Merge pull request #184 from openstack-k8s-operators/renovate/github-actions-dependencies

Pin dependencies

Author: openshift-merge-bot[bot]

.github/workflows/build-custom-tobiko-image.yml

@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: 1. Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: 2. Prepare Config Files
         run: |
@@ -99,7 +99,7 @@ jobs:
           sudo chown $(whoami):$(whoami) ${{ env.CUSTOM_IMAGE_FILE }}
 
       - name: 7. Create GitHub Release and Upload Artifact
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           # This is the tag you provided as input
           tag_name: ${{ inputs.release_tag }}

.github/workflows/build-custom-wntp-image.yml

@@ -62,7 +62,7 @@ jobs:
           sudo chown $(whoami):$(whoami) ${{ env.CUSTOM_IMAGE_FILE }}
 
       - name: 4. Create GitHub Release and Upload Artifact
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           # This is the tag you provided as input
           tag_name: ${{ inputs.release_tag }}

.github/workflows/build-nat64-appliance.yml

@@ -49,7 +49,7 @@ jobs:
           echo "System dependencies installed"
 
       - name: 2. Clone ci-framework Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: ${{ inputs.ci_framework_repo || 'openstack-k8s-operators/ci-framework' }}
           ref: ${{ inputs.ci_framework_ref || 'main' }}
@@ -148,7 +148,7 @@ jobs:
           ls -lh ${{ github.workspace }}/${TAGGED_IMAGE}
 
       - name: 8. Create Versioned GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ steps.release_tag.outputs.release_tag }}
           name: "NAT64 Appliance ${{ steps.release_tag.outputs.release_tag }}"
@@ -170,7 +170,7 @@ jobs:
           files: ${{ steps.release_tag.outputs.tagged_image }}
 
       - name: 9. Update 'latest' Release Tag
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: latest
           name: "NAT64 Appliance (Latest)"

.github/workflows/create-release-branch-v1.yml

@@ -68,7 +68,7 @@ jobs:
       GIT_TIMEOUT: '300'
     steps:
       - name: Generate a token from the GitHub App
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         id: app-token
         with:
           app-id: ${{ secrets.APP_ID }}
@@ -129,7 +129,7 @@ jobs:
           echo "✅ Inputs and permissions validated successfully."
 
       - name: Checkout code (for the workflow itself)
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           token: ${{ steps.app-token.outputs.token }}
 

.github/workflows/force-bump-pull-request.yaml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         ref: ${{ inputs.branch_name }}
 
@@ -90,7 +90,7 @@ jobs:
 
     - name: Create Pull Request
       if: steps.git_diff.outputs.changes == 'true'
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
       with:
         token: ${{ steps.token.outputs.token }}
         title: "openstack-k8s-operators dependency bump branch: ${{ inputs.branch_name }}"

.github/workflows/golangci-lint.yaml

@@ -8,15 +8,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
         with:
           go-version: 1.21.x
       - name: Checkout project code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           repository: openstack-k8s-operators/osp-director-operator
       - name: Checkout openstack-k8s-operators-ci project
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           path: ./openstack-k8s-operators-ci
       - name: Run govet.sh
@@ -32,16 +32,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
         with:
           go-version: 1.16.0 # don't bump this until we drop OSPdO v1.2.x
       - name: Checkout project code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           repository: openstack-k8s-operators/osp-director-operator
           ref: v1.2.x
       - name: Checkout openstack-k8s-operators-ci project
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           path: ./openstack-k8s-operators-ci
       - name: Run govet.sh

.github/workflows/label-pr.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add ${{ inputs.label_name }} label on the PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             await github.rest.issues.addLabels({

.github/workflows/rabbitmq-cluster-operator-index-feature-tag.yaml

@@ -107,7 +107,7 @@ jobs:
           echo "FORCE_OVERWRITE=${{ github.event.inputs.force_overwrite || inputs.force_overwrite || 'false' }}" >> $GITHUB_ENV
 
       - name: Log in to Quay.io
-        uses: redhat-actions/podman-login@v1
+        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
         with:
           registry: ${{ env.imageregistry }}
           username: ${{ secrets.QUAY_USERNAME }}

.github/workflows/reusable-build-operator.yaml

@@ -65,7 +65,7 @@ jobs:
     if: needs.check-secrets.outputs.missing-secrets != 'true'
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Set latest tag for non main branch
       if: github.ref_name != 'main'
@@ -77,15 +77,15 @@ jobs:
 
     - name: Buildah Action
       id: build-operator
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
       with:
         image: ${{ inputs.operator_name }}-operator
         tags: ${{ env.latesttag }} ${{ github.sha }}
         containerfiles: |
           ./Dockerfile
 
     - name: Push ${{ inputs.operator_name }}-operator To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-operator.outputs.image }}
         tags: ${{ steps.build-operator.outputs.tags }}
@@ -106,7 +106,7 @@ jobs:
         GITHUB_SHA: ${{ github.sha }}
 
     - name: Push tag with digest ${{ env.OPERATOR_IMAGE_DIGEST }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-operator.outputs.image }}
         tags: ${{ env.OPERATOR_IMAGE_DIGEST }}
@@ -121,29 +121,29 @@ jobs:
 
     steps:
     - name: Install Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
       with:
         go-version: ${{ inputs.go_version }}
         cache: false
 
     - name: Checkout ${{ inputs.operator_name }}-operator repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Install operator-sdk
-      uses: redhat-actions/openshift-tools-installer@v1
+      uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1
       with:
         source: github
         operator-sdk: ${{ inputs.operator_sdk_version }}
 
     - name: Log in to Quay Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: ${{ env.imageregistry }}
         username: ${{ secrets.QUAY_USERNAME }}
         password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Log in to Red Hat Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: registry.redhat.io
         username: ${{ secrets.REDHATIO_USERNAME }}
@@ -169,14 +169,14 @@ jobs:
 
     - name: Build operator-bundle using buildah
       id: build-operator-bundle
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
       with:
         image: ${{ inputs.operator_name }}-operator-bundle
         tags: ${{ env.latesttag }} ${{ github.sha }}
         containerfiles: ${{ inputs.bundle_dockerfile }}
 
     - name: Push ${{ inputs.operator_name }}-operator To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-operator-bundle.outputs.image }}
         tags: ${{ steps.build-operator-bundle.outputs.tags }}
@@ -197,7 +197,7 @@ jobs:
         GITHUB_SHA: ${{ github.sha }}
 
     - name: Push tag with digest ${{ env.OPERATOR_BUNDLE_IMAGE_DIGEST }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-operator-bundle.outputs.image }}
         tags: ${{ env.OPERATOR_BUNDLE_IMAGE_DIGEST }}
@@ -212,13 +212,13 @@ jobs:
 
     steps:
     - name: Install Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
       with:
         go-version: ${{ inputs.go_version }}
         cache: false
 
     - name: Checkout ${{ inputs.operator_name }}-operator repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Set latest tag for non main branch
       if: github.ref_name != 'main'
@@ -229,20 +229,20 @@ jobs:
         echo "latesttag=${latesttag@L}" >> $GITHUB_ENV
 
     - name: Install opm
-      uses: redhat-actions/openshift-tools-installer@v1
+      uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1
       with:
         source: github
         opm: 'latest'
 
     - name: Log in to Quay Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: ${{ env.imageregistry }}
         username: ${{ secrets.QUAY_USERNAME }}
         password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Log in to Red Hat Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: registry.redhat.io
         username: ${{ secrets.REDHATIO_USERNAME }}
@@ -298,7 +298,7 @@ jobs:
         CONTAINERS_REGISTRIES_CONF: /dev/null
 
     - name: Push ${{ inputs.operator_name }}-operator-index To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ inputs.operator_name }}-operator-index
         tags: ${{ env.latesttag }} ${{ github.sha }}
@@ -319,7 +319,7 @@ jobs:
         GITHUB_SHA: ${{ github.sha }}
 
     - name: Push tag with digest ${{ env.OPERATOR_INDEX_IMAGE_DIGEST }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ inputs.operator_name }}-operator-index
         tags: ${{ env.OPERATOR_INDEX_IMAGE_DIGEST }}