Skip to content

Commit c8a5aa4

Browse files
ewaostrowskaewaostrowska
authored
chore: improve workflow security (#516)
1 parent 2dca7a9 commit c8a5aa4

6 files changed

Lines changed: 19 additions & 25 deletions

File tree

‎.github/workflows/next-snapshot-v1.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
run: |
6868
. ./CI/post-nextsnap-v1.sh
6969
- name: Create Next Snapshot Pull Request
70-
uses: peter-evans/create-pull-request@v8
70+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
7171
if: env.RELEASE_OK == 'yes'
7272
with:
7373
token: ${{ steps.generate-token.outputs.token }}
@@ -76,11 +76,10 @@ jobs:
7676
branch: bump-snap-${{ env.SC_NEXT_VERSION }}-SNAPSHOT
7777

7878
env:
79-
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
8079
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
8180
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
8281
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83-
SC_VERSION:
84-
SC_NEXT_VERSION:
82+
SC_VERSION: ""
83+
SC_NEXT_VERSION: ""
8584
GPG_PRIVATE_KEY: ${{ secrets.OSSRH_GPG_PRIVATE_KEY }}
8685
GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_PRIVATE_PASSPHRASE }}

‎.github/workflows/next-snapshot.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
run: |
6868
. ./CI/post-nextsnap.sh
6969
- name: Create Next Snapshot Pull Request
70-
uses: peter-evans/create-pull-request@v8
70+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
7171
if: env.RELEASE_OK == 'yes'
7272
with:
7373
token: ${{ steps.generate-token.outputs.token }}
@@ -76,11 +76,10 @@ jobs:
7676
branch: bump-snap-${{ env.SC_NEXT_VERSION }}-SNAPSHOT
7777

7878
env:
79-
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
8079
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
8180
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
8281
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83-
SC_VERSION:
84-
SC_NEXT_VERSION:
82+
SC_VERSION: ""
83+
SC_NEXT_VERSION: ""
8584
GPG_PRIVATE_KEY: ${{ secrets.OSSRH_GPG_PRIVATE_KEY }}
8685
GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_PRIVATE_PASSPHRASE }}

‎.github/workflows/prepare-release-v1.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,17 +49,16 @@ jobs:
4949
echo "SC_VERSION=$SC_VERSION" >> $GITHUB_ENV
5050
echo "SC_NEXT_VERSION=$SC_NEXT_VERSION" >> $GITHUB_ENV
5151
- name: Create Prepare Release Pull Request
52-
uses: peter-evans/create-pull-request@v8
52+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
5353
if: env.PREPARE_RELEASE_OK == 'yes'
5454
with:
5555
token: ${{ steps.generate-token.outputs.token }}
5656
commit-message: prepare release ${{ env.SC_VERSION }}
5757
title: 'prepare release ${{ env.SC_VERSION }}'
5858
branch: prepare-release-${{ env.SC_VERSION }}
5959
env:
60-
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
6160
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
6261
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
6362
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64-
SC_VERSION:
65-
SC_NEXT_VERSION:
63+
SC_VERSION: ""
64+
SC_NEXT_VERSION: ""

‎.github/workflows/prepare-release.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,17 +49,16 @@ jobs:
4949
echo "SC_VERSION=$SC_VERSION" >> $GITHUB_ENV
5050
echo "SC_NEXT_VERSION=$SC_NEXT_VERSION" >> $GITHUB_ENV
5151
- name: Create Prepare Release Pull Request
52-
uses: peter-evans/create-pull-request@v8
52+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
5353
if: env.PREPARE_RELEASE_OK == 'yes'
5454
with:
5555
token: ${{ steps.generate-token.outputs.token }}
5656
commit-message: prepare release ${{ env.SC_VERSION }}
5757
title: 'prepare release ${{ env.SC_VERSION }}'
5858
branch: prepare-release-${{ env.SC_VERSION }}
5959
env:
60-
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
6160
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
6261
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
6362
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64-
SC_VERSION:
65-
SC_NEXT_VERSION:
63+
SC_VERSION: ""
64+
SC_NEXT_VERSION: ""

‎.github/workflows/release-v1.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
git config --global hub.protocol https
5858
git remote set-url origin https://\${{ secrets.GITHUB_TOKEN }}:x-oauth-basic@github.com/swagger-api/swagger-inflector.git
5959
- name: Run maven deploy/release (action-maven-publish)
60-
uses: samuelmeuli/action-maven-publish@v1
60+
uses: samuelmeuli/action-maven-publish@201a45a3f311b2ee888f252ba9f4194257545709 # v1
6161
if: env.RELEASE_OK == 'yes'
6262
with:
6363
gpg_private_key: ${{ secrets.OSSRH_GPG_PRIVATE_KEY }}
@@ -71,7 +71,7 @@ jobs:
7171
run: |
7272
. ./CI/post-release-v1.sh
7373
- name: Create Next Snapshot Pull Request
74-
uses: peter-evans/create-pull-request@v8
74+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
7575
if: env.RELEASE_OK == 'yes'
7676
with:
7777
token: ${{ steps.generate-token.outputs.token }}
@@ -80,11 +80,10 @@ jobs:
8080
branch: bump-snap-${{ env.SC_NEXT_VERSION }}-SNAPSHOT
8181

8282
env:
83-
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
8483
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
8584
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
8685
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
87-
SC_VERSION:
88-
SC_NEXT_VERSION:
86+
SC_VERSION: ""
87+
SC_NEXT_VERSION: ""
8988
GPG_PRIVATE_KEY: ${{ secrets.OSSRH_GPG_PRIVATE_KEY }}
9089
GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_PRIVATE_PASSPHRASE }}

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
run: |
7474
. ./CI/post-release.sh
7575
- name: Create Next Snapshot Pull Request
76-
uses: peter-evans/create-pull-request@v8
76+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
7777
if: env.RELEASE_OK == 'yes'
7878
with:
7979
token: ${{ steps.generate-token.outputs.token }}
@@ -82,11 +82,10 @@ jobs:
8282
branch: bump-snap-${{ env.SC_NEXT_VERSION }}-SNAPSHOT
8383

8484
env:
85-
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
8685
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
8786
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
8887
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
89-
SC_VERSION:
90-
SC_NEXT_VERSION:
88+
SC_VERSION: ""
89+
SC_NEXT_VERSION: ""
9190
GPG_PRIVATE_KEY: ${{ secrets.OSSRH_GPG_PRIVATE_KEY }}
9291
GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_PRIVATE_PASSPHRASE }}

0 commit comments

Comments
 (0)