From a39a65296bf297a64c400daf62499dfc7a8ec68d Mon Sep 17 00:00:00 2001 From: Svein-Petter Johnsen <83902071+sveinpj@users.noreply.github.com> Date: Thu, 26 Mar 2026 12:51:07 +0100 Subject: [PATCH 1/3] Update actions/checkout to v6 and reusable workflows to v1.1.0 --- .github/workflows/create-releases.yml | 4 ++-- .github/workflows/pr.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index d3e6fe5..73d818f 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -11,7 +11,7 @@ jobs: permissions: pull-requests: read contents: read - uses: equinor/radix-reusable-workflows/.github/workflows/template-unreleased-pr-metadata.yml@v1.0.2 + uses: equinor/radix-reusable-workflows/.github/workflows/template-unreleased-pr-metadata.yml@v1.1.0 release-pull-request: name: Release pull request @@ -25,7 +25,7 @@ jobs: pull-requests: write contents: read issues: write - uses: equinor/radix-reusable-workflows/.github/workflows/template-create-release-from-pr.yml@v1.0.2 + uses: equinor/radix-reusable-workflows/.github/workflows/template-create-release-from-pr.yml@v1.1.0 with: pull-request-number: ${{ matrix.pull-request-number }} use-github-app-token: true diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 82442f4..20786a1 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -10,7 +10,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Set up Go uses: actions/setup-go@v5 @@ -26,7 +26,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: fetch-depth: 2 - uses: actions/setup-go@v5 From 1c062d2dd41c116e8ba0ce496fd5493a79b6ba2d Mon Sep 17 00:00:00 2001 From: Richard Hagen Date: Tue, 31 Mar 2026 14:06:27 +0200 Subject: [PATCH 2/3] chore: harden github actions with actions-hardify Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/create-releases.yml | 1 + .github/workflows/pr.yaml | 11 ++++++----- .github/workflows/prepare-release-pr.yml | 1 + 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index 73d818f..e6c1fa5 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -5,6 +5,7 @@ on: - main workflow_dispatch: +permissions: {} jobs: unreleased-prs-metadata: name: Get list of pending release pull requests diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 20786a1..ee93fb5 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -4,16 +4,17 @@ on: pull_request: branches: [ main ] +permissions: {} jobs: test: runs-on: ubuntu-latest permissions: contents: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: 'go.mod' @@ -26,13 +27,13 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 2 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: 'go.mod' - name: golangci-lint - uses: golangci/golangci-lint-action@v8 + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: version: v2.7.2 diff --git a/.github/workflows/prepare-release-pr.yml b/.github/workflows/prepare-release-pr.yml index 0e87dd5..9c6617e 100644 --- a/.github/workflows/prepare-release-pr.yml +++ b/.github/workflows/prepare-release-pr.yml @@ -7,6 +7,7 @@ on: - main workflow_dispatch: +permissions: {} concurrency: group: ${{ github.workflow }} From 01816d9be38de7cced1f10d8abb369741d471df1 Mon Sep 17 00:00:00 2001 From: Richard Hagen Date: Tue, 31 Mar 2026 15:16:21 +0200 Subject: [PATCH 3/3] chore: re-harden github actions with actions-hardify Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/create-releases.yml | 4 ++-- .github/workflows/prepare-release-pr.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml index e6c1fa5..8c380d9 100644 --- a/.github/workflows/create-releases.yml +++ b/.github/workflows/create-releases.yml @@ -12,7 +12,7 @@ jobs: permissions: pull-requests: read contents: read - uses: equinor/radix-reusable-workflows/.github/workflows/template-unreleased-pr-metadata.yml@v1.1.0 + uses: equinor/radix-reusable-workflows/.github/workflows/template-unreleased-pr-metadata.yml@bbbf79dd34776ca9e9a4dc4fcf6dc643953f37e8 # v1.1.0 release-pull-request: name: Release pull request @@ -26,7 +26,7 @@ jobs: pull-requests: write contents: read issues: write - uses: equinor/radix-reusable-workflows/.github/workflows/template-create-release-from-pr.yml@v1.1.0 + uses: equinor/radix-reusable-workflows/.github/workflows/template-create-release-from-pr.yml@bbbf79dd34776ca9e9a4dc4fcf6dc643953f37e8 # v1.1.0 with: pull-request-number: ${{ matrix.pull-request-number }} use-github-app-token: true diff --git a/.github/workflows/prepare-release-pr.yml b/.github/workflows/prepare-release-pr.yml index 9c6617e..1b7a8b9 100644 --- a/.github/workflows/prepare-release-pr.yml +++ b/.github/workflows/prepare-release-pr.yml @@ -14,7 +14,7 @@ concurrency: jobs: prepare-release-pr: name: Prepare release pull request - uses: equinor/radix-reusable-workflows/.github/workflows/template-prepare-release-pr.yml@v1.0.2 + uses: equinor/radix-reusable-workflows/.github/workflows/template-prepare-release-pr.yml@bbbf79dd34776ca9e9a4dc4fcf6dc643953f37e8 # v1.1.0 permissions: contents: write pull-requests: write