Skip to content

Commit ff23c1a

Browse files
staaldraadstaaldraad
authored
Merge pull request #677 from supabase/etienne/sec-666-pin-all-github-actions-to-full-commit-sha
chore: pin actions to sha
2 parents e86da41 + 339e5c7 commit ff23c1a

4 files changed

Lines changed: 38 additions & 36 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ jobs:
4444
name: 'fmt'
4545
runs-on: blacksmith-4vcpu-ubuntu-2404
4646
steps:
47-
- uses: actions/checkout@v6
48-
- uses: denoland/setup-deno@v2
47+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
48+
- uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
4949
with:
5050
deno-version: v2.x
5151
- run: rustup show
@@ -56,13 +56,13 @@ jobs:
5656
name: 'cargo clippy'
5757
runs-on: blacksmith-4vcpu-ubuntu-2404
5858
steps:
59-
- uses: actions/checkout@v6
59+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6060
- name: Install deps
6161
run: |
6262
sudo apt-get update
6363
sudo apt-get -y install libblas-dev liblapack-dev libopenblas-dev
6464
- run: rustup show
65-
- uses: Swatinem/rust-cache@v2
65+
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
6666
- run: ./scripts/clippy.sh
6767

6868
cargo-test:
@@ -76,7 +76,9 @@ jobs:
7676
sudo apt-get -y install libblas-dev liblapack-dev libopenblas-dev
7777
7878
- name: Install cargo-llvm-cov
79-
uses: taiki-e/install-action@cargo-llvm-cov
79+
uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2.69.9
80+
with:
81+
tool: cargo-llvm-cov
8082

8183
- name: Remove unwanted software
8284
run: |
@@ -89,11 +91,11 @@ jobs:
8991
sudo apt-get remove --purge -y man-db
9092
sudo apt-get remove 'clang-13*' 'clang-14*' 'clang-15*' 'llvm-13*' 'llvm-14*' 'llvm-15*' 'lld-13*' 'lld-14*' 'lld-15*'
9193
92-
- uses: actions/checkout@v6
94+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9395
- run: rustup show
94-
- uses: Swatinem/rust-cache@v2
96+
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
9597

96-
- uses: cardinalby/export-env-action@v2
98+
- uses: cardinalby/export-env-action@b16a08b396d047e3f9e1446e3946440e2be02a73 # 2.2.2
9799
with:
98100
envFile: '.env'
99101

@@ -107,7 +109,7 @@ jobs:
107109
github.event_name != 'pull_request'
108110
|| github.event.pull_request.head.repo.full_name == github.repository
109111
)
110-
uses: actions/checkout@v6
112+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
111113
with:
112114
repository: ${{ env.ESZIP_TESTDATA_REPO }}
113115
path: ./edge-runtime-test-eszip
@@ -154,7 +156,7 @@ jobs:
154156
shell: bash
155157

156158
- name: Cache AI models
157-
uses: actions/cache@v4
159+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
158160
with:
159161
path: ${{ env.EXT_AI_CACHE_DIR }}
160162
key: ext-ai-cache-${{ runner.os }}-v1
@@ -166,7 +168,7 @@ jobs:
166168
run: |
167169
cargo llvm-cov test --workspace --no-fail-fast --lcov -j 1 --output-path lcov.info
168170
- name: Coveralls upload
169-
uses: coverallsapp/github-action@v2
171+
uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
170172
with:
171173
fail-on-error: false
172174
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/mirror.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,19 @@ jobs:
2020
id-token: write
2121
steps:
2222
- name: configure aws credentials
23-
uses: aws-actions/configure-aws-credentials@v5
23+
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
2424
with:
2525
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
2626
aws-region: 'us-east-1'
27-
- uses: docker/login-action@v3
27+
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
2828
with:
2929
registry: public.ecr.aws
30-
- uses: docker/login-action@v3
30+
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
3131
with:
3232
registry: ghcr.io
3333
username: ${{ github.actor }}
3434
password: ${{ secrets.GITHUB_TOKEN }}
35-
- uses: akhilerm/tag-push-action@v2.2.0
35+
- uses: akhilerm/tag-push-action@f35ff2cb99d407368b5c727adbcc14a2ed81d509 # v2.2.0
3636
with:
3737
src: docker.io/supabase/edge-runtime:${{ inputs.version }}
3838
dst: |

‎.github/workflows/release.yml‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@ jobs:
1717
published: ${{ steps.semantic.outputs.new_release_published }}
1818
version: ${{ steps.semantic.outputs.new_release_version }}
1919
steps:
20-
- uses: actions/checkout@v6
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2121
with:
2222
fetch-depth: 0
2323
fetch-tags: true
2424

2525
- name: Semantic Release
2626
id: semantic
27-
uses: cycjimmy/semantic-release-action@v6.0.0
27+
uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
2828
with:
2929
semantic_version: 18
3030
extra_plugins: |
@@ -43,28 +43,28 @@ jobs:
4343
outputs:
4444
image_digest: ${{ steps.build.outputs.digest }}
4545
steps:
46-
- uses: actions/checkout@v6
46+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4747
- id: meta
48-
uses: docker/metadata-action@v5
48+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
4949
with:
5050
images: |
5151
supabase/edge-runtime
5252
tags: |
5353
type=raw,value=v${{ needs.release.outputs.version }}_${{ env.arch }}
5454
55-
- uses: docker/setup-buildx-action@v3
55+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
5656

5757
- name: Login to DockerHub
58-
uses: docker/login-action@v3
58+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
5959
with:
6060
username: ${{ secrets.DOCKER_USERNAME }}
6161
password: ${{ secrets.DOCKER_PASSWORD }}
6262

63-
- uses: cardinalby/export-env-action@v2
63+
- uses: cardinalby/export-env-action@b16a08b396d047e3f9e1446e3946440e2be02a73 # 2.2.2
6464
with:
6565
envFile: '.env'
6666
- id: build
67-
uses: docker/build-push-action@v6
67+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
6868
with:
6969
push: true
7070
platforms: linux/${{ env.arch }}
@@ -85,33 +85,33 @@ jobs:
8585
outputs:
8686
image_digest: ${{ steps.build.outputs.digest }}
8787
steps:
88-
- uses: actions/checkout@v6
88+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8989
- id: meta
90-
uses: docker/metadata-action@v5
90+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
9191
with:
9292
images: |
9393
supabase/edge-runtime
9494
tags: |
9595
type=raw,value=v${{ needs.release.outputs.version }}_${{ env.arch }}
9696
9797
- name: Login to DockerHub
98-
uses: docker/login-action@v3
98+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
9999
with:
100100
username: ${{ secrets.DOCKER_USERNAME }}
101101
password: ${{ secrets.DOCKER_PASSWORD }}
102102

103-
- uses: docker/setup-buildx-action@v3
103+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
104104
with:
105105
driver: docker
106106
driver-opts: |
107107
image=moby/buildkit:master
108108
network=host
109109
110-
- uses: cardinalby/export-env-action@v2
110+
- uses: cardinalby/export-env-action@b16a08b396d047e3f9e1446e3946440e2be02a73 # 2.2.2
111111
with:
112112
envFile: '.env'
113113
- id: build
114-
uses: docker/build-push-action@v6
114+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
115115
with:
116116
context: .
117117
push: true
@@ -130,9 +130,9 @@ jobs:
130130
packages: write
131131
id-token: write
132132
steps:
133-
- uses: docker/setup-buildx-action@v3
133+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
134134

135-
- uses: docker/login-action@v3
135+
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
136136
with:
137137
username: ${{ secrets.DOCKER_USERNAME }}
138138
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -143,25 +143,25 @@ jobs:
143143
supabase/edge-runtime@${{ needs.publish_x86.outputs.image_digest }} \
144144
supabase/edge-runtime@${{ needs.publish_arm.outputs.image_digest }}
145145
- name: configure aws credentials
146-
uses: aws-actions/configure-aws-credentials@v5
146+
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
147147
with:
148148
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
149149
aws-region: us-east-1
150150

151151
- name: Login to ECR
152-
uses: docker/login-action@v3
152+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
153153
with:
154154
registry: public.ecr.aws
155155

156156
- name: Login to GHCR
157-
uses: docker/login-action@v3
157+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
158158
with:
159159
registry: ghcr.io
160160
username: ${{ github.actor }}
161161
password: ${{ secrets.GITHUB_TOKEN }}
162162

163163
- name: Mirror to ECR
164-
uses: akhilerm/tag-push-action@v2.2.0
164+
uses: akhilerm/tag-push-action@f35ff2cb99d407368b5c727adbcc14a2ed81d509 # v2.2.0
165165
with:
166166
src: docker.io/supabase/edge-runtime:v${{ needs.release.outputs.version }}
167167
dst: |

‎.github/workflows/stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
stale:
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/stale@v10
17+
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
1818
with:
1919
stale-issue-label: 'stale'
2020
stale-pr-label: 'stale'

0 commit comments

Comments
 (0)