210-
uses: actions/upload-release-asset@v1.0.2
210+
uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 Deprecated/EOL - needs replacement
211211
env:
212212
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
213213
with:
@@ -217,7 +217,7 @@ jobs:
217217
asset_content_type: application/zip
218218
- name: Upload ANT signature
219219
id: upload-release-ant-sig
220-
uses: actions/upload-release-asset@v1.0.2
220+
uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 Deprecated/EOL - needs replacement
221221
env:
222222
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
223223
with:
@@ -227,7 +227,7 @@ jobs:
227227
asset_content_type: text/plain
228228
- name: Upload buildinfo
229229
id: upload-release-buildinfo
230-
uses: actions/upload-release-asset@v1.0.2
230+
uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 Deprecated/EOL - needs replacement
231231
env:
232232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
233233
with:
@@ -242,17 +242,17 @@ jobs:
242242
needs: build
243243
steps:
244244
- name: Checkout code
245-
uses: actions/checkout@v6
245+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
246246
- name: Download Site
247-
uses: actions/download-artifact@v8
247+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
248248
with:
249249
name: archive-site
250250
path: target/staging
251251
- name: Display structure of downloaded files
252252
run: ls -R
253253
working-directory: target
254254
- name: Deploy gh-pages
255-
uses: JamesIves/github-pages-deploy-action@v4.8.0
255+
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
256256
with:
257257
branch: gh-pages
258258
folder: target/staging

0 commit comments

Comments
 (0)