This repository was archived by the owner on Jan 12, 2026. It is now read-only.

Pin github workflows to a commit hash instead of version tag for security purpose #1

	name: Build library

	on: { pull_request: {} }

	concurrency:
	group: build-library-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	build-library:
	name: 👷‍♀️ Build library
	runs-on: ubuntu-latest
	container: golang:1.21-alpine
	steps:
	- name: Install build dependencies
	run: apk add --no-cache alpine-sdk git bash npm python3 py3-pip

	- name: Install yarn
	run: npm install --global yarn

	- name: Setup Dotnet
	uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
	with: { dotnet-version: 6 }

	- name: Check out repository code
	uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # main
	with: { fetch-depth: 0 }

	- name: Treat repo as safe
	run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift

	- name: Install pulumictl
	uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
	with:
	repo: pulumi/pulumictl
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Install pulumi
	uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4

	- name: Tag version
	run: \|
	CURRENTTAG=$(git describe --tags --abbrev=0)
	git tag $CURRENTTAG${{ github.run_number }}

	- name: Print version
	run: pulumictl get version

	- name: Build SDKs
	run: make build_sdks
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Check if sdk is up to date
	run: git diff --exit-code ./

Provide feedback