Skip to content

Commit 1eb045f

Browse files
alionazherdetskaalionazherdetska
authored
chore(workflow): reference GitHub Actions by hash instead of version (#5088)
## 📄 Description This PR updates all GitHub Actions references in workflows and custom actions to use commit hashes instead of version tags. **Changes** 1. Replaced version tags (e.g., @v4, @v7) with specific commit hashes in multiple workflows and action files. 2. Ensured that actions/checkout, actions/upload-artifact, actions/github-script, and other third-party actions reference their exact commit SHA. ## 📝 Checklist - ✅ My code follows the style guidelines of this project - 🛠️ I have performed a self-review of my own code - 📄 I have made corresponding changes to the documentation - ⚠️ My changes generate no new warnings or errors - 🧪 I have added tests that prove my fix is effective or that my feature works - ✔️ New and existing unit tests pass locally with my changes
1 parent 4323e3a commit 1eb045f

21 files changed

+58
-58
lines changed

‎.github/actions/artifact-download/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
using: composite
3333
steps:
3434
- name: Download artifact
35-
uses: dawidd6/action-download-artifact@v9
35+
uses: dawidd6/action-download-artifact@07ab29fd4a977ae4d2b275087cf67563dfdf0295
3636
with:
3737
name: ${{ inputs.name }}
3838
run_id: ${{ github.event.workflow_run.id }}

‎.github/actions/artifact-upload/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ runs:
3131
run: cd ${{ inputs.folder }} && zip artifacts.zip . -r
3232

3333
- name: Upload artifacts
34-
uses: actions/upload-artifact@v4
34+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
3535
with:
3636
name: ${{ inputs.name }}
3737
path: ${{ inputs.folder }}/artifacts.zip

‎.github/actions/preview/message/create/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ inputs:
1212
runs:
1313
using: composite
1414
steps:
15-
- uses: actions/github-script@v7
15+
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
1616
env:
1717
ISSUE_NUMBER: ${{ inputs.issue-number }}
1818
with:

‎.github/actions/preview/message/update/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ inputs:
1515
runs:
1616
using: composite
1717
steps:
18-
- uses: actions/github-script@v7
18+
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
1919
env:
2020
ISSUE_NUMBER: ${{ inputs.issue-number }}
2121
PREVIEW_URL: ${{ inputs.preview-url }}

‎.github/actions/setup-pnpm/action.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ runs:
3131
steps:
3232
- name: Detect wanted version
3333
id: wanted-versions
34-
uses: actions/github-script@v7
34+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
3535
with:
3636
script: |
3737
const fs = require('fs')
@@ -43,7 +43,7 @@ runs:
4343
}
4444
4545
- name: Install pnpm
46-
uses: pnpm/action-setup@v4
46+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
4747
with:
4848
# If input.pnpm_version is NOT defined,
4949
# the action automatically uses the "packageManager" field from the package.json file
@@ -53,7 +53,7 @@ runs:
5353
version: ${{ inputs.pnpm_version || null }}
5454

5555
- name: Install node
56-
uses: actions/setup-node@v4
56+
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
5757
with:
5858
node-version: ${{ inputs.node_version || fromJSON(steps.wanted-versions.outputs.result).node }}
5959
cache: ${{ inputs.use_cache == 'true' && 'pnpm' || '' }}

‎.github/workflows/build-documentation.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v4
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2727

2828
- name: Setup
2929
uses: ./.github/actions/setup-pnpm

‎.github/workflows/build-tokens.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
runs-on: ubuntu-latest
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@v4
14+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
1515

1616
- name: Setup
1717
uses: ./.github/actions/setup-pnpm

‎.github/workflows/create-token-pr.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Checkout
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2020
with:
2121
fetch-depth: 0
2222
token: ${{ secrets.SWISSPOSTDEVS_ACCESS_TOKEN }}

‎.github/workflows/deploy-demo.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
2222
steps:
2323
- name: Checkout
24-
uses: actions/checkout@v4
24+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2525
with:
2626
ref: ${{ github.event.workflow_run.head_branch }}
2727

‎.github/workflows/deploy-documentation.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' }}
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@v4
14+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
1515

1616
- name: Setup pnpm & node
1717
uses: ./.github/actions/setup-pnpm
@@ -34,7 +34,7 @@ jobs:
3434

3535
- name: Get netlify config
3636
id: netlify-config
37-
uses: actions/github-script@v7
37+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
3838
with:
3939
script: |
4040
const fs = require('fs')
@@ -63,7 +63,7 @@ jobs:
6363

6464
- name: Create Summary
6565
id: summary
66-
uses: actions/github-script@v7
66+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
6767
with:
6868
script: |
6969
return `# Deployed Documentation Preview

‎.github/workflows/e2e-tests.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Checkout
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2020
with:
2121
fetch-depth: 0
2222

@@ -26,7 +26,7 @@ jobs:
2626
use_cache: false
2727

2828
- name: Cache cypress
29-
uses: actions/cache@v4.2.0
29+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684
3030
with:
3131
path: /home/runner/.cache/Cypress
3232
key: ${{ runner.os }}-cypress-${{ hashFiles('./pnpm-lock.yaml') }}
@@ -48,7 +48,7 @@ jobs:
4848
run: pnpm e2e:ci
4949

5050
- name: Upload screenshots
51-
uses: actions/upload-artifact@v4.3.4
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
5252
if: failure()
5353
with:
5454
name: cypress-snapshots

‎.github/workflows/fetch-icons-v8.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232

3333
steps:
3434
- name: Checkout
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
3636
with:
3737
fetch-depth: 0
3838

@@ -74,7 +74,7 @@ jobs:
7474
7575
- name: Get Changes
7676
id: changed-files
77-
uses: step-security/changed-files@v45
77+
uses: step-security/changed-files@3dbe17c78367e7d60f00d78ae6781a35be47b4a1
7878
with:
7979
files: ./packages/icons/public/post-icons/**
8080

‎.github/workflows/fetch-icons.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232

3333
steps:
3434
- name: Checkout
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
3636
with:
3737
fetch-depth: 0
3838

@@ -75,7 +75,7 @@ jobs:
7575
7676
- name: Get Changes
7777
id: changed-files
78-
uses: step-security/changed-files@v45
78+
uses: step-security/changed-files@3dbe17c78367e7d60f00d78ae6781a35be47b4a1
7979
with:
8080
files: ./packages/icons/src/icons/**/*.svg
8181

‎.github/workflows/lint.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v4
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
1818
with:
1919
fetch-depth: 0
2020

‎.github/workflows/pr-title-lint.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ jobs:
99
name: Validate PR title
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: amannn/action-semantic-pull-request@v5
12+
- uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017
1313
env:
1414
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-documentation.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,19 @@ jobs:
1717
changed: ${{ steps.check.outputs.changed }}
1818
steps:
1919
- name: Checkout
20-
uses: actions/checkout@v4
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2121

2222
- name: Detect Version Change
2323
id: check
24-
uses: EndBug/version-check@v2
24+
uses: EndBug/version-check@36ff30f37c7deabe56a30caa043d127be658c425
2525
with:
2626
file-name: ./packages/documentation/package.json
2727
diff-search: true
2828
token: ${{ secrets.GITHUB_TOKEN }}
2929

3030
- name: Create Summary
3131
id: summary
32-
uses: actions/github-script@v7
32+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
3333
with:
3434
script: |
3535
return `# Version Change Detection
@@ -46,7 +46,7 @@ jobs:
4646
if: needs.detect-version-change.outputs.changed == 'true'
4747
steps:
4848
- name: Checkout
49-
uses: actions/checkout@v4
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
5050

5151
- name: Setup pnpm & node
5252
uses: ./.github/actions/setup-pnpm
@@ -62,7 +62,7 @@ jobs:
6262

6363
- name: Get Netlify Config
6464
id: netlify-config
65-
uses: actions/github-script@v7
65+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
6666
with:
6767
script: |
6868
const fs = require('fs')
@@ -79,7 +79,7 @@ jobs:
7979
8080
- name: Create Summary
8181
id: summary
82-
uses: actions/github-script@v7
82+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
8383
with:
8484
script: |
8585
return `# Deployed Documentation

0 commit comments

Comments
 (0)