Skip to content

Commit a9389e6

Browse files
mjameswhmjameswh
authored
Update and pin all GHA actions (#2847)
1 parent 686a62d commit a9389e6

7 files changed

Lines changed: 45 additions & 45 deletions

File tree

‎.github/workflows/build-native-image.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,22 +62,22 @@ jobs:
6262
runs-on: ${{ matrix.runner }}
6363
steps:
6464
- name: Checkout repo
65-
uses: actions/checkout@v5
65+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6666
with:
6767
fetch-depth: 0
6868
submodules: recursive
6969
ref: ${{ env.INPUT_REF }}
7070

7171
- name: Set up Java
7272
if: matrix.os_family != 'linux'
73-
uses: actions/setup-java@v5
73+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
7474
with:
7575
java-version: 23
7676
distribution: "graalvm"
7777

7878
- name: Set up Gradle
7979
if: matrix.os_family != 'linux'
80-
uses: gradle/actions/setup-gradle@v5
80+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
8181

8282
- name: Build native test server (non-Docker)
8383
if: matrix.os_family != 'linux'
@@ -105,7 +105,7 @@ jobs:
105105
# path ends in a wildcard because on windows the file ends in '.exe'
106106
- name: Upload executable to workflow
107107
if: ${{ inputs.upload_artifact }}
108-
uses: actions/upload-artifact@v5
108+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
109109
with:
110110
name: ${{ matrix.musl && format('{0}_{1}_musl', matrix.os_family, matrix.arch) || format('{0}_{1}', matrix.os_family, matrix.arch)}}
111111
path: |

‎.github/workflows/ci.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,20 +14,20 @@ jobs:
1414
timeout-minutes: 30
1515
steps:
1616
- name: Checkout repo
17-
uses: actions/checkout@v5
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1818
with:
1919
fetch-depth: 0
2020
submodules: recursive
2121
ref: ${{ github.event.pull_request.head.sha }}
2222

2323
- name: Set up Java
24-
uses: actions/setup-java@v5
24+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
2525
with:
2626
java-version: "23"
2727
distribution: "temurin"
2828

2929
- name: Set up Gradle
30-
uses: gradle/actions/setup-gradle@v5
30+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
3131

3232
- name: Run unit tests (Java 23)
3333
env:
@@ -54,7 +54,7 @@ jobs:
5454
run: ./gradlew --no-daemon :temporal-spring-boot-autoconfigure:test -x spotlessCheck -x spotlessApply -x spotlessJava -P edgeDepsTest -P springBoot4Test -PtestJavaVersion=23
5555

5656
- name: Publish Test Report
57-
uses: mikepenz/action-junit-report@v6
57+
uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
5858
if: success() || failure() # always run even if the previous step fails
5959
with:
6060
report_paths: "**/build/test-results/test/TEST-*.xml"
@@ -65,22 +65,22 @@ jobs:
6565
timeout-minutes: 30
6666
steps:
6767
- name: Checkout repo
68-
uses: actions/checkout@v5
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6969
with:
7070
fetch-depth: 0
7171
submodules: recursive
7272
ref: ${{ github.event.pull_request.head.sha }}
7373

7474
- name: Set up Java
75-
uses: actions/setup-java@v5
75+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
7676
with:
7777
java-version: |
7878
11
7979
23
8080
distribution: "temurin"
8181

8282
- name: Set up Gradle
83-
uses: gradle/actions/setup-gradle@v5
83+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
8484

8585
- name: Start containerized server and dependencies
8686
env:
@@ -138,7 +138,7 @@ jobs:
138138
run: ./gradlew --no-daemon :temporal-sdk:virtualThreadTests -x spotlessCheck -x spotlessApply -x spotlessJava -PtestJavaVersion=21
139139

140140
- name: Publish Test Report
141-
uses: mikepenz/action-junit-report@v6
141+
uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
142142
if: success() || failure() # always run even if the previous step fails
143143
with:
144144
report_paths: "**/build/test-results/test/TEST-*.xml"
@@ -149,20 +149,20 @@ jobs:
149149
timeout-minutes: 30
150150
steps:
151151
- name: Checkout repo
152-
uses: actions/checkout@v5
152+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
153153
with:
154154
fetch-depth: 0
155155
submodules: recursive
156156
ref: ${{ github.event.pull_request.head.sha }}
157157

158158
- name: Set up Java
159-
uses: actions/setup-java@v5
159+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
160160
with:
161161
java-version: "23"
162162
distribution: "temurin"
163163

164164
- name: Set up Gradle
165-
uses: gradle/actions/setup-gradle@v5
165+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
166166

167167
- name: Run cloud test
168168
# Only supported in non-fork runs, since secrets are not available in forks. We intentionally
@@ -177,7 +177,7 @@ jobs:
177177
run: ./gradlew --no-daemon :temporal-sdk:test --tests '*CloudOperationsClientTest'
178178

179179
- name: Publish Test Report
180-
uses: mikepenz/action-junit-report@v6
180+
uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
181181
if: success() || failure() # always run even if the previous step fails
182182
with:
183183
report_paths: "**/build/test-results/test/TEST-*.xml"
@@ -188,20 +188,20 @@ jobs:
188188
timeout-minutes: 20
189189
steps:
190190
- name: Checkout repo
191-
uses: actions/checkout@v5
191+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
192192
with:
193193
fetch-depth: 0
194194
submodules: recursive
195195
ref: ${{ github.event.pull_request.head.sha }}
196196

197197
- name: Set up Java
198-
uses: actions/setup-java@v5
198+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
199199
with:
200200
java-version: "23"
201201
distribution: "temurin"
202202

203203
- name: Set up Gradle
204-
uses: gradle/actions/setup-gradle@v5
204+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
205205

206206
- name: Run copyright and code format checks
207207
run: ./gradlew --no-daemon spotlessCheck
@@ -212,20 +212,20 @@ jobs:
212212
timeout-minutes: 20
213213
steps:
214214
- name: Checkout repo
215-
uses: actions/checkout@v5
215+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
216216
with:
217217
fetch-depth: 0
218218
submodules: recursive
219219
ref: ${{ github.event.pull_request.head.sha }}
220220

221221
- name: Set up Java
222-
uses: actions/setup-java@v5
222+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
223223
with:
224224
java-version: "23"
225225
distribution: "temurin"
226226

227227
- name: Set up Gradle
228-
uses: gradle/actions/setup-gradle@v5
228+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
229229

230230
- name: Run javadoc
231231
run: ./gradlew --no-daemon javadoc

‎.github/workflows/coverage.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,18 +12,18 @@ jobs:
1212
runs-on: ubuntu-latest-16-cores
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@v5
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1616
with:
1717
fetch-depth: 0
1818

1919
- name: Set up Java
20-
uses: actions/setup-java@v5
20+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
2121
with:
2222
java-version: "23"
2323
distribution: "temurin"
2424

2525
- name: Set up Gradle
26-
uses: gradle/actions/setup-gradle@v5
26+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
2727

2828
- name: Run Tests
2929
run: ./gradlew test -x spotlessCheck -x spotlessApply -Pjacoco -PtestJavaVersion=23

‎.github/workflows/gradle-wrapper-validation.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,5 @@ jobs:
99
name: "Gradle wrapper validation"
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/checkout@v5
13-
- uses: gradle/actions/wrapper-validation@v4
12+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
13+
- uses: gradle/actions/wrapper-validation@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6

‎.github/workflows/nightly-throughput-stress.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -68,38 +68,38 @@ jobs:
6868
echo "=========================================="
6969
7070
- name: Checkout SDK
71-
uses: actions/checkout@v5
71+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7272
with:
7373
submodules: recursive
7474
fetch-depth: 0
7575

7676
- name: Checkout OMES
77-
uses: actions/checkout@v5
77+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7878
with:
7979
repository: ${{ env.OMES_REPO }}
8080
ref: ${{ env.OMES_REF }}
8181
path: omes
8282

8383
- name: Setup Go
84-
uses: actions/setup-go@v6
84+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
8585
with:
8686
go-version-file: omes/go.mod
8787
cache-dependency-path: omes/go.sum
8888

8989
- name: Set up Java
90-
uses: actions/setup-java@v5
90+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
9191
with:
9292
java-version: "23"
9393
distribution: "temurin"
9494

9595
- name: Set up Gradle
96-
uses: gradle/actions/setup-gradle@v4
96+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
9797

9898
- name: Build SDK
9999
run: ./gradlew build -x test -x virtualThreadTests -PtestJavaVersion=23
100100

101101
- name: Install Temporal CLI
102-
uses: temporalio/setup-temporal@v0
102+
uses: temporalio/setup-temporal@1059a504f87e7fa2f385e3fa40d1aa7e62f1c6ca # v0
103103

104104
- name: Install Prometheus
105105
run: |
@@ -154,7 +154,7 @@ jobs:
154154
155155
- name: Configure AWS credentials
156156
if: always()
157-
uses: aws-actions/configure-aws-credentials@v4
157+
uses: aws-actions/configure-aws-credentials@51635dbf418c2cdd8b3e1497529334d8db7e4063 # v6
158158
with:
159159
role-to-assume: ${{ env.AWS_S3_METRICS_UPLOAD_ROLE_ARN }}
160160
aws-region: us-west-2
@@ -174,15 +174,15 @@ jobs:
174174
175175
- name: Upload logs on failure
176176
if: failure() || cancelled()
177-
uses: actions/upload-artifact@v5
177+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
178178
with:
179179
name: throughput-stress-logs
180180
path: ${{ env.WORKER_LOG_DIR }}
181181
retention-days: 30
182182

183183
- name: Notify Slack on failure
184184
if: failure() || cancelled()
185-
uses: slackapi/slack-github-action@v2
185+
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3
186186
with:
187187
webhook-type: incoming-webhook
188188
payload: |

‎.github/workflows/prepare-release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454

5555
- name: Checkout repo
5656
if: steps.check_release.outputs.already_exists == 'false'
57-
uses: actions/checkout@v5
57+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5858
with:
5959
ref: ${{ env.INPUT_REF }}
6060

@@ -78,7 +78,7 @@ jobs:
7878
needs: create_draft_release
7979
steps:
8080
- name: Checkout repo
81-
uses: actions/checkout@v5
81+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
8282
with:
8383
ref: ${{ env.INPUT_REF }}
8484

@@ -92,13 +92,13 @@ jobs:
9292
run: git tag "$INPUT_TAG"
9393

9494
- name: Set up Java
95-
uses: actions/setup-java@v5
95+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
9696
with:
9797
java-version: "23"
9898
distribution: "temurin"
9999

100100
- name: Set up Gradle
101-
uses: gradle/actions/setup-gradle@v5
101+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
102102

103103
- name: Set up signing key
104104
run: mkdir -p "$HOME/.gnupg" && echo -n "$KEY" | base64 -d > "$HOME/.gnupg/secring.gpg"
@@ -148,7 +148,7 @@ jobs:
148148

149149
# when no artifact is specified, all artifacts are downloaded and expanded into CWD
150150
- name: Fetch executables
151-
uses: actions/download-artifact@v6
151+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
152152

153153
# example: linux_amd64/ -> temporal-test-server_1.2.3_linux_amd64
154154
# the name of the directory created becomes the basename of the archive (*.tar.gz or *.zip) and
@@ -165,7 +165,7 @@ jobs:
165165
run: for dir in *windows*; do zip -r "${dir}.zip" "$dir"; done
166166

167167
- name: Upload release archives
168-
uses: actions/upload-artifact@v5
168+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
169169
with:
170170
name: release-archives
171171
path: |

‎.github/workflows/publish-snapshot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,18 +31,18 @@ jobs:
3131
runs-on: ubuntu-latest
3232
steps:
3333
- name: Checkout repo
34-
uses: actions/checkout@v5
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3535
with:
3636
fetch-depth: 0
3737

3838
- name: Set up Java
39-
uses: actions/setup-java@v5
39+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
4040
with:
4141
java-version: '23'
4242
distribution: 'temurin'
4343

4444
- name: Set up Gradle
45-
uses: gradle/actions/setup-gradle@v5
45+
uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
4646

4747
# Prefer env variables here rather than inline ${{ secrets.FOO }} to
4848
# decrease the likelihood that secrets end up printed to stdout.

0 commit comments

Comments
 (0)