Skip to content

Commit a0be383

Browse files
sophokles73sophokles73
committed
Pin actions to reduce attack surface
Also enabled dependabot for github actions to keep them up to date and reduce the risk of using vulnerable versions of actions. See https://mikael.barbero.tech/blog/post/2026-03-24-stop-trusting-mutable-references/
1 parent c9fb74b commit a0be383

File tree

9 files changed

+53
-25
lines changed

9 files changed

+53
-25
lines changed

‎.github/dependabot.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# ********************************************************************************
2+
# Copyright (c) 2026 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# SPDX-License-Identifier: Apache-2.0
12+
# *******************************************************************************/
13+
version: 2
14+
updates:
15+
16+
- package-ecosystem: "github-actions"
17+
directories:
18+
- "/.github/workflows"
19+
- "/.github/actions"
20+
schedule:
21+
# Check for updates to GitHub Actions every week
22+
interval: "weekly"
23+
cooldown:
24+
default-days: 7

‎.github/workflows/requirements-tracing.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
outputs:
7070
tracing-report-url: ${{ steps.run-oft.outputs.tracing-report-url }}
7171
steps:
72-
- uses: actions/checkout@v6
72+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7373
with:
7474
submodules: "recursive"
7575

@@ -81,15 +81,15 @@ jobs:
8181
8282
- name: "Determine OpenFastTrace parameters from .env file"
8383
if: inputs.env-file-suffix != ''
84-
uses: falti/dotenv-action@v1.2.0
84+
uses: falti/dotenv-action@73fafca04177425fd3e0a0849257015ae9d42034 # v1.2.0
8585
with:
8686
path: ".env.${{ inputs.env-file-suffix }}"
8787
export-variables: true
8888
keys-case: bypass
8989

9090
- name: Run OpenFastTrace
9191
id: run-oft
92-
uses: eclipse-uprotocol/ci-cd/.github/actions/run-oft@main
92+
uses: eclipse-uprotocol/ci-cd/.github/actions/run-oft@c9fb74b20429e69c15021c64dcf343447a2f46a2 # main
9393
with:
9494
file-patterns: ${{ env.OFT_FILE_PATTERNS }}
9595
tags: ${{ env.OFT_TAGS }}

‎.github/workflows/rust-coverage.yaml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,35 +36,37 @@ jobs:
3636
outputs:
3737
test_coverage_url: ${{ steps.test_coverage_html.outputs.artifact-url }}
3838
steps:
39-
- uses: actions/checkout@v6
39+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4040
with:
4141
submodules: "recursive"
4242

43-
- uses: actions-rust-lang/setup-rust-toolchain@v1
43+
- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
4444
with:
4545
toolchain: ${{ env.RUST_TOOLCHAIN }}
4646
- name: Install cargo-tarpaulin
47-
uses: taiki-e/install-action@cargo-tarpaulin
47+
uses: taiki-e/install-action@7bc99eee1f1b8902a125006cf790a1f4c8461e63 # v2.69.8
48+
with:
49+
tool: cargo-tarpaulin
4850

4951
- name: Run tests and report code coverage
5052
run: |
5153
# enable nightly features so that we can also include Doctests
5254
RUSTC_BOOTSTRAP=1 cargo tarpaulin --workspace --implicit-test-threads --all-features --all-targets --doc -o xml -o lcov -o html
5355
5456
- name: Upload coverage report (lcov)
55-
uses: actions/upload-artifact@v6
57+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
5658
id: test_coverage_lcov
5759
with:
5860
name: code-coverage-lcov
5961
path: lcov.info
6062
- name: Upload coverage report (xml)
61-
uses: actions/upload-artifact@v6
63+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
6264
id: test_coverage_xml
6365
with:
6466
name: code-coverage-xml
6567
path: cobertura.xml
6668
- name: Upload coverage report (html)
67-
uses: actions/upload-artifact@v6
69+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
6870
id: test_coverage_html
6971
with:
7072
name: code-coverage-html
@@ -74,8 +76,8 @@ jobs:
7476
env:
7577
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
7678
if: env.CODECOV_TOKEN != ''
77-
uses: codecov/codecov-action@v4.0.1
79+
uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044 # v4.0.1
7880
with:
7981
token: ${{ secrets.CODECOV_TOKEN }}
8082
slug: ${{ vars.GITHUB_REPOSITORY }}
81-
files: lcov.info
83+
files: lcov.info

‎.github/workflows/rust-deny-check.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,11 @@ jobs:
5050
continue-on-error: ${{ matrix.checks == 'advisories' }}
5151

5252
steps:
53-
- uses: actions/checkout@v6
53+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5454
with:
5555
submodules: "recursive"
5656

57-
- uses: EmbarkStudios/cargo-deny-action@v2
57+
- uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
5858
with:
5959
command: check ${{ matrix.checks }}
6060
command-arguments: ${{ inputs.command-arguments }}

‎.github/workflows/rust-license-report.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,10 @@ jobs:
5151
outputs:
5252
license_report_url: ${{ steps.license_report.outputs.artifact-url }}
5353
steps:
54-
- uses: actions/checkout@v6
54+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5555
with:
5656
submodules: "recursive"
57-
- uses: actions-rust-lang/setup-rust-toolchain@v1
57+
- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
5858
with:
5959
toolchain: ${{ env.RUST_TOOLCHAIN }}
6060

@@ -64,8 +64,8 @@ jobs:
6464
- name: Create license report
6565
run: |
6666
cargo about generate --config ${{ inputs.config }} ${{ inputs.templates }} > licenses.html
67-
- uses: actions/upload-artifact@v6
67+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
6868
id: license_report
6969
with:
7070
name: license-report
71-
path: licenses.html
71+
path: licenses.html

‎.github/workflows/rust-test-featurematrix.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ jobs:
3131
matrix:
3232
os: [ubuntu-latest, windows-latest, macOS-latest]
3333
steps:
34-
- uses: actions/checkout@v6
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535
with:
3636
submodules: "recursive"
37-
- uses: actions-rust-lang/setup-rust-toolchain@v1
37+
- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
3838
with:
3939
toolchain: ${{ env.RUST_TOOLCHAIN }}
4040
- name: Install cargo-all-features

‎.github/workflows/rust-verify-latest-deps.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
env:
3232
CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: allow
3333
steps:
34-
- uses: actions/checkout@v6
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535
with:
3636
submodules: "recursive"
3737
- run: rustup update stable && rustup default stable

‎.github/workflows/rust-verify-msrv.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,15 @@ jobs:
2929
check:
3030
runs-on: ubuntu-latest
3131
steps:
32-
- uses: actions/checkout@v6
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3333
with:
3434
submodules: "recursive"
35-
- uses: actions-rust-lang/setup-rust-toolchain@v1
35+
- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
3636
with:
3737
toolchain: ${{ env.RUST_TOOLCHAIN }}
38-
- uses: taiki-e/install-action@cargo-hack
38+
- uses: taiki-e/install-action@7bc99eee1f1b8902a125006cf790a1f4c8461e63 # v2.69.8
39+
with:
40+
tool: cargo-hack
3941
- name: check MSRV
4042
run: |
4143
cargo hack check --rust-version --workspace --all-targets --all-features --ignore-private

‎.github/workflows/rust-x-build.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,12 +47,12 @@ jobs:
4747
target: aarch64-apple-darwin
4848

4949
steps:
50-
- uses: actions/checkout@v6
50+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5151
with:
5252
submodules: "recursive"
5353

5454
- name: Install Rust
55-
uses: actions-rust-lang/setup-rust-toolchain@v1
55+
uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
5656
with:
5757
toolchain: ${{ env.RUST_TOOLCHAIN }}
5858
target: "${{ matrix.target }}"

0 commit comments

Comments
 (0)