Skip to content

Commit 8add83d

Browse files
bschwedlerbschwedler
committed
Use specific version tags in SHA pin comments
Major version tags (v6, v7) are mutable — they float forward with each release. Version comments must reference the exact release (v6.0.2, v7.6.0) so Dependabot can correctly identify and propose updates.
1 parent 9d42d7e commit 8add83d

7 files changed

Lines changed: 51 additions & 51 deletions

File tree

‎.github/workflows/bakery-build-native.yml‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ jobs:
8585

8686
steps:
8787
- name: Checkout
88-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
88+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8989

9090
- name: Install
9191
uses: "posit-dev/images-shared/setup-bakery@main"
@@ -112,7 +112,7 @@ jobs:
112112

113113
steps:
114114
- name: Checkout
115-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
115+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
116116

117117
- name: Setup bakery
118118
uses: "posit-dev/images-shared/setup-bakery@main"
@@ -123,7 +123,7 @@ jobs:
123123
uses: "posit-dev/images-shared/setup-goss@ci-native-multiplatform"
124124

125125
- name: Set up Docker
126-
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5
126+
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5.0.0
127127
with:
128128
daemon-config: |
129129
{
@@ -132,10 +132,10 @@ jobs:
132132
}
133133
}
134134
- name: Setup docker buildx
135-
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
135+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
136136

137137
- name: Setup ORAS CLI
138-
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
138+
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
139139

140140
# Since secrets cannot be referenced in an `if` condition directly,
141141
# this step sets an output that we can reference later.
@@ -155,30 +155,30 @@ jobs:
155155
fi
156156
157157
- name: Login to GitHub Container Registry
158-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
158+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
159159
with:
160160
registry: ghcr.io
161161
username: ${{ github.actor }}
162162
password: ${{ secrets.GITHUB_TOKEN }}
163163

164164
- name: Login to Docker Hub
165165
if: ${{ inputs.push && steps.filter-steps.outputs.docker-hub == 'true' }}
166-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
166+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
167167
with:
168168
username: "posit"
169169
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
170170

171171
- name: Configure AWS Credentials
172172
if: ${{ inputs.push && steps.filter-steps.outputs.ecr == 'true' }}
173-
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
173+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
174174
with:
175175
role-to-assume: ${{ secrets.AWS_ROLE }}
176176
aws-region: ${{ inputs.aws-region }}
177177
role-session-name: gha-bakery-build
178178

179179
- name: Login to Amazon ECR
180180
if: ${{ inputs.push && steps.filter-steps.outputs.ecr == 'true' }}
181-
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2
181+
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
182182

183183
- name: Normalize platform
184184
id: normalize-platform
@@ -220,7 +220,7 @@ jobs:
220220
--metadata-file "./${{ matrix.img.image }}-${{ matrix.img.version }}-${{ steps.normalize-platform.outputs.platform }}-metadata.json" \
221221
--context ${{ inputs.context }}
222222
- name: Upload Metadata
223-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
223+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
224224
with:
225225
name: "${{ matrix.img.image }}-${{ matrix.img.version }}-${{ steps.normalize-platform.outputs.platform }}-metadata"
226226
path: "./${{ matrix.img.image }}-${{ matrix.img.version }}-${{ steps.normalize-platform.outputs.platform }}-metadata.json"
@@ -239,15 +239,15 @@ jobs:
239239

240240
steps:
241241
- name: Checkout
242-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
242+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
243243

244244
- name: Setup bakery
245245
uses: "posit-dev/images-shared/setup-bakery@main"
246246
with:
247247
version: ${{ inputs.version }}
248248

249249
- name: Set up Docker
250-
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5
250+
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5.0.0
251251
with:
252252
daemon-config: |
253253
{
@@ -274,39 +274,39 @@ jobs:
274274
fi
275275
276276
- name: Login to GitHub Container Registry
277-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
277+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
278278
with:
279279
registry: ghcr.io
280280
username: ${{ github.actor }}
281281
password: ${{ secrets.GITHUB_TOKEN }}
282282

283283
- name: Login to Docker Hub
284284
if: ${{ inputs.push && steps.filter-steps.outputs.docker-hub == 'true' }}
285-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
285+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
286286
with:
287287
username: "posit"
288288
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
289289

290290
- name: Configure AWS Credentials
291291
if: ${{ inputs.push && steps.filter-steps.outputs.ecr == 'true' }}
292-
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
292+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
293293
with:
294294
role-to-assume: ${{ secrets.AWS_ROLE }}
295295
aws-region: ${{ inputs.aws-region }}
296296
role-session-name: gha-bakery-build
297297

298298
- name: Login to Amazon ECR
299299
if: ${{ inputs.push && steps.filter-steps.outputs.ecr == 'true' }}
300-
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2
300+
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
301301

302302
- name: Setup docker buildx
303-
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
303+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
304304

305305
- name: Setup ORAS CLI
306-
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
306+
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
307307

308308
- name: Download Metadata
309-
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
309+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
310310
with:
311311
pattern: "${{ matrix.img.image }}-${{ matrix.img.version }}-*-metadata"
312312
merge-multiple: true
@@ -334,7 +334,7 @@ jobs:
334334

335335
steps:
336336
- name: Checkout
337-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
337+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
338338

339339
- name: Setup bakery
340340
uses: "posit-dev/images-shared/setup-bakery@main"

‎.github/workflows/bakery-build.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ jobs:
7575

7676
steps:
7777
- name: Checkout
78-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
78+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7979

8080
- name: Install
8181
uses: "posit-dev/images-shared/setup-bakery@main"
@@ -98,7 +98,7 @@ jobs:
9898

9999
steps:
100100
- name: Checkout
101-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
101+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
102102

103103
- name: Setup bakery
104104
uses: "posit-dev/images-shared/setup-bakery@main"
@@ -109,7 +109,7 @@ jobs:
109109
uses: "posit-dev/images-shared/setup-goss@main"
110110

111111
- name: Setup QEMU
112-
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
112+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
113113

114114
# Since secrets cannot be referenced in an `if` condition directly,
115115
# this step sets an output that we can reference later.
@@ -129,33 +129,33 @@ jobs:
129129
fi
130130
131131
- name: Login to GitHub Container Registry
132-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
132+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
133133
with:
134134
registry: ghcr.io
135135
username: ${{ github.actor }}
136136
password: ${{ secrets.GITHUB_TOKEN }}
137137

138138
- name: Login to Docker Hub
139139
if: ${{ inputs.push && steps.filter-steps.outputs.docker-hub == 'true' }}
140-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
140+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
141141
with:
142142
username: "posit"
143143
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
144144

145145
- name: Configure AWS Credentials
146146
if: ${{ inputs.push && steps.filter-steps.outputs.ecr == 'true' }}
147-
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
147+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
148148
with:
149149
role-to-assume: ${{ secrets.AWS_ROLE }}
150150
aws-region: ${{ inputs.aws-region }}
151151
role-session-name: gha-bakery-build
152152

153153
- name: Login to Amazon ECR
154154
if: ${{ inputs.push && steps.filter-steps.outputs.ecr == 'true' }}
155-
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2
155+
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
156156

157157
- name: Setup docker buildx
158-
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
158+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
159159

160160
- name: Build
161161
env:
@@ -206,7 +206,7 @@ jobs:
206206

207207
steps:
208208
- name: Checkout
209-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
209+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
210210

211211
- name: Setup bakery
212212
uses: "posit-dev/images-shared/setup-bakery@main"

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
- zizmor
3333

3434
steps:
35-
- uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1
35+
- uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
3636
with:
3737
allowed-skips: zizmor
3838
jobs: ${{ toJSON(needs) }}
@@ -42,7 +42,7 @@ jobs:
4242
runs-on: ubuntu-latest-8x
4343
steps:
4444
- name: Checkout
45-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4646
with:
4747
fetch-depth: 0
4848
fetch-tags: true
@@ -51,7 +51,7 @@ jobs:
5151
uses: ./setup-goss
5252

5353
- name: Set up Docker
54-
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5
54+
uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # v5.0.0
5555
with:
5656
daemon-config: |
5757
{
@@ -61,24 +61,24 @@ jobs:
6161
}
6262
6363
- name: Setup QEMU
64-
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
64+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
6565
with:
6666
platforms: linux/amd64,linux/arm64
6767

6868
- name: Setup docker buildx
69-
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
69+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
7070

7171
- name: Setup hadolint
7272
uses: ./setup-hadolint
7373

7474
- name: Setup ORAS CLI
75-
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
75+
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
7676

7777
- name: Add tools/ to path
7878
run: echo "${GITHUB_WORKSPACE}/tools" >> $GITHUB_PATH
7979

8080
- name: Setup uv
81-
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
81+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
8282
with:
8383
python-version-file: "posit-bakery/pyproject.toml"
8484

@@ -106,7 +106,7 @@ jobs:
106106
107107
- name: Publish results
108108
if: always()
109-
uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
109+
uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
110110
with:
111111
files: ./posit-bakery/results.xml
112112

@@ -141,7 +141,7 @@ jobs:
141141
contents: read
142142
security-events: write
143143
steps:
144-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
144+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
145145
with:
146146
persist-credentials: false
147147
- uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
@@ -192,13 +192,13 @@ jobs:
192192

193193
steps:
194194
- name: Checkout
195-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
195+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
196196
with:
197197
fetch-depth: 0
198198
fetch-tags: true
199199

200200
- name: Setup uv
201-
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
201+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
202202
with:
203203
python-version-file: "posit-bakery/pyproject.toml"
204204

@@ -214,7 +214,7 @@ jobs:
214214
215215
- name: Upload snapshot artifacts
216216
if: github.event_name == 'pull_request'
217-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
217+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
218218
with:
219219
name: bakery-snapshot-pr${{ github.event.pull_request.number }}
220220
path: ./posit-bakery/dist

‎.github/workflows/clean.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,15 +74,15 @@ jobs:
7474
steps:
7575

7676
- name: Checkout
77-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
77+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7878

7979
- name: Setup bakery
8080
uses: "posit-dev/images-shared/setup-bakery@main"
8181
with:
8282
version: ${{ inputs.version }}
8383

8484
- name: Login to GitHub Container Registry
85-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
85+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
8686
with:
8787
registry: ghcr.io
8888
username: ${{ github.actor }}
@@ -107,15 +107,15 @@ jobs:
107107
steps:
108108

109109
- name: Checkout
110-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
110+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
111111

112112
- name: Setup bakery
113113
uses: "posit-dev/images-shared/setup-bakery@main"
114114
with:
115115
version: ${{ inputs.version }}
116116

117117
- name: Login to GitHub Container Registry
118-
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
118+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
119119
with:
120120
registry: ghcr.io
121121
username: ${{ github.actor }}

‎.github/workflows/issues.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
steps:
1313

1414
- name: GitHub App Token
15-
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
15+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
1616
id: app-token
1717
with:
1818
app-id: ${{ secrets.APP_ID }}
@@ -25,7 +25,7 @@ jobs:
2525
project-url: https://github.com/orgs/posit-dev/projects/17
2626

2727
- name: Add Default Labels
28-
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1
28+
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.0
2929
with:
3030
github_token: ${{ steps.app-token.outputs.token }}
3131
labels: |

0 commit comments

Comments
 (0)