chore: Pin github actions. (#500)

kinyoklion · web-flow · commit 5b8bbee10d89 · 2025-11-12T14:44:39.000-08:00
> [!NOTE] > Pins CI actions to specific SHAs across all workflows and adds `apt-get install libcurl4-openssl-dev` to the Ubuntu curl job. > > - **CI/CD workflows**: > - Pin actions to commit SHAs across workflows in `.github/workflows/*`: > - `actions/checkout`, `launchdarkly/gh-actions/actions/contract-tests`, `ilammy/msvc-dev-cmd`, `MarkusJx/install-boost`, `cpp-linter/cpp-linter-action`, `googleapis/release-please-action`, and reusable `launchdarkly/gh-actions/.github/workflows/lint-pr-title.yml`. > - `cmake.yml` (Ubuntu curl job): add explicit installation of `libcurl4-openssl-dev` via `apt-get`. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 7aab6d9. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
diff --git a/.github/workflows/client.yml b/.github/workflows/client.yml
@@ -21,14 +21,16 @@ jobs:
       TEST_SERVICE_PORT: 8123
       TEST_SERVICE_BINARY: ./build/contract-tests/client-contract-tests/client-tests
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: client-tests
           run_tests: false
       - name: 'Launch test service as background task'
         run: $TEST_SERVICE_BINARY $TEST_SERVICE_PORT 2>&1 &
-      - uses: launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.1.0
+      # https://github.com/launchdarkly/gh-actions/releases/tag/contract-tests-v1.1.0
+      - uses: launchdarkly/gh-actions/actions/contract-tests@2715574e04448246bc529a23a81766491bbc4aae
         with:
           # Inform the test harness of test service's port.
           test_service_port: ${{ env.TEST_SERVICE_PORT }}
@@ -41,23 +43,26 @@ jobs:
       TEST_SERVICE_PORT: 8123
       TEST_SERVICE_BINARY: ./build/contract-tests/client-contract-tests/client-tests
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: client-tests
           run_tests: false
           use_curl: true
       - name: 'Launch test service as background task'
         run: $TEST_SERVICE_BINARY $TEST_SERVICE_PORT 2>&1 &
-      - uses: launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.1.0
+      # https://github.com/launchdarkly/gh-actions/releases/tag/contract-tests-v1.1.0
+      - uses: launchdarkly/gh-actions/actions/contract-tests@2715574e04448246bc529a23a81766491bbc4aae
         with:
           # Inform the test harness of test service's port.
           test_service_port: ${{ env.TEST_SERVICE_PORT }}
           token: ${{ secrets.GITHUB_TOKEN }}
   build-test:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-client
@@ -66,7 +71,8 @@ jobs:
   build-test-curl:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-client
@@ -76,7 +82,8 @@ jobs:
   build-test-client-mac:
     runs-on: macos-13
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-client
@@ -86,7 +93,8 @@ jobs:
   build-test-client-mac-curl:
     runs-on: macos-13
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-client
@@ -97,8 +105,10 @@ jobs:
   build-test-client-windows:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - uses: ./.github/actions/ci
         env:
           BOOST_LIBRARY_DIR: 'C:\local\boost_1_87_0\lib64-msvc-14.3'
@@ -113,8 +123,10 @@ jobs:
   build-test-client-windows-curl:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - uses: ./.github/actions/ci
         env:
           BOOST_LIBRARY_DIR: 'C:\local\boost_1_87_0\lib64-msvc-14.3'
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
@@ -17,17 +17,20 @@ jobs:
   test-ubuntu:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/cmake-test
         with:
           platform_version: '22.04'
 
   test-ubuntu-curl:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/install-curl
         id: install-curl
+        run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev
       - uses: ./.github/actions/cmake-test
         env:
           CURL_ROOT: ${{ steps.install-curl.outputs.CURL_ROOT }}
@@ -39,15 +42,17 @@ jobs:
   test-macos:
     runs-on: macos-13
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/cmake-test
         with:
           platform_version: '12'
 
   test-macos-curl:
     runs-on: macos-13
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/install-curl
         id: install-curl
       - uses: ./.github/actions/cmake-test
@@ -61,8 +66,10 @@ jobs:
   test-windows:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - uses: ./.github/actions/cmake-test
         env:
           Boost_DIR: 'C:\local\boost_1_87_0\lib64-msvc-14.3\cmake\Boost-1.87.0'
@@ -73,8 +80,10 @@ jobs:
   test-windows-curl:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - uses: ./.github/actions/install-curl
         id: install-curl
       - uses: ./.github/actions/cmake-test
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
@@ -14,7 +14,8 @@ jobs:
   build-test-common:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-common
diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml
@@ -13,9 +13,11 @@ jobs:
   cpp-linter:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - name: Install boost
-        uses: MarkusJx/install-boost@v2.4.4
+        # https://github.com/MarkusJx/install-boost/releases/tag/v2.4.4
+        uses: MarkusJx/install-boost@3039450bb3dd2e8630d1cf10ec39cb1da3054bbd
         id: install-boost
         with:
           boost_version: 1.81.0
@@ -25,7 +27,8 @@ jobs:
         env:
           BOOST_ROOT: ${{ steps.install-boost.outputs.BOOST_ROOT }}
         run: cmake -S . -B /home/runner/build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-      - uses: cpp-linter/cpp-linter-action@v2.4.2
+      # https://github.com/cpp-linter/cpp-linter-action/releases/tag/v2.4.2
+      - uses: cpp-linter/cpp-linter-action@e84192cfd882b66bc5b84d5d6f80fe7802161f34
         id: linter
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/hello-apps.yml b/.github/workflows/hello-apps.yml
@@ -19,8 +19,10 @@ jobs:
       fail-fast: false
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - name: Install Ninja
         uses: ./.github/actions/install-ninja
       - name: Install boost
diff --git a/.github/workflows/internal.yml b/.github/workflows/internal.yml
@@ -14,7 +14,8 @@ jobs:
   build-test-internal:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-internal
diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml
@@ -9,4 +9,5 @@ on:
 
 jobs:
   lint-pr-title:
-    uses: launchdarkly/gh-actions/.github/workflows/lint-pr-title.yml@main
+    # https://github.com/launchdarkly/gh-actions/commit/f1760cc538c362c2ab826a3bd22611743ef8f82c
+    uses: launchdarkly/gh-actions/.github/workflows/lint-pr-title.yml@f1760cc538c362c2ab826a3bd22611743ef8f82c
diff --git a/.github/workflows/manual-publish-doc.yml b/.github/workflows/manual-publish-doc.yml
@@ -16,7 +16,8 @@ jobs:
   build-publish:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - run: sudo apt-get install doxygen graphviz
       - id: build
         # Build using the same steps from CI.
diff --git a/.github/workflows/manual-sdk-release-artifacts.yml b/.github/workflows/manual-sdk-release-artifacts.yml
@@ -45,7 +45,8 @@ jobs:
       hashes-windows: ${{ steps.release-sdk.outputs.hashes-windows }}
       hashes-macos: ${{ steps.release-sdk.outputs.hashes-macos }}
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
         with:
           ref: ${{ inputs.tag }}
       - id: release-sdk
diff --git a/.github/workflows/networking.yml b/.github/workflows/networking.yml
@@ -14,7 +14,8 @@ jobs:
   build-test-networking:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-networking
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -17,7 +17,8 @@ jobs:
       package-server-otel-released: ${{ steps.release.outputs['libs/server-sdk-otel--release_created'] }}
       package-server-otel-tag: ${{ steps.release.outputs['libs/server-sdk-otel--tag_name'] }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      # https://github.com/googleapis/release-please-action/releases/tag/v4.3.0
+      - uses: googleapis/release-please-action@c2a5a2bd6a758a0937f1ddb1e8950609867ed15c
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -35,7 +36,8 @@ jobs:
       hashes-windows: ${{ steps.release-client.outputs.hashes-windows }}
       hashes-macos: ${{ steps.release-client.outputs.hashes-macos }}
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - id: release-client
         name: Full release of libs/client-sdk
         uses: ./.github/actions/sdk-release
@@ -59,7 +61,8 @@ jobs:
       hashes-windows: ${{ steps.release-server.outputs.hashes-windows }}
       hashes-macos: ${{ steps.release-server.outputs.hashes-macos }}
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - id: release-server
         name: Full release of libs/server-sdk
         uses: ./.github/actions/sdk-release
@@ -83,7 +86,8 @@ jobs:
       hashes-windows: ${{ steps.release-server-redis.outputs.hashes-windows }}
       hashes-macos: ${{ steps.release-server-redis.outputs.hashes-macos }}
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - id: release-server-redis
         name: Full release of libs/server-sdk-redis-source
         uses: ./.github/actions/sdk-release
diff --git a/.github/workflows/server-otel.yml b/.github/workflows/server-otel.yml
@@ -17,7 +17,8 @@ jobs:
   build-test-otel:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-server-otel
@@ -27,7 +28,8 @@ jobs:
   build-otel-mac:
     runs-on: macos-13
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-server-otel
@@ -38,8 +40,10 @@ jobs:
   build-test-otel-windows:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - uses: ./.github/actions/ci
         env:
           BOOST_LIBRARY_DIR: 'C:\local\boost_1_87_0\lib64-msvc-14.3'
diff --git a/.github/workflows/server-redis.yml b/.github/workflows/server-redis.yml
@@ -22,15 +22,17 @@ jobs:
         ports:
           - 6379:6379
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-server-redis-source
           simulate_release: true
   build-redis-mac:
     runs-on: macos-13
     steps:
-      - uses: actions/checkout@v4
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - uses: ./.github/actions/ci
         with:
           cmake_target: launchdarkly-cpp-server-redis-source
@@ -40,8 +42,10 @@ jobs:
   build-test-redis-windows:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      # https://github.com/ilammy/msvc-dev-cmd/releases/tag/v1.13.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       - uses: ./.github/actions/ci
         env:
           BOOST_LIBRARY_DIR: 'C:\local\boost_1_87_0\lib64-msvc-14.3'
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
diff --git a/.github/workflows/sse.yml b/.github/workflows/sse.yml
