From b8ab3d2c1ce9641e757e760196850ca526ecd71f Mon Sep 17 00:00:00 2001 From: cheyang Date: Wed, 18 Jun 2025 19:59:39 +0800 Subject: [PATCH 1/2] Add pinned GithubAction Signed-off-by: cheyang --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/kind-e2e.yml | 6 +++--- .github/workflows/project-check.yml | 8 ++++---- .github/workflows/sonarcloud.yaml | 4 ++-- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 9a0ac9e6125..44e57be2593 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -40,11 +40,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3.28.18 + uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -64,4 +64,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3.28.18 + uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0 diff --git a/.github/workflows/kind-e2e.yml b/.github/workflows/kind-e2e.yml index 6e43026b828..c5158d1cd1b 100644 --- a/.github/workflows/kind-e2e.yml +++ b/.github/workflows/kind-e2e.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: ${{ env.GO_VERSION }} @@ -43,12 +43,12 @@ jobs: uses: azure/setup-helm@v4.3.0 - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: ${{ env.GOPATH }}/src/github.com/fluid-cloudnative/fluid - name: Create k8s Kind Cluster - uses: helm/kind-action@v1.12.0 + uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0 with: node_image: kindest/node:${{ matrix.kubernetes-version }} cluster_name: ${{ env.KIND_CLUSTER }} diff --git a/.github/workflows/project-check.yml b/.github/workflows/project-check.yml index 7b8326dedf4..004b710a2df 100644 --- a/.github/workflows/project-check.yml +++ b/.github/workflows/project-check.yml @@ -16,7 +16,7 @@ jobs: staticcheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - uses: dominikh/staticcheck-action@v1 lint: @@ -34,12 +34,12 @@ jobs: go-version: ${{ env.GO_VERSION }} - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: ${{ env.GOPATH }}/src/github.com/fluid-cloudnative/fluid - name: Lint golang code - uses: golangci/golangci-lint-action@v6 + uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0 with: version: latest args: --timeout 10m --verbose @@ -89,7 +89,7 @@ jobs: go-version: ${{ env.GO_VERSION }} - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: ${{ env.GOPATH }}/src/github.com/fluid-cloudnative/fluid diff --git a/.github/workflows/sonarcloud.yaml b/.github/workflows/sonarcloud.yaml index bd7d53e61bd..08a2b5122bf 100644 --- a/.github/workflows/sonarcloud.yaml +++ b/.github/workflows/sonarcloud.yaml @@ -29,7 +29,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false @@ -43,7 +43,7 @@ jobs: exclude_paths: "vendor/**" - name: "Upload artifact" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: SARIF file path: results.sarif From b1f89cf2aca3f67d4cb1dc98095ea237668722c2 Mon Sep 17 00:00:00 2001 From: cheyang Date: Wed, 18 Jun 2025 20:05:45 +0800 Subject: [PATCH 2/2] Add pinned GithubAction Signed-off-by: cheyang --- .github/workflows/project-check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/project-check.yml b/.github/workflows/project-check.yml index 004b710a2df..c1af2b41cdd 100644 --- a/.github/workflows/project-check.yml +++ b/.github/workflows/project-check.yml @@ -39,7 +39,7 @@ jobs: path: ${{ env.GOPATH }}/src/github.com/fluid-cloudnative/fluid - name: Lint golang code - uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0 + uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2 with: version: latest args: --timeout 10m --verbose