Skip to content

Commit a958d07

Browse files
mergify[bot]kruskall
mergify[bot]
and
kruskall
authored
[9.0](backport #16297) ci: pin actions to specific commits (#16298)
* ci: pin actions to specific commits (#16297) replace mutable tag with commit hash to improve security and reproducibility (cherry picked from commit 43108a0) # Conflicts: # .github/workflows/benchmarks.yml # .github/workflows/docs-build.yml # .github/workflows/docs-cleanup.yml * Update benchmarks.yml * ci: fix conflicts * ci: pin more actions --------- Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
1 parent 8e9db98 commit a958d07

25 files changed

+100
-100
lines changed

‎.github/workflows/add-to-docs-project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
"organization_projects": "write",
2323
"issues": "read"
2424
}
25-
- uses: octokit/graphql-action@v2.x
25+
- uses: octokit/graphql-action@51bf543c240dcd14761320e2efc625dc32ec0d32 # v2.x
2626
id: add_to_project
2727
with:
2828
query: |

‎.github/workflows/add-to-project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
"organization_projects": "write",
2626
"issues": "read"
2727
}
28-
- uses: actions/add-to-project@v1.0.2
28+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
2929
with:
3030
project-url: https://github.com/orgs/elastic/projects/1286
3131
github-token: ${{ steps.get_token.outputs.token }}

‎.github/workflows/benchmarks.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,13 @@ jobs:
8080
GOBENCH_USERNAME: ${{ secrets.GOBENCH_USERNAME }}
8181
GOBENCH_HOST: ${{ secrets.GOBENCH_HOST }}
8282
steps:
83-
- uses: actions/checkout@v4
83+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
8484

85-
- uses: actions/setup-go@v5
85+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
8686
with:
8787
go-version-file: 'go.mod'
8888

89-
- uses: rlespinasse/github-slug-action@aba9f8db6ef36e0733227a62673d6592b1f430ea
89+
- uses: rlespinasse/github-slug-action@955b5ba4560860f8a633bd24190941f16016e42c # v5.1.0
9090

9191
- name: Set up env
9292
run: |
@@ -115,9 +115,9 @@ jobs:
115115
username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
116116
password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
117117

118-
- uses: elastic/oblt-actions/google/auth@v1
118+
- uses: elastic/oblt-actions/google/auth@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
119119

120-
- uses: elastic/oblt-actions/aws/auth@v1
120+
- uses: elastic/oblt-actions/aws/auth@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
121121
with:
122122
role-duration-seconds: 21600 # 6 hours
123123

@@ -127,7 +127,7 @@ jobs:
127127
secrets: |-
128128
EC_API_KEY:elastic-observability/elastic-cloud-observability-team-pro-api-key
129129
130-
- uses: hashicorp/setup-terraform@v3
130+
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
131131
with:
132132
terraform_version: ~1.10.0
133133
terraform_wrapper: false
@@ -180,7 +180,7 @@ jobs:
180180
$PNG_REPORT_FILE
181181
182182
- name: Upload PNG
183-
uses: actions/upload-artifact@v4
183+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
184184
with:
185185
name: kibana-png-report
186186
path: ${{ env.WORKING_DIRECTORY }}/${{ env.PNG_REPORT_FILE }}
@@ -196,7 +196,7 @@ jobs:
196196
echo "png_report_url=https://elastic-apm-server-benchmark-reports.s3.amazonaws.com/${DEST_NAME}" >> "$GITHUB_OUTPUT"
197197
198198
- name: Upload benchmark result
199-
uses: actions/upload-artifact@v4
199+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
200200
with:
201201
name: benchmark-result
202202
path: ${{ env.WORKING_DIRECTORY }}/${{ env.BENCHMARK_RESULT }}
@@ -210,7 +210,7 @@ jobs:
210210
run: make cp-cpuprof
211211

212212
- name: Upload CPU profile
213-
uses: actions/upload-artifact@v4
213+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
214214
with:
215215
name: cpu-profile
216216
path: ${{ env.WORKING_DIRECTORY }}/${{ env.BENCHMARK_CPU_OUT }}
@@ -232,7 +232,7 @@ jobs:
232232
# GitHub bot won't trigger any CI builds.
233233
# See https://github.com/peter-evans/create-pull-request/issues/48#issuecomment-537478081
234234
- name: Configure git user
235-
uses: elastic/oblt-actions/git/setup@v1
235+
uses: elastic/oblt-actions/git/setup@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
236236
with:
237237
github-token: ${{ steps.get_token.outputs.token }}
238238

@@ -270,7 +270,7 @@ jobs:
270270

271271
# Notify failure to Slack only on schedule (nightly run)
272272
- if: failure() && github.event_name == 'schedule'
273-
uses: elastic/oblt-actions/slack/notify-result@v1
273+
uses: elastic/oblt-actions/slack/notify-result@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
274274
with:
275275
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
276276
channel-id: "#apm-server"

‎.github/workflows/bump-elastic-stack.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
matrix: ${{ steps.generator.outputs.matrix }}
1818
steps:
1919
- id: generator
20-
uses: elastic/oblt-actions/elastic/active-branches@v1
20+
uses: elastic/oblt-actions/elastic/active-branches@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2121

2222
bump-elastic-stack:
2323
runs-on: ubuntu-latest
@@ -26,7 +26,7 @@ jobs:
2626
fail-fast: false
2727
matrix: ${{ fromJson(needs.filter.outputs.matrix) }}
2828
steps:
29-
- uses: actions/checkout@v4
29+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3030
with:
3131
ref: ${{ matrix.branch }}
3232

@@ -42,15 +42,15 @@ jobs:
4242
"pull_requests": "write"
4343
}
4444
45-
- uses: elastic/oblt-actions/updatecli/run@v1
45+
- uses: elastic/oblt-actions/updatecli/run@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
4646
with:
4747
command: --experimental apply --config .ci/updatecli/bump-elastic-stack-snapshot.yml --values .ci/updatecli/values.d/scm.yml
4848
env:
4949
BRANCH: ${{ matrix.branch }}
5050
GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
5151

5252
- if: ${{ failure() }}
53-
uses: elastic/oblt-actions/slack/send@v1
53+
uses: elastic/oblt-actions/slack/send@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
5454
with:
5555
channel-id: '#apm-server'
5656
message: ":traffic_cone: updatecli failed for `${{ github.repository }}@${{ github.ref_name }}`, @robots-ci please look what's going on <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|here>"

‎.github/workflows/bump-golang.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
steps:
2020
- id: generate
2121
name: Generate matrix
22-
uses: elastic/oblt-actions/elastic/active-branches@v1
22+
uses: elastic/oblt-actions/elastic/active-branches@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2323
with:
2424
exclude-branches: '7.17,main'
25-
- uses: actions/github-script@v7
25+
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
2626
id: labels
2727
env:
2828
BRANCHES: ${{ steps.generate.outputs.branches }}
@@ -39,7 +39,7 @@ jobs:
3939
needs: [labels]
4040
steps:
4141

42-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4343

4444
- name: Get token
4545
id: get_token
@@ -53,7 +53,7 @@ jobs:
5353
"pull_requests": "write"
5454
}
5555
56-
- uses: elastic/oblt-actions/updatecli/run@v1
56+
- uses: elastic/oblt-actions/updatecli/run@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
5757
with:
5858
command: --experimental apply --config .ci/updatecli/bump-golang.yml --values .ci/updatecli/values.d/scm.yml
5959
env:
@@ -64,11 +64,11 @@ jobs:
6464
bump-7:
6565
runs-on: ubuntu-latest
6666
steps:
67-
- uses: actions/checkout@v4
67+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
6868
with:
6969
ref: '7.17'
7070

71-
- uses: elastic/oblt-actions/updatecli/run@v1
71+
- uses: elastic/oblt-actions/updatecli/run@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
7272
with:
7373
command: --experimental apply --config .ci/updatecli/bump-golang.yml --values .ci/updatecli/values.d/scm.yml
7474
env:
@@ -82,11 +82,11 @@ jobs:
8282
if: always()
8383
steps:
8484
- id: check
85-
uses: elastic/oblt-actions/check-dependent-jobs@v1
85+
uses: elastic/oblt-actions/check-dependent-jobs@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
8686
with:
8787
jobs: ${{ toJSON(needs) }}
8888
- if: ${{ steps.check.outputs.isSuccess == 'false' }}
89-
uses: elastic/oblt-actions/slack/send@v1
89+
uses: elastic/oblt-actions/slack/send@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
9090
with:
9191
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
9292
channel-id: "#apm-server"

‎.github/workflows/check-docker-compose.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
matrix: ${{ steps.generator.outputs.matrix }}
1818
steps:
1919
- id: generator
20-
uses: elastic/oblt-actions/elastic/active-branches@v1
20+
uses: elastic/oblt-actions/elastic/active-branches@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2121

2222
check-docker-compose:
2323
needs:
@@ -27,10 +27,10 @@ jobs:
2727
fail-fast: false
2828
matrix: ${{ fromJson(needs.filter.outputs.matrix) }}
2929
steps:
30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3131
with:
3232
ref: ${{ matrix.branch }}
33-
- uses: actions/setup-go@v5
33+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
3434
with:
3535
go-version-file: go.mod
3636
cache: false
@@ -44,12 +44,12 @@ jobs:
4444
- check-docker-compose
4545
steps:
4646
- id: check
47-
uses: elastic/oblt-actions/check-dependent-jobs@v1
47+
uses: elastic/oblt-actions/check-dependent-jobs@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
4848
with:
4949
jobs: ${{ toJSON(needs) }}
5050
- run: ${{ steps.check.outputs.isSuccess }}
5151
- if: failure()
52-
uses: elastic/oblt-actions/slack/notify-result@v1
52+
uses: elastic/oblt-actions/slack/notify-result@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
5353
with:
5454
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
5555
channel-id: "#apm-server"

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ jobs:
2828
lint:
2929
runs-on: ubuntu-latest
3030
steps:
31-
- uses: actions/checkout@v4
32-
- uses: actions/setup-go@v5
31+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
32+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
3333
with:
3434
go-version-file: go.mod
3535
cache: true
@@ -43,13 +43,13 @@ jobs:
4343
os: ['macos-latest', 'ubuntu-latest', 'windows-latest']
4444
runs-on: ${{ matrix.os }}
4545
steps:
46-
- uses: actions/checkout@v4
47-
- uses: antontroshin/setup-go@bda02de8887c9946189f81e7e59512914aeb9ea4
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
47+
- uses: antontroshin/setup-go@bda02de8887c9946189f81e7e59512914aeb9ea4 # bda02de8887c9946189f81e7e59512914aeb9ea4
4848
if: runner.os == 'Windows'
4949
with:
5050
go-version-file: go.mod
5151
cache: true
52-
- uses: actions/setup-go@v5
52+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
5353
if: runner.os != 'Windows'
5454
with:
5555
go-version-file: go.mod
@@ -61,8 +61,8 @@ jobs:
6161
test-fips:
6262
runs-on: ubuntu-latest
6363
steps:
64-
- uses: actions/checkout@v4
65-
- uses: actions/setup-go@v5
64+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
65+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
6666
with:
6767
go-version-file: go.mod
6868
cache: true
@@ -75,8 +75,8 @@ jobs:
7575
system-test:
7676
runs-on: ubuntu-latest
7777
steps:
78-
- uses: actions/checkout@v4
79-
- uses: actions/setup-go@v5
78+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
79+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
8080
with:
8181
go-version-file: systemtest/go.mod
8282
cache: true
@@ -92,8 +92,8 @@ jobs:
9292
test-package:
9393
runs-on: ubuntu-latest
9494
steps:
95-
- uses: actions/checkout@v4
96-
- uses: actions/setup-go@v5
95+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
96+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
9797
with:
9898
go-version-file: go.mod
9999
cache: false
@@ -110,8 +110,8 @@ jobs:
110110
env:
111111
GENERATE_WOLFI_IMAGES: true
112112
steps:
113-
- uses: actions/checkout@v4
114-
- uses: actions/setup-go@v5
113+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
114+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
115115
with:
116116
go-version-file: go.mod
117117
cache: false

‎.github/workflows/comment-on-asciidoc-changes.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@ jobs:
1616
permissions:
1717
contents: read
1818
pull-requests: write
19-
uses: elastic/docs-builder/.github/workflows/comment-on-asciidoc-changes.yml@main
19+
uses: elastic/docs-builder/.github/workflows/comment-on-asciidoc-changes.yml@d20bc8650b8ea27a58ee6d17ed963659e878f993 # main

‎.github/workflows/functional-tests.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,17 +27,17 @@ jobs:
2727
- 'qa'
2828
- 'pro'
2929
steps:
30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3131

3232
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
3333
with:
3434
terraform_version: "${{ env.TERRAFORM_VERSION }}"
3535

36-
- uses: actions/setup-go@v5
36+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
3737
with:
3838
go-version-file: 'functionaltests/go.mod'
3939

40-
- uses: elastic/oblt-actions/google/auth@v1
40+
- uses: elastic/oblt-actions/google/auth@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
4141

4242
- uses: google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce # v2.2.2
4343
with:
@@ -56,10 +56,10 @@ jobs:
5656
- run
5757
steps:
5858
- id: check
59-
uses: elastic/oblt-actions/check-dependent-jobs@v1
59+
uses: elastic/oblt-actions/check-dependent-jobs@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
6060
with:
6161
jobs: ${{ toJSON(needs) }}
62-
- uses: elastic/oblt-actions/slack/notify-result@v1
62+
- uses: elastic/oblt-actions/slack/notify-result@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
6363
with:
6464
bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
6565
channel-id: "#apm-server"

‎.github/workflows/mergify-labels-copier.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ jobs:
1818
# See https://github.com/cli/cli/issues/6274
1919
repository-projects: read
2020
steps:
21-
- uses: elastic/oblt-actions/mergify/labels-copier@v1
21+
- uses: elastic/oblt-actions/mergify/labels-copier@31e93d1dfb82adc106fc7820f505db1afefe43b1 # v1
2222
with:
2323
excluded-labels-regex: "^backport-*"

0 commit comments

Comments
 (0)