Skip to content

Commit 56403a5

Browse files
vd0nvd0n
committed
ci: pin all GitHub Actions to commit SHAs
1 parent 7b48e8e commit 56403a5

File tree

8 files changed

+47
-47
lines changed

8 files changed

+47
-47
lines changed

‎.github/workflows/bld_docker.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -119,12 +119,12 @@ jobs:
119119

120120
- name: git-checkout-ref-action
121121
id: ref
122-
uses: ORCID/git-checkout-ref-action@main
122+
uses: ORCID/git-checkout-ref-action@4258c0cbe4b164e410d0263416034787fb300f26 # main
123123
with:
124124
default_branch: ${{ github.event.repository.default_branch }}
125125
ref: ${{ inputs.ref }}
126126

127-
- uses: actions/checkout@v4
127+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
128128
with:
129129
ref: ${{ steps.ref.outputs.ref }}
130130
# checkout some history so we can scan commits for bump messages
@@ -133,15 +133,15 @@ jobs:
133133

134134
- name: find next version
135135
id: version
136-
uses: ORCID/version-bump-action@main
136+
uses: ORCID/version-bump-action@75233259407ae3728171973d09bc66fcf4b15b6a # main
137137
with:
138138
version_tag: ${{ inputs.version_tag }}
139139
bump: ${{ inputs.bump }}
140140

141-
- uses: docker/setup-buildx-action@v3
141+
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
142142

143143
- name: Login to private registry
144-
uses: docker/login-action@v3
144+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
145145
with:
146146
registry: ${{ secrets.DOCKER_REG_PRIVATE }}
147147
username: ${{ secrets.DOCKER_USER }}
@@ -157,7 +157,7 @@ jobs:
157157
run: |
158158
echo ${{ steps.dynamic_defaults.outputs.default_file }}
159159
160-
- uses: docker/build-push-action@v6
160+
- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
161161
with:
162162
push: ${{ inputs.push }}
163163
tags: ${{ secrets.DOCKER_REG_PRIVATE }}/${{ matrix.docker_name}}:${{ steps.version.outputs.version_tag_numeric }}

‎.github/workflows/bld_mvn.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -105,12 +105,12 @@ jobs:
105105

106106
- name: git-checkout-ref-action
107107
id: ref
108-
uses: ORCID/git-checkout-ref-action@main
108+
uses: ORCID/git-checkout-ref-action@4258c0cbe4b164e410d0263416034787fb300f26 # main
109109
with:
110110
default_branch: ${{ github.event.repository.default_branch }}
111111
ref: ${{ inputs.ref }}
112112

113-
- uses: actions/checkout@v4
113+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
114114
with:
115115
ref: ${{ steps.ref.outputs.ref }}
116116
# checkout some history so we can scan commits for bump messages
@@ -119,13 +119,13 @@ jobs:
119119

120120
- name: find next version
121121
id: version
122-
uses: ORCID/version-bump-action@main
122+
uses: ORCID/version-bump-action@75233259407ae3728171973d09bc66fcf4b15b6a # main
123123
with:
124124
version_tag: ${{ inputs.version_tag }}
125125
bump: ${{ inputs.bump }}
126126

127127
- name: Set up Open JDK 11
128-
uses: actions/setup-java@v4
128+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
129129
with:
130130
distribution: 'temurin'
131131
java-version: '11'
@@ -134,7 +134,7 @@ jobs:
134134

135135
- name: if not installing dependencies restore special previous git_sha cache
136136
if: ${{ ! inputs.install_maven_dependencies }}
137-
uses: actions/cache@v4
137+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
138138
with:
139139
path: ~/.m2/repository
140140
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-${{ steps.version.outputs.version_tag_numeric }}-${{ github.sha }}
@@ -153,7 +153,7 @@ jobs:
153153

154154
- name: if installing dependencies use a standard cache key name
155155
if: ${{ inputs.install_maven_dependencies }}
156-
uses: actions/cache@v4
156+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
157157
with:
158158
path: ~/.m2/repository
159159
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-seed-cache
@@ -163,14 +163,14 @@ jobs:
163163
- name: seed_maven_cache
164164
if: ${{ inputs.seed_maven_cache }}
165165
id: cache
166-
uses: ORCID/ORCID-Source-cache-action@main
166+
uses: ORCID/ORCID-Source-cache-action@9831e0ffb2e9db46bffa6bb55fb897d159da5668 # main
167167
with:
168168
version_tag_numeric: ${{ steps.version.outputs.version_tag_numeric }}
169169

170170
- name: install_dependencies and bump version
171171
if: ${{ inputs.install_maven_dependencies }}
172172
id: install_dependencies
173-
uses: ORCID/ORCID-Source-dependencies-action@main
173+
uses: ORCID/ORCID-Source-dependencies-action@e470d485ef8dc69858100998d77d03ccefb06ef1 # main
174174
with:
175175
version_tag_numeric: ${{ steps.version.outputs.version_tag_numeric }}
176176

@@ -192,7 +192,7 @@ jobs:
192192

193193
- name: setup node for angular static file
194194
if: ${{ matrix.project == 'orcid-web' }}
195-
uses: actions/setup-node@v4
195+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
196196
with:
197197
node-version: 18.7.0
198198

‎.github/workflows/install_maven_dependencies.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -73,12 +73,12 @@ jobs:
7373

7474
- name: git-checkout-ref-action
7575
id: ref
76-
uses: ORCID/git-checkout-ref-action@main
76+
uses: ORCID/git-checkout-ref-action@4258c0cbe4b164e410d0263416034787fb300f26 # main
7777
with:
7878
default_branch: ${{ github.event.repository.default_branch }}
7979
ref: ${{ inputs.ref }}
8080

81-
- uses: actions/checkout@v4
81+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
8282
with:
8383
ref: ${{ steps.ref.outputs.ref }}
8484
# checkout some history so we can scan commits for bump messages
@@ -87,19 +87,19 @@ jobs:
8787

8888
- name: find next version
8989
id: version
90-
uses: ORCID/version-bump-action@main
90+
uses: ORCID/version-bump-action@75233259407ae3728171973d09bc66fcf4b15b6a # main
9191
with:
9292
version_tag: ${{ inputs.version_tag }}
9393
bump: ${{ inputs.bump }}
9494

9595
- name: Set up Open JDK 11
96-
uses: actions/setup-java@v4
96+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
9797
with:
9898
distribution: 'temurin'
9999
java-version: '11'
100100

101101
- name: Restore the seeded cache but save dependencies into a new unique git sha hash with the expected version of the build
102-
uses: actions/cache@v4
102+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
103103
with:
104104
path: ~/.m2/repository
105105
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-${{ steps.version.outputs.version_tag_numeric }}-${{ github.sha }}
@@ -125,7 +125,7 @@ jobs:
125125

126126
- name: install_dependencies
127127
id: install_dependencies
128-
uses: ORCID/ORCID-Source-dependencies-action@main
128+
uses: ORCID/ORCID-Source-dependencies-action@e470d485ef8dc69858100998d77d03ccefb06ef1 # main
129129
with:
130130
version_tag_numeric: ${{ steps.version.outputs.version_tag_numeric }}
131131

‎.github/workflows/lint.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ jobs:
2121
with:
2222
egress-policy: audit
2323

24-
- uses: actions/checkout@v4
25-
- uses: actions/setup-python@v5
24+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
25+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
2626
with:
2727
python-version: '3.10'
28-
- uses: pre-commit/action@576ff52938d158a24ac7e009dfa94b1455e7df99
28+
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

‎.github/workflows/rel_tag.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,13 @@ jobs:
6363

6464
- name: git-checkout-ref-action
6565
id: ref
66-
uses: ORCID/git-checkout-ref-action@main
66+
uses: ORCID/git-checkout-ref-action@4258c0cbe4b164e410d0263416034787fb300f26 # main
6767
with:
6868
default_branch: ${{ github.event.repository.default_branch }}
6969
ref: ${{ inputs.ref }}
7070

7171

72-
- uses: actions/checkout@v4
72+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
7373
with:
7474
# token with write permissions to protected branches
7575
# standard github token does not allow this
@@ -81,13 +81,13 @@ jobs:
8181

8282
- name: find next version
8383
id: version
84-
uses: ORCID/version-bump-action@main
84+
uses: ORCID/version-bump-action@75233259407ae3728171973d09bc66fcf4b15b6a # main
8585
with:
8686
version_tag: ${{ inputs.version_tag }}
8787
bump: ${{ inputs.bump }}
8888

8989
- name: tag repo create changelog and create release
90-
uses: ORCID/changelog-action@main
90+
uses: ORCID/changelog-action@a5a2787feb8462255492cdfc732b32adf4d0c5d0 # main
9191
with:
9292
version_tag: ${{ steps.version.outputs.version_tag }}
9393
slack_channel: tech-release

‎.github/workflows/sast.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ jobs:
1515
egress-policy: audit
1616

1717
- name: Checkout code
18-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
18+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1919
- name: Set up JDK 11
20-
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00
20+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
2121
with:
2222
java-version: '11'
2323
distribution: 'temurin'
@@ -28,7 +28,7 @@ jobs:
2828
- name: Create zip with all dependency trees
2929
run: find . -type f -name 'maven_dep_tree.txt' -exec zip -r deptree.zip {} +
3030
- name: Upload zip
31-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
31+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3232
with:
3333
name: deptree
3434
path: deptree.zip
@@ -46,9 +46,9 @@ jobs:
4646
if: (github.actor != 'dependabot[bot]')
4747
steps:
4848
- name: Checkout code
49-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
49+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
5050
- name: Download Maven Dependencies
51-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
51+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
5252
with:
5353
name: deptree
5454
- name: Extract zip and run Semgrep

‎.github/workflows/seed_maven_cache.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,12 +71,12 @@ jobs:
7171

7272
- name: git-checkout-ref-action
7373
id: ref
74-
uses: ORCID/git-checkout-ref-action@main
74+
uses: ORCID/git-checkout-ref-action@4258c0cbe4b164e410d0263416034787fb300f26 # main
7575
with:
7676
default_branch: ${{ github.event.repository.default_branch }}
7777
ref: ${{ inputs.ref }}
7878

79-
- uses: actions/checkout@v4
79+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
8080
with:
8181
ref: ${{ steps.ref.outputs.ref }}
8282
# checkout some history so we can scan commits for bump messages
@@ -85,19 +85,19 @@ jobs:
8585

8686
- name: find next version
8787
id: version
88-
uses: ORCID/version-bump-action@main
88+
uses: ORCID/version-bump-action@75233259407ae3728171973d09bc66fcf4b15b6a # main
8989
with:
9090
version_tag: ${{ inputs.version_tag }}
9191
bump: ${{ inputs.bump }}
9292

9393
- name: Set up Open JDK 11
94-
uses: actions/setup-java@v4
94+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
9595
with:
9696
distribution: 'temurin'
9797
java-version: '11'
9898

9999
- name: Cache local Maven repository keyed off the pom
100-
uses: actions/cache@v4
100+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
101101
with:
102102
path: ~/.m2/repository
103103
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-seed-cache
@@ -106,7 +106,7 @@ jobs:
106106
107107
- name: seed_cache
108108
id: cache
109-
uses: ORCID/ORCID-Source-cache-action@main
109+
uses: ORCID/ORCID-Source-cache-action@9831e0ffb2e9db46bffa6bb55fb897d159da5668 # main
110110
with:
111111
version_tag_numeric: ${{ steps.version.outputs.version_tag_numeric }}
112112

‎.github/workflows/test_mvn.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -89,12 +89,12 @@ jobs:
8989

9090
- name: git-checkout-ref-action
9191
id: ref
92-
uses: ORCID/git-checkout-ref-action@main
92+
uses: ORCID/git-checkout-ref-action@4258c0cbe4b164e410d0263416034787fb300f26 # main
9393
with:
9494
default_branch: ${{ github.event.repository.default_branch }}
9595
ref: ${{ inputs.ref }}
9696

97-
- uses: actions/checkout@v4
97+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
9898
with:
9999
ref: ${{ steps.ref.outputs.ref }}
100100
# checkout some history so we can scan commits for bump messages
@@ -103,13 +103,13 @@ jobs:
103103

104104
- name: find next version
105105
id: version
106-
uses: ORCID/version-bump-action@main
106+
uses: ORCID/version-bump-action@75233259407ae3728171973d09bc66fcf4b15b6a # main
107107
with:
108108
version_tag: ${{ inputs.version_tag }}
109109
bump: ${{ inputs.bump }}
110110

111111
- name: Set up Open JDK 11
112-
uses: actions/setup-java@v4
112+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
113113
with:
114114
distribution: 'temurin'
115115
java-version: '11'
@@ -119,7 +119,7 @@ jobs:
119119

120120
- name: if not installing dependencies restore special previous git_sha cache
121121
if: ${{ ! inputs.install_maven_dependencies }}
122-
uses: actions/cache@v4
122+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
123123
with:
124124
path: ~/.m2/repository
125125
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-${{ steps.version.outputs.version_tag_numeric }}-${{ github.sha }}
@@ -138,7 +138,7 @@ jobs:
138138

139139
- name: if installing dependencies use a standard cache key name
140140
if: ${{ inputs.install_maven_dependencies }}
141-
uses: actions/cache@v4
141+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
142142
with:
143143
path: ~/.m2/repository
144144
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-seed-cache
@@ -148,14 +148,14 @@ jobs:
148148
- name: seed_maven_cache
149149
if: ${{ inputs.seed_maven_cache }}
150150
id: cache
151-
uses: ORCID/ORCID-Source-cache-action@main
151+
uses: ORCID/ORCID-Source-cache-action@9831e0ffb2e9db46bffa6bb55fb897d159da5668 # main
152152
with:
153153
version_tag_numeric: ${{ steps.version.outputs.version_tag_numeric }}
154154

155155
- name: install_dependencies and bump version
156156
if: ${{ inputs.install_maven_dependencies }}
157157
id: install_dependencies
158-
uses: ORCID/ORCID-Source-dependencies-action@main
158+
uses: ORCID/ORCID-Source-dependencies-action@e470d485ef8dc69858100998d77d03ccefb06ef1 # main
159159
with:
160160
version_tag_numeric: ${{ steps.version.outputs.version_tag_numeric }}
161161

0 commit comments

Comments
 (0)