Skip to content

Commit 3cdcbff

Browse files
andrrossandrross
committed
Pin GHAs to SHAs instead of using tags
Signed-off-by: Andrew Ross <andrross@amazon.com>
1 parent ae52ab4 commit 3cdcbff

12 files changed

Lines changed: 46 additions & 104 deletions

‎.github/workflows/assemble.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ jobs:
1010
java: [ 11 ]
1111
os: [ubuntu-latest, windows-latest, macos-13]
1212
steps:
13-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1414
- name: Set up JDK ${{ matrix.java }}
15-
uses: actions/setup-java@v4
15+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
1616
with:
1717
java-version: ${{ matrix.java }}
1818
distribution: temurin

‎.github/workflows/auto-release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,16 @@ jobs:
1414
steps:
1515
- name: GitHub App token
1616
id: github_app_token
17-
uses: tibdex/github-app-token@v1.5.0
17+
uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0
1818
with:
1919
app_id: ${{ secrets.APP_ID }}
2020
private_key: ${{ secrets.APP_PRIVATE_KEY }}
2121
installation_id: 22958780
2222
- name: Get tag
2323
id: tag
24-
uses: dawidd6/action-get-tag@v1
25-
- uses: actions/checkout@v2
26-
- uses: ncipollo/release-action@v1
24+
uses: dawidd6/action-get-tag@727a6f0a561be04e09013531e73a3983a65e3479 # v1
25+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
26+
- uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
2727
with:
2828
github_token: ${{ steps.github_app_token.outputs.token }}
2929
bodyFile: release-notes/opensearch.release-notes-${{steps.tag.outputs.tag}}.md

‎.github/workflows/backport.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ jobs:
2626
steps:
2727
- name: GitHub App token
2828
id: github_app_token
29-
uses: tibdex/github-app-token@v2.1.0
29+
uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0
3030
with:
3131
app_id: ${{ secrets.APP_ID }}
3232
private_key: ${{ secrets.APP_PRIVATE_KEY }}
3333
installation_id: 22958780
3434

3535
- name: Backport
36-
uses: VachaShah/backport@v2.2.0
36+
uses: VachaShah/backport@3dc1c79b5fa9d9dcd542cee70bd5d10c6e5dbbf6 # v2.1.0
3737
with:
3838
github_token: ${{ steps.github_app_token.outputs.token }}
3939
head_template: backport/backport-<%= number %>-to-<%= base %>

‎.github/workflows/copy-linked-issue-labels.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
pull-requests: write
1414
steps:
1515
- name: copy-issue-labels
16-
uses: michalvankodev/copy-issue-labels@v1.3.0
16+
uses: michalvankodev/copy-issue-labels@c4df96ee53d2cdf639ba169a26c43b04d5085cb3 # v2.0.0
1717
with:
1818
repo-token: ${{ secrets.GITHUB_TOKEN }}
1919
labels-to-exclude: |

‎.github/workflows/delete_backport_branch.yml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,20 @@
11
name: Delete merged branch of the backport PRs
2-
on:
2+
on:
33
pull_request:
44
types:
55
- closed
6-
6+
77
jobs:
88
delete-branch:
99
runs-on: ubuntu-latest
10-
if: startsWith(github.event.pull_request.head.ref,'backport/')
10+
if: github.repository == 'opensearch-project/OpenSearch' && startsWith(github.event.pull_request.head.ref,'backport/')
1111
steps:
12-
- name: Delete merged branch
13-
uses: SvanBoxel/delete-merged-branch@main
14-
env:
15-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12+
- name: Delete merged branch
13+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
14+
with:
15+
script: |
16+
github.rest.git.deleteRef({
17+
owner: context.repo.owner,
18+
repo: context.repo.repo,
19+
ref: `heads/${context.payload.pull_request.head.ref}`,
20+
})

‎.github/workflows/dependabot_pr.yml‎

Lines changed: 0 additions & 63 deletions
This file was deleted.

‎.github/workflows/gradle-check.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ jobs:
1717
outputs:
1818
RUN_GRADLE_CHECK: ${{ steps.changed-files-specific.outputs.any_changed }}
1919
steps:
20-
- uses: actions/checkout@v3
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2121
- name: Get changed files
2222
id: changed-files-specific
23-
uses: tj-actions/changed-files@v44
23+
uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
2424
with:
2525
files_ignore: |
2626
release-notes/*.md
@@ -38,7 +38,7 @@ jobs:
3838
timeout-minutes: 130
3939
steps:
4040
- name: Checkout OpenSearch repo
41-
uses: actions/checkout@v4
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4242
with:
4343
ref: ${{ github.event.pull_request.head.sha }}
4444

@@ -57,7 +57,7 @@ jobs:
5757
echo "post_merge_action=false" >> $GITHUB_ENV
5858
5959
# to get the PR data that can be used for post merge actions
60-
- uses: actions/github-script@v7
60+
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
6161
if: github.event_name == 'push'
6262
id: get_pr_data
6363
with:
@@ -89,7 +89,7 @@ jobs:
8989
echo "post_merge_action=true" >> $GITHUB_ENV
9090
9191
- name: Checkout opensearch-build repo
92-
uses: actions/checkout@v4
92+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9393
with:
9494
repository: opensearch-project/opensearch-build
9595
ref: main
@@ -111,13 +111,13 @@ jobs:
111111
112112
- name: Upload Coverage Report
113113
if: success()
114-
uses: codecov/codecov-action@v4
114+
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
115115
with:
116116
files: ./codeCoverage.xml
117117

118118
- name: Create Comment Success
119119
if: ${{ github.event_name == 'pull_request_target' && success() && env.result == 'SUCCESS' }}
120-
uses: peter-evans/create-or-update-comment@v4
120+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
121121
with:
122122
issue-number: ${{ env.pr_number }}
123123
body: |
@@ -140,7 +140,7 @@ jobs:
140140
141141
- name: Create Comment Flaky
142142
if: ${{ github.event_name == 'pull_request_target' && success() && env.result != 'SUCCESS' }}
143-
uses: peter-evans/create-or-update-comment@v4
143+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
144144
with:
145145
issue-number: ${{ env.pr_number }}
146146
body: |
@@ -150,7 +150,7 @@ jobs:
150150
151151
- name: Create Comment Failure
152152
if: ${{ github.event_name == 'pull_request_target' && failure() }}
153-
uses: peter-evans/create-or-update-comment@v4
153+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
154154
with:
155155
issue-number: ${{ env.pr_number }}
156156
body: |

‎.github/workflows/maintainer-approval.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- id: find-maintainers
12-
uses: actions/github-script@v7.0.1
12+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
1313
with:
1414
github-token: ${{ secrets.GITHUB_TOKEN }}
1515
result-encoding: string

‎.github/workflows/precommit.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ jobs:
1010
java: [ 11 ]
1111
os: [ubuntu-latest, windows-latest, macos-13]
1212
steps:
13-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1414
- name: Set up JDK ${{ matrix.java }}
15-
uses: actions/setup-java@v4
15+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
1616
with:
1717
java-version: ${{ matrix.java }}
1818
distribution: temurin

‎.github/workflows/publish-maven-snapshots.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@ jobs:
1717
contents: write
1818

1919
steps:
20-
- uses: actions/checkout@v3
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2121
- name: Set up JDK 11
22-
uses: actions/setup-java@v3
22+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
2323
with:
2424
distribution: adopt
2525
java-version: 11
2626

2727
- name: Configure AWS credentials
28-
uses: aws-actions/configure-aws-credentials@v1
28+
uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
2929
with:
3030
role-to-assume: ${{ secrets.PUBLISH_SNAPSHOTS_ROLE }}
3131
aws-region: us-east-1

0 commit comments

Comments
 (0)