Merge pull request #87 from eviltester/83-sha-actions-and-pin-packagejson-versions

pinning versions and locking down

Author: eviltester

.github/workflows/cli-deploy.yml

@@ -44,8 +44,8 @@ jobs:
             smoke_command: ./out/macos-arm64/anywaydata --help
             bun_build_flags: --compile
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.2.10
       - name: install dependencies
@@ -65,7 +65,7 @@ jobs:
         shell: bash
         run: zip -j "${{ github.workspace }}/${{ matrix.zip_name }}" "${{ github.workspace }}/${{ matrix.bin_relpath }}"
       - name: upload zip artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ matrix.zip_name }}
           path: ${{ github.workspace }}/${{ matrix.zip_name }}
@@ -78,10 +78,10 @@ jobs:
       contents: write
     steps:
       - name: download built zips
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: ${{ github.workspace }}/release-assets
-      - uses: ncipollo/release-action@v1.16.0
+      - uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1.16.0
         with:
           tag: ${{ inputs.tag }}
           commit: ${{ inputs.commit }}

.github/workflows/codex-pr-review.yml

@@ -16,37 +16,37 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
         with:
           ruby-version: '3.3'
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.3'
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: '8.0.x'
 
@@ -92,7 +92,7 @@ jobs:
         run: npm run build --if-present
 
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.2.10
 
@@ -188,13 +188,13 @@ jobs:
           echo "AnyWayData full-site docker smoke test passed"
 
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: coverage-report-node-${{ matrix.node-version }}
           path: coverage/
 
       - name: Upload HTML coverage report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: coverage-html-report-node-${{ matrix.node-version }}
           path: coverage/lcov-report/

.github/workflows/node.js.yml

@@ -23,8 +23,8 @@
     "test": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js --config ./jest.config.cjs"
   },
   "dependencies": {
-    "@anywaydata/core": "^1.2.0",
-    "express": "^4.21.2",
-    "swagger-ui-express": "^5.0.1"
+    "@anywaydata/core": "1.2.0",
+    "express": "4.21.2",
+    "swagger-ui-express": "5.0.1"
   }
 }

apps/api/package.json

@@ -21,7 +21,7 @@
     "test": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js --config ./jest.config.cjs"
   },
   "dependencies": {
-    "@anywaydata/core": "^1.2.0",
-    "yargs": "^17.7.2"
+    "@anywaydata/core": "1.2.0",
+    "yargs": "17.7.2"
   }
 }

apps/cli/package.json

@@ -23,6 +23,6 @@
     "test": "jest --config ../../package.json --testMatch \"<rootDir>/apps/mcp/src/*.test.js\""
   },
   "dependencies": {
-    "@anywaydata/core": "^1.2.0"
+    "@anywaydata/core": "1.2.0"
   }
 }