Skip to content
This repository was archived by the owner on Jan 12, 2026. It is now read-only.

Commit 5e0cb58

Browse files
jkim-notionjkim-notion
committed
Pin github workflows to a commit hash instead of version tag for security purpose
1 parent e8289e9 commit 5e0cb58

6 files changed

Lines changed: 27 additions & 27 deletions

File tree

‎.github/workflows/build-library.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,25 +19,25 @@ jobs:
1919
run: npm install --global yarn
2020

2121
- name: Setup Dotnet
22-
uses: actions/setup-dotnet@v3
22+
uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
2323
with: { dotnet-version: 6 }
2424

2525
- name: Check out repository code
26-
uses: actions/checkout@main
26+
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # main
2727
with: { fetch-depth: 0 }
2828

2929
- name: Treat repo as safe
3030
run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift
3131

3232
- name: Install pulumictl
33-
uses: jaxxstorm/action-install-gh-release@v1
33+
uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
3434
with:
3535
repo: pulumi/pulumictl
3636
env:
3737
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3838

3939
- name: Install pulumi
40-
uses: pulumi/actions@v4
40+
uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4
4141

4242
- name: Tag version
4343
run: |

‎.github/workflows/build-provider.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,21 @@ jobs:
1616
run: apk add --no-cache alpine-sdk git bash
1717

1818
- name: Check out repository code
19-
uses: actions/checkout@main
19+
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # main
2020
with: { fetch-depth: 0 }
2121

2222
- name: Treat repo as safe
2323
run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift
2424

2525
- name: Install pulumictl
26-
uses: jaxxstorm/action-install-gh-release@v1
26+
uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
2727
with:
2828
repo: pulumi/pulumictl
2929
env:
3030
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3131

3232
- name: Install pulumi
33-
uses: pulumi/actions@v4
33+
uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4
3434

3535
- name: Tag version
3636
run: |

‎.github/workflows/library-deployment.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,28 +18,28 @@ jobs:
1818
run: sudo apt update && sudo apt install -y bash
1919

2020
- name: Check out repository code
21-
uses: actions/checkout@main
21+
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # main
2222

2323
- name: Treat repo as safe
2424
run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift
2525

2626
- name: Install Go
27-
uses: actions/setup-go@v4
27+
uses: actions/setup-go@19bb51245e9c80abacb2e91cc42b33fa478b8639 # v4
2828
with:
2929
go-version: 1.21.x
3030

3131
- name: Install pulumictl
32-
uses: jaxxstorm/action-install-gh-release@v1
32+
uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
3333
with:
3434
repo: pulumi/pulumictl
3535
env:
3636
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3737

3838
- name: Install pulumi
39-
uses: pulumi/actions@v4
39+
uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4
4040

4141
- name: Setup Node
42-
uses: actions/setup-node@v4
42+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
4343
with:
4444
node-version: 16.x
4545
registry-url: https://registry.npmjs.org
@@ -48,15 +48,15 @@ jobs:
4848
run: npm install --global yarn
4949

5050
- name: Setup DotNet
51-
uses: actions/setup-dotnet@v3
51+
uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
5252
with:
5353
dotnet-version: 6
5454

5555
- name: Setup DotNet ICU
5656
run: sudo apt-get update && sudo apt-get install -y icu-devtools
5757

5858
- name: Setup Python
59-
uses: actions/setup-python@v4
59+
uses: actions/setup-python@0ae58361cdfd39e2950bed97a1e26aa20c3d8955 # v4
6060
with:
6161
python-version: 3.9
6262

@@ -81,7 +81,7 @@ jobs:
8181
run: cd sdk/dotnet && dotnet nuget push ${{github.workspace}}/sdk/dotnet/bin/Debug/*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }} --source "github"
8282

8383
- name: Create release
84-
uses: ncipollo/release-action@v1
84+
uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1
8585
with:
8686
generateReleaseNotes: true
8787
skipIfReleaseExists: true

‎.github/workflows/preprod-deployment.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
run: apk add --no-cache alpine-sdk git aws-cli bash
1717

1818
- name: Check out repository code
19-
uses: actions/checkout@main
19+
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # main
2020

2121
- name: Treat repo as safe
2222
run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift
@@ -25,14 +25,14 @@ jobs:
2525
run: rm -rf /github/home/.pulumi
2626

2727
- name: Install pulumictl
28-
uses: jaxxstorm/action-install-gh-release@v1
28+
uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
2929
with:
3030
repo: pulumi/pulumictl
3131
env:
3232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3333

3434
- name: Install pulumi
35-
uses: pulumi/actions@v4
35+
uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4
3636

3737
- name: Tag version
3838
run: git tag -d `git tag | grep -E '.'` && git tag v0.0.0
@@ -63,7 +63,7 @@ jobs:
6363

6464
- name: Configure AWS credentials
6565
if: github.ref == 'refs/heads/future'
66-
uses: aws-actions/configure-aws-credentials@v4
66+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
6767
with:
6868
aws-region: ${{ secrets.PREPROD_AWS_REGION }}
6969
role-to-assume: ${{ secrets.PREPROD_AWS_ROLE_TO_ASSUME }}

‎.github/workflows/prod-deployment.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
run: apk add --no-cache alpine-sdk git aws-cli bash
1717

1818
- name: Check out repository code
19-
uses: actions/checkout@main
19+
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # main
2020

2121
- name: Treat repo as safe
2222
run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift
@@ -25,14 +25,14 @@ jobs:
2525
run: rm -rf /github/home/.pulumi
2626

2727
- name: Install pulumictl
28-
uses: jaxxstorm/action-install-gh-release@v1
28+
uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
2929
with:
3030
repo: pulumi/pulumictl
3131
env:
3232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3333

3434
- name: Install pulumi
35-
uses: pulumi/actions@v4
35+
uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4
3636

3737
- name: Tag version
3838
run: git tag -d `git tag | grep -E '.'` && git tag v0.0.0
@@ -62,7 +62,7 @@ jobs:
6262
run: mkdir -p upload/pulumi-plugins && mv package/*/*.tar.gz upload/pulumi-plugins/ && ls -la upload/pulumi-plugins/
6363

6464
- name: Configure AWS credentials
65-
uses: aws-actions/configure-aws-credentials@v4
65+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
6666
if: github.ref == 'refs/heads/main'
6767
with:
6868
aws-region: ${{ secrets.AWS_REGION }}

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
run: apk add --no-cache alpine-sdk git aws-cli bash
2222

2323
- name: Check out repository code
24-
uses: actions/checkout@v4
24+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
2525

2626
- name: Treat repo as safe
2727
run: git config --global --add safe.directory /__w/pulumi-spacelift/pulumi-spacelift
@@ -30,14 +30,14 @@ jobs:
3030
run: rm -rf /github/home/.pulumi
3131

3232
- name: Install pulumictl
33-
uses: jaxxstorm/action-install-gh-release@v1
33+
uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1
3434
with:
3535
repo: pulumi/pulumictl
3636
env:
3737
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3838

3939
- name: Install pulumi
40-
uses: pulumi/actions@v4
40+
uses: pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e # v4
4141

4242
- name: Print pulumictl version
4343
run: pulumictl get version
@@ -64,7 +64,7 @@ jobs:
6464
run: mkdir -p upload/pulumi-plugins && mv package/*/*.tar.gz upload/pulumi-plugins/ && ls -la upload/pulumi-plugins/
6565

6666
- name: Configure AWS credentials
67-
uses: aws-actions/configure-aws-credentials@v4
67+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
6868
with:
6969
aws-region: ${{ secrets.AWS_REGION }}
7070
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}

0 commit comments

Comments
 (0)