Skip to content

Commit c109146

Browse files
hilmarfhilmarf
authored
Neu (#1439)
<!-- markdownlint-disable MD041 --> #### What this PR does / why we need it #### Which issue(s) this PR fixes <!-- Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`. -->
1 parent db2b500 commit c109146

16 files changed

Lines changed: 109 additions & 100 deletions

‎.github/workflows/check_diff_action.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1919
- name: Setup Go
20-
uses: actions/setup-go@v5
20+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
2121
with:
2222
go-version-file: '${{ github.workspace }}/go.mod'
2323
cache: false
@@ -33,7 +33,8 @@ jobs:
3333
# This is because we have huge storage requirements for our cache because of the mass of dependencies
3434
- name: Restore / Reuse Cache from central build
3535
id: cache-golang-restore
36-
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
36+
# Only Restore, not build another cache (too big)
37+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
3738
with:
3839
path: |
3940
${{ env.go_cache }}

‎.github/workflows/codeql.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,14 @@ jobs:
6060
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
6161
steps:
6262
- name: Self Hosted Runner Post Job Cleanup Action
63-
uses: TooMuch4U/actions-clean@v2.2
63+
uses: TooMuch4U/actions-clean@3f61bacac66e425c632b77a19065e4ba2f43a04e # v2.1
6464

6565
- name: Checkout repository
66-
uses: actions/checkout@v4
66+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6767

6868

6969
- name: Setup Go
70-
uses: actions/setup-go@v5
70+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
7171
if: matrix.build-mode == 'manual'
7272
with:
7373
go-version-file: '${{ github.workspace }}/go.mod'
@@ -86,7 +86,8 @@ jobs:
8686
- name: Restore / Reuse Cache from central build
8787
if: matrix.build-mode == 'manual'
8888
id: cache-golang-restore
89-
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
89+
# Only Restore, not build another cache (too big)
90+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
9091
with:
9192
path: |
9293
${{ env.go_cache }}
@@ -99,7 +100,7 @@ jobs:
99100

100101
# Initializes the CodeQL tools for scanning.
101102
- name: Initialize CodeQL
102-
uses: github/codeql-action/init@v3
103+
uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
103104
with:
104105
languages: ${{ matrix.language }}
105106
build-mode: ${{ matrix.build-mode }}
@@ -116,7 +117,7 @@ jobs:
116117
run: make build -j
117118

118119
- name: Perform CodeQL Analysis
119-
uses: github/codeql-action/analyze@v3
120+
uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
120121
with:
121122
category: "/language:${{matrix.language}}"
122123

‎.github/workflows/components.yaml‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -59,20 +59,20 @@ jobs:
5959
runs-on: large_runner
6060
steps:
6161
- name: Self Hosted Runner Post Job Cleanup Action
62-
uses: TooMuch4U/actions-clean@v2.2
62+
uses: TooMuch4U/actions-clean@3f61bacac66e425c632b77a19065e4ba2f43a04e # v2.1
6363
- name: Checkout
64-
uses: actions/checkout@v4
64+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6565
with:
6666
ref: ${{ env.REF }}
6767
- name: Setup Go
68-
uses: actions/setup-go@v5
68+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
6969
with:
7070
go-version-file: '${{ github.workspace }}/go.mod'
7171
cache: false
7272
- name: Set up Docker Buildx
73-
uses: docker/setup-buildx-action@v3
73+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
7474
- name: Docker Login
75-
uses: docker/login-action@v3
75+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
7676
with:
7777
registry: ghcr.io
7878
username: ${{ github.actor }}
@@ -87,7 +87,8 @@ jobs:
8787
# This is because we have huge storage requirements for our cache because of the mass of dependencies
8888
- name: Restore / Reuse Cache from central build
8989
id: cache-golang-restore
90-
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
90+
# Only Restore, not build another cache (too big)
91+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
9192
with:
9293
path: |
9394
${{ env.go_cache }}
@@ -111,7 +112,7 @@ jobs:
111112
make \
112113
ctf descriptor describe
113114
- name: Upload CTF
114-
uses: actions/upload-artifact@v4
115+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
115116
with:
116117
if-no-files-found: error
117118
overwrite: true
@@ -127,13 +128,13 @@ jobs:
127128
components: ${{ join(fromJSON(needs.define-matrix.outputs.components), ' ') }}
128129
steps:
129130
- name: Self Hosted Runner Post Job Cleanup Action
130-
uses: TooMuch4U/actions-clean@v2.2
131+
uses: TooMuch4U/actions-clean@3f61bacac66e425c632b77a19065e4ba2f43a04e # v2.1
131132
- name: Checkout
132-
uses: actions/checkout@v4
133+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
133134
with:
134135
ref: ${{ env.REF }}
135136
- name: Download CTFs
136-
uses: actions/download-artifact@v4
137+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
137138
with:
138139
pattern: 'ctf-component-*'
139140
path: gen/downloaded-ctfs
@@ -175,15 +176,15 @@ jobs:
175176
- name: Upload aggregated CTF
176177
# only upload the artifact if we are not on a PR
177178
if: inputs.upload-ctf
178-
uses: actions/upload-artifact@v4
179+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
179180
with:
180181
if-no-files-found: error
181182
overwrite: true
182183
retention-days: 30
183184
name: ctf-aggregated
184185
path: gen/ctf
185186
- name: Delete old CTFs that lead up to aggregation
186-
uses: geekyeggo/delete-artifact@v5
187+
uses: geekyeggo/delete-artifact@7ee91e82b4a7f3339cd8b14beace3d826a2aac39 # v5.1.0
187188
with:
188189
name: |
189190
ctf-component-*

‎.github/workflows/flake_vendorhash.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,16 @@ jobs:
1717
steps:
1818
- name: Generate token
1919
id: generate_token
20-
uses: tibdex/github-app-token@v2
20+
uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0
2121
with: # OCMBot
2222
app_id: ${{ secrets.OCMBOT_APP_ID }}
2323
private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
2424
- name: Checkout repository
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2626
with:
2727
token: ${{ steps.generate_token.outputs.token }}
2828
- name: Install Nix
29-
uses: DeterminateSystems/nix-installer-action@v17
29+
uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
3030
with:
3131
nix-package-url: https://releases.nixos.org/nix/nix-2.26.2/nix-2.26.2-x86_64-linux.tar.xz
3232
- name: Update flake.lock
@@ -54,7 +54,7 @@ jobs:
5454
\`\`\`
5555
EOF
5656
- name: Create Pull Request
57-
uses: peter-evans/create-pull-request@v7
57+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
5858
with:
5959
token: ${{ steps.generate_token.outputs.token }}
6060
title: "chore: update 'flake.nix'"

‎.github/workflows/lint_and_test.yaml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ jobs:
1717
runs-on: large_runner
1818
steps:
1919
- name: Self Hosted Runner Post Job Cleanup Action
20-
uses: TooMuch4U/actions-clean@v2.2
20+
uses: TooMuch4U/actions-clean@3f61bacac66e425c632b77a19065e4ba2f43a04e # v2.1
2121
- name: Checkout
22-
uses: actions/checkout@v4
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2323
- name: Setup Go
24-
uses: actions/setup-go@v5
24+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
2525
with:
2626
go-version-file: '${{ github.workspace }}/go.mod'
2727
cache: false
@@ -38,7 +38,8 @@ jobs:
3838
# This is because it requires caching of test dependencies, which are compiled only for linux-amd64 for test runs in CI.
3939
- name: Restore / Reuse Cache from central build
4040
id: cache-golang-restore
41-
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
41+
# Only Restore, not build another cache (too big)
42+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
4243
with:
4344
path: |
4445
${{ env.go_cache }}
@@ -57,7 +58,8 @@ jobs:
5758
- name: Save Cache of Build (only on main)
5859
id: cache-golang-save
5960
if: github.ref == 'refs/heads/main' # Only run on main, never in PR
60-
uses: actions/cache/save@v4 # Only saves cache build-test (linux-amd64)
61+
# Only saves cache build-test (linux-amd64)
62+
uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
6163
with:
6264
path: |
6365
${{ env.go_cache }}
@@ -72,11 +74,11 @@ jobs:
7274
runs-on: large_runner
7375
steps:
7476
- name: Self Hosted Runner Post Job Cleanup Action
75-
uses: TooMuch4U/actions-clean@v2.2
77+
uses: TooMuch4U/actions-clean@3f61bacac66e425c632b77a19065e4ba2f43a04e # v2.1
7678
- name: Checkout
77-
uses: actions/checkout@v4
79+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7880
- name: Setup Go
79-
uses: actions/setup-go@v5
81+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
8082
with:
8183
go-version-file: '${{ github.workspace }}/go.mod'
8284
cache: false
@@ -90,7 +92,8 @@ jobs:
9092
# This is because we have huge storage requirements for our cache because of the mass of dependencies
9193
- name: Restore / Reuse Cache from central build
9294
id: cache-golang-restore
93-
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
95+
# Only Restore, not build another cache (too big)
96+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
9497
with:
9598
path: |
9699
${{ env.go_cache }}

‎.github/workflows/publish-latest.yaml‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -23,41 +23,41 @@ jobs:
2323
steps:
2424
- name: Generate token
2525
id: generate_token
26-
uses: tibdex/github-app-token@v2
26+
uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0
2727
with:
2828
app_id: ${{ secrets.OCMBOT_APP_ID }}
2929
private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
3030
- name: Checkout
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3232
with:
3333
token: ${{ steps.generate_token.outputs.token }}
3434
- name: Set up QEMU
35-
uses: docker/setup-qemu-action@v3
35+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
3636
- name: Set up Docker Buildx
37-
uses: docker/setup-buildx-action@v3
37+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
3838
- name: Docker Login
39-
uses: docker/login-action@v3
39+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
4040
with:
4141
registry: ghcr.io
4242
username: ${{ github.actor }}
4343
password: ${{ secrets.GITHUB_TOKEN }}
4444
- name: Extract metadata (tags, labels) for Docker
4545
id: meta
46-
uses: docker/metadata-action@v5
46+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
4747
with:
4848
images: |
4949
ghcr.io/${{ github.repository }}
5050
- name: Go Build Cache for Docker
51-
uses: actions/cache@v4
51+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
5252
with:
5353
path: go-build-cache
5454
key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
5555
- name: inject go-build-cache into docker
56-
uses: reproducible-containers/buildkit-cache-dance@v3
56+
uses: reproducible-containers/buildkit-cache-dance@9380a95413d28427de1842dc121f44b9e8a3f406 # v3.1.2
5757
with:
5858
cache-source: go-build-cache
5959
- name: Build and push
60-
uses: docker/build-push-action@v6
60+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
6161
with:
6262
context: .
6363
# supported platforms: https://github.com/GoogleContainerTools/distroless?tab=readme-ov-file#what-images-are-available
@@ -78,27 +78,27 @@ jobs:
7878
packages: write
7979
steps:
8080
- name: Self hosted runner post job cleanup
81-
uses: TooMuch4U/actions-clean@v2.2
81+
uses: TooMuch4U/actions-clean@3f61bacac66e425c632b77a19065e4ba2f43a04e # v2.1
8282
- name: Generate token
8383
id: generate_token
84-
uses: tibdex/github-app-token@v2
84+
uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0
8585
with:
8686
app_id: ${{ secrets.OCMBOT_APP_ID }}
8787
private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
8888
- name: Checkout
89-
uses: actions/checkout@v4
89+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9090
with:
9191
fetch-depth: 0
9292
token: ${{ steps.generate_token.outputs.token }}
9393
- name: Enable github-cli
94-
uses: actions4gh/setup-gh@v1.0.2
94+
uses: actions4gh/setup-gh@44a12005484c53be5bf51bebe8c985b4be8ba8de # v1.0.2
9595
with:
9696
token: ${{ steps.generate_token.outputs.token }}
9797
- name: Move tag to latest commit
9898
run: |
9999
gh api -X PATCH -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/open-component-model/ocm/git/refs/tags/ocm-cli/latest -f "sha=${{ github.sha }}" -F "force=true"
100100
- name: Setup go
101-
uses: actions/setup-go@v5
101+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
102102
with:
103103
go-version-file: '${{ github.workspace }}/go.mod'
104104
check-latest: false
@@ -115,7 +115,8 @@ jobs:
115115
# This is because we have huge storage requirements for our cache because of the mass of dependencies
116116
- name: Restore / Reuse Cache from central build
117117
id: cache-golang-restore
118-
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
118+
# Only Restore, not build another cache (too big)
119+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
119120
with:
120121
path: |
121122
${{ env.go_cache }}
@@ -127,7 +128,7 @@ jobs:
127128
cache_name: ocm-cli-latest-go-cache # needs to be the same key in the end as in the build step
128129

129130
- name: Goreleaser release snapshot
130-
uses: goreleaser/goreleaser-action@v6
131+
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
131132
with:
132133
distribution: goreleaser
133134
version: 2.2.0
@@ -138,7 +139,7 @@ jobs:
138139
GORELEASER_CURRENT_TAG: v0.0.0
139140
GORELEASER_PREVIOUS_TAG: v0.0.0
140141
- name: Create or update release
141-
uses: ncipollo/release-action@v1
142+
uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1.16.0
142143
with:
143144
name: latest ocm-cli
144145
tag: ocm-cli/latest
@@ -158,7 +159,8 @@ jobs:
158159
# This step is actually responsible for populating our build cache for the next runs in PRs or on main.
159160
- name: Save Cache of Build (only on main)
160161
id: cache-golang-save
161-
uses: actions/cache/save@v4 # Only save build cache once
162+
# Only save build cache once
163+
uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
162164
with:
163165
path: |
164166
${{ env.go_cache }}

0 commit comments

Comments
 (0)