Skip to content

Commit db4537b

Browse files
mikehardymikehardy
committed
test(deps): update all workflow actions, pin to SHA w/descriptive comments
- removes deprecation warnings about node20 still being in use (updates) - incremental step to better software supply chain security (pinned SHAs)
1 parent 1b65ab7 commit db4537b

13 files changed

Lines changed: 258 additions & 129 deletions

‎.github/workflows/create_test_patches.yml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,19 @@ jobs:
2828
name: Create patch-package Patches
2929
runs-on: ubuntu-latest
3030
steps:
31-
- uses: actions/checkout@v4
31+
# https://github.com/actions/checkout/releases
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3233

3334
# Future ideas:
3435
# - make into an action, parameterize directories to pack, and package names to install
3536
# - name patches w/PR as "semver prerelease" and SHA as "semver build info". Needs patch-package enhancement.
36-
- uses: actions/setup-node@v4
37+
# https://github.com/actions/setup-node/releases
38+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3739
with:
3840
node-version: 22
3941

40-
- uses: actions/cache/restore@v4
42+
# https://github.com/actions/cache/releases
43+
- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
4144
name: Yarn Cache Restore
4245
id: yarn-cache
4346
continue-on-error: true
@@ -47,7 +50,8 @@ jobs:
4750
restore-keys: ${{ runner.os }}-yarn-v1
4851

4952
- name: Yarn Install
50-
uses: nick-fields/retry@v3
53+
# https://github.com/nick-fields/retry/releases
54+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
5155
with:
5256
timeout_minutes: 15
5357
retry_wait_seconds: 60
@@ -86,12 +90,14 @@ jobs:
8690
shell: bash
8791

8892
- name: Upload Test Patches
89-
uses: actions/upload-artifact@v4
93+
# https://github.com/actions/upload-artifact/releases
94+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
9095
with:
9196
name: patches
9297
path: ~/template/patches/
9398

94-
- uses: actions/cache/save@v4
99+
# https://github.com/actions/cache/releases
100+
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
95101
name: Yarn Cache Save
96102
if: "${{ github.ref == 'refs/heads/main' }}"
97103
continue-on-error: true

‎.github/workflows/deploy-api-reference.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,12 @@ jobs:
1717
name: 'Build API Reference'
1818
runs-on: ubuntu-latest
1919
steps:
20-
- uses: actions/checkout@v6
20+
# https://github.com/actions/checkout/releases
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2122
with:
2223
fetch-depth: 0
23-
- uses: actions/setup-node@v6
24+
# https://github.com/actions/setup-node/releases
25+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2426
with:
2527
node-version: lts/*
2628
registry-url: 'https://registry.npmjs.org'
@@ -30,7 +32,8 @@ jobs:
3032
npm install -g npm@latest
3133
npm --version
3234
- name: Yarn Install
33-
uses: nick-fields/retry@v4
35+
# https://github.com/nick-fields/retry/releases
36+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
3437
with:
3538
timeout_minutes: 15
3639
retry_wait_seconds: 60
@@ -40,7 +43,8 @@ jobs:
4043
run: yarn reference:api:gh-pages
4144
- name: Upload API reference artifact
4245
id: deployment
43-
uses: actions/upload-pages-artifact@v3
46+
# https://github.com/actions/upload-pages-artifact/releases
47+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
4448
with:
4549
path: ./apidocs-out
4650

@@ -54,4 +58,5 @@ jobs:
5458
steps:
5559
- name: Deploy to GitHub Pages
5660
id: deployment
57-
uses: actions/deploy-pages@v4
61+
# https://github.com/actions/deploy-pages/releases
62+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

‎.github/workflows/docs.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,16 @@ jobs:
1818
name: 'Spelling & Grammar'
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v4
21+
# https://github.com/actions/checkout/releases
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2223
with:
2324
fetch-depth: 1
24-
- uses: actions/setup-node@v4
25+
# https://github.com/actions/setup-node/releases
26+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2527
with:
2628
node-version: 22
27-
- uses: actions/cache/restore@v4
29+
# https://github.com/actions/cache/releases
30+
- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
2831
name: Yarn Cache Restore
2932
id: yarn-cache
3033
continue-on-error: true
@@ -33,7 +36,8 @@ jobs:
3336
key: ${{ runner.os }}-yarn-v1-${{ hashFiles('yarn.lock') }}
3437
restore-keys: ${{ runner.os }}-yarn-v1
3538
- name: Yarn Install
36-
uses: nick-fields/retry@v3
39+
# https://github.com/nick-fields/retry/releases
40+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
3741
with:
3842
timeout_minutes: 15
3943
retry_wait_seconds: 30
@@ -44,7 +48,8 @@ jobs:
4448
- name: Spell check
4549
run: |
4650
yarn lint:spellcheck
47-
- uses: actions/cache/save@v4
51+
# https://github.com/actions/cache/releases
52+
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
4853
name: Yarn Cache Save
4954
if: "${{ github.ref == 'refs/heads/main' }}"
5055
continue-on-error: true

‎.github/workflows/issue-labels.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,23 +22,26 @@ jobs:
2222
2323
- name: Add 'Needs Attention' label if OP responded and it was open
2424
if: env.op_comment == 'true' && github.event.issue.state == 'open'
25-
uses: actions-ecosystem/action-add-labels@v1
25+
# https://github.com/actions-ecosystem/action-add-labels/releases
26+
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1
2627
with:
2728
labels: 'Needs Attention'
2829
env:
2930
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
3031

3132
- name: Remove 'blocked customer-response' label if OP responded and it was open
3233
if: env.op_comment == 'true' && github.event.issue.state == 'open'
33-
uses: actions-ecosystem/action-remove-labels@v1
34+
# https://github.com/actions-ecosystem/action-remove-labels/releases
35+
uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1
3436
with:
3537
labels: 'blocked: customer-response'
3638
env:
3739
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
3840

3941
- name: Add comment if OP responded but issue was closed
4042
if: env.op_comment == 'true' && github.event.issue.state == 'closed'
41-
uses: actions-ecosystem/action-create-comment@v1
43+
# https://github.com/actions-ecosystem/action-create-comment/releases
44+
uses: actions-ecosystem/action-create-comment@e23bc59fbff7aac7f9044bd66c2dc0fe1286f80b # v1
4245
with:
4346
github_token: ${{ secrets.GH_TOKEN }}
4447
body: |

‎.github/workflows/linting.yml‎

Lines changed: 44 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -19,18 +19,22 @@ jobs:
1919
timeout-minutes: 30
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v4
22+
# https://github.com/actions/checkout/releases
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2324
with:
2425
fetch-depth: 1
25-
- uses: actions/setup-node@v4
26+
# https://github.com/actions/setup-node/releases
27+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2628
with:
2729
node-version: 22
2830
- name: Configure JDK
29-
uses: actions/setup-java@v4
31+
# https://github.com/actions/setup-java/releases
32+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
3033
with:
3134
distribution: 'temurin'
3235
java-version: '21'
33-
- uses: actions/cache/restore@v4
36+
# https://github.com/actions/cache/releases
37+
- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
3438
name: Yarn Cache Restore
3539
id: yarn-cache
3640
continue-on-error: true
@@ -39,20 +43,23 @@ jobs:
3943
key: ${{ runner.os }}-yarn-v1-${{ hashFiles('yarn.lock') }}
4044
restore-keys: ${{ runner.os }}-yarn-v1
4145
- name: Yarn Install
42-
uses: nick-fields/retry@v3
46+
# https://github.com/nick-fields/retry/releases
47+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
4348
with:
4449
timeout_minutes: 15
4550
retry_wait_seconds: 30
4651
max_attempts: 3
4752
command: yarn
4853
- name: Lint
49-
uses: nick-fields/retry@v3
54+
# https://github.com/nick-fields/retry/releases
55+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
5056
with:
5157
timeout_minutes: 3
5258
retry_wait_seconds: 10
5359
max_attempts: 3
5460
command: yarn lint
55-
- uses: actions/cache/save@v4
61+
# https://github.com/actions/cache/releases
62+
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
5663
name: Yarn Cache Save
5764
if: "${{ github.ref == 'refs/heads/main' }}"
5865
continue-on-error: true
@@ -66,13 +73,16 @@ jobs:
6673
runs-on: ubuntu-latest
6774
timeout-minutes: 30
6875
steps:
69-
- uses: actions/checkout@v4
76+
# https://github.com/actions/checkout/releases
77+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7078
with:
7179
fetch-depth: 1
72-
- uses: actions/setup-node@v4
80+
# https://github.com/actions/setup-node/releases
81+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
7382
with:
7483
node-version: 22
75-
- uses: actions/cache/restore@v4
84+
# https://github.com/actions/cache/releases
85+
- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
7686
name: Yarn Cache Restore
7787
id: yarn-cache
7888
continue-on-error: true
@@ -81,15 +91,17 @@ jobs:
8191
key: ${{ runner.os }}-yarn-v1-${{ hashFiles('yarn.lock') }}
8292
restore-keys: ${{ runner.os }}-yarn-v1
8393
- name: Yarn Install
84-
uses: nick-fields/retry@v3
94+
# https://github.com/nick-fields/retry/releases
95+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
8596
with:
8697
timeout_minutes: 15
8798
retry_wait_seconds: 30
8899
max_attempts: 3
89100
command: yarn
90101
- name: Lint
91102
run: yarn tsc:compile
92-
- uses: actions/cache/save@v4
103+
# https://github.com/actions/cache/releases
104+
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
93105
name: Yarn Cache Save
94106
if: "${{ github.ref == 'refs/heads/main' }}"
95107
continue-on-error: true
@@ -103,13 +115,16 @@ jobs:
103115
runs-on: ubuntu-latest
104116
timeout-minutes: 30
105117
steps:
106-
- uses: actions/checkout@v4
118+
# https://github.com/actions/checkout/releases
119+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
107120
with:
108121
fetch-depth: 1
109-
- uses: actions/setup-node@v4
122+
# https://github.com/actions/setup-node/releases
123+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
110124
with:
111125
node-version: 22
112-
- uses: actions/cache/restore@v4
126+
# https://github.com/actions/cache/releases
127+
- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
113128
name: Yarn Cache Restore
114129
id: yarn-cache
115130
continue-on-error: true
@@ -118,15 +133,17 @@ jobs:
118133
key: ${{ runner.os }}-yarn-v1-${{ hashFiles('yarn.lock') }}
119134
restore-keys: ${{ runner.os }}-yarn-v1
120135
- name: Yarn Install
121-
uses: nick-fields/retry@v3
136+
# https://github.com/nick-fields/retry/releases
137+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
122138
with:
123139
timeout_minutes: 15
124140
retry_wait_seconds: 30
125141
max_attempts: 3
126142
command: yarn
127143
- name: Consumer Type Test
128144
run: yarn tsc:compile:consumer
129-
- uses: actions/cache/save@v4
145+
# https://github.com/actions/cache/releases
146+
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
130147
name: Yarn Cache Save
131148
if: "${{ github.ref == 'refs/heads/main' }}"
132149
continue-on-error: true
@@ -140,13 +157,16 @@ jobs:
140157
runs-on: ubuntu-latest
141158
timeout-minutes: 30
142159
steps:
143-
- uses: actions/checkout@v4
160+
# https://github.com/actions/checkout/releases
161+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
144162
with:
145163
fetch-depth: 1
146-
- uses: actions/setup-node@v4
164+
# https://github.com/actions/setup-node/releases
165+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
147166
with:
148167
node-version: 22
149-
- uses: actions/cache/restore@v4
168+
# https://github.com/actions/cache/releases
169+
- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
150170
name: Yarn Cache Restore
151171
id: yarn-cache
152172
continue-on-error: true
@@ -155,15 +175,17 @@ jobs:
155175
key: ${{ runner.os }}-yarn-with-website-v1-${{ hashFiles('yarn.lock') }}
156176
restore-keys: ${{ runner.os }}-yarn-with-website-v1
157177
- name: Yarn Install
158-
uses: nick-fields/retry@v3
178+
# https://github.com/nick-fields/retry/releases
179+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
159180
with:
160181
timeout_minutes: 15
161182
retry_wait_seconds: 30
162183
max_attempts: 3
163184
command: yarn
164185
- name: Generate TypeDoc
165186
run: yarn reference:api
166-
- uses: actions/cache/save@v4
187+
# https://github.com/actions/cache/releases
188+
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
167189
name: Yarn Cache Save
168190
if: "${{ github.ref == 'refs/heads/main' }}"
169191
continue-on-error: true

‎.github/workflows/pr_title.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,12 @@ jobs:
1717
env:
1818
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
1919
steps:
20-
- uses: actions/setup-node@v4
20+
# https://github.com/actions/setup-node/releases
21+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2122
with:
2223
node-version: 22
23-
- uses: amannn/action-semantic-pull-request@v5
24+
# https://github.com/amannn/action-semantic-pull-request/releases
25+
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
2426
with:
2527
validateSingleCommit: true
2628
validateSingleCommitMatchesPrTitle: true

‎.github/workflows/publish.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,14 @@ jobs:
1313
id-token: write # enables OIDC for npmjs.com "Trusted Publisher" and provenance
1414
contents: read
1515
steps:
16-
- uses: actions/checkout@v6
16+
# https://github.com/actions/checkout/releases
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1718
with:
1819
fetch-depth: 0
1920
# Repository admin required to evade PR+checks branch protection
2021
token: ${{ secrets.GH_TOKEN }}
21-
- uses: actions/setup-node@v6
22+
# https://github.com/actions/setup-node/releases
23+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2224
with:
2325
node-version: lts/*
2426
registry-url: 'https://registry.npmjs.org'
@@ -29,7 +31,8 @@ jobs:
2931
npm install -g npm@latest
3032
npm --version
3133
- name: Yarn Install
32-
uses: nick-fields/retry@v3
34+
# https://github.com/nick-fields/retry/releases
35+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
3336
with:
3437
timeout_minutes: 15
3538
retry_wait_seconds: 60

0 commit comments

Comments
 (0)