Skip to content

chore: Update and pin all GHA actions #1222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjameswh merged 3 commits into from
Apr 18, 2026
Merged

chore: Update and pin all GHA actions #1222

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e29918b
Update and pin all GHA actions
mjameswh Apr 17, 2026
b6a450d
ci: add explicit GITHUB_TOKEN permissions in workflows
mjameswh Apr 17, 2026
5d6825c
ci: add job-level GITHUB_TOKEN permissions on heavy workflow
mjameswh Apr 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .github/workflows/heavy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on: # rebuild any PRs and main branch changes
branches:
- master

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
Expand All @@ -15,12 +18,12 @@ jobs:
timeout-minutes: 20
runs-on: ubuntu-latest-16-cores
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
submodules: recursive
- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
Comment on lines 20 to 31
Copy link
Copy Markdown

@semgrep-managed-scans semgrep-managed-scans Bot Apr 17, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

🥳 Fixed in commit b6a450d 🥳

Expand Down
78 changes: 39 additions & 39 deletions .github/workflows/per-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,18 +20,18 @@ jobs:
timeout-minutes: ${{ github.ref == 'refs/heads/master' && 15 || 10 }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
submodules: recursive
- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
repo-token: ${{ secrets.GITHUB_TOKEN }}
- run: rustup component add rustfmt clippy
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
- run: cargo fmt --all --check
Expand Down Expand Up @@ -63,10 +63,10 @@ jobs:
timeoutMinutes: 20
runs-on: ${{ matrix.runsOn || matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
Expand All @@ -76,11 +76,11 @@ jobs:
# Visual Studio bug tracker https://developercommunity.visualstudio.com/t/Regression-from-1943:-linkexe-crashes/10912960
- name: Setup RUSTFLAGS (Windows)
if: runner.os == 'Windows'
uses: actions/github-script@v7
uses: actions/github-script@450193c5abd4cdb17ba9f3ffcfe8f635c4bb6c2a # v9
with:
script: |
core.exportVariable('RUSTFLAGS', '-Csymbol-mangling-version=v0');
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
- run: cargo test -- --include-ignored --nocapture
Expand All @@ -91,16 +91,16 @@ jobs:
test_executable=$(cargo build --tests --message-format json | jq -r 'select(.profile?.test == true and .target?.name == "temporalio_sdk_core" and .executable) | .executable')
cp $test_executable ./core-tests
- name: Upload cgroup test executable
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
if: runner.os == 'Linux' && runner.arch == 'X64'
with:
name: cgroup-tests-linux-x86_64
path: ./core-tests
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
with:
name: coverage-report
path: tarpaulin-report.html
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
with:
name: state-machine-coverage
path: machine_coverage/
Expand All @@ -110,18 +110,18 @@ jobs:
timeout-minutes: ${{ github.ref == 'refs/heads/master' && 15 || 10 }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
submodules: recursive
- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
repo-token: ${{ secrets.GITHUB_TOKEN }}
- run: rustup component add rustfmt clippy
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
key: msrv
Expand All @@ -140,7 +140,7 @@ jobs:
CGROUP_TESTS_ENABLED: true
steps:
- name: Download cgroup test executable
uses: actions/download-artifact@v5
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: cgroup-tests-linux-x86_64
- name: Run tests
Expand All @@ -166,10 +166,10 @@ jobs:
runsOn: macos-15-intel
runs-on: ${{ matrix.runsOn || matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
Expand All @@ -179,11 +179,11 @@ jobs:
# Visual Studio bug tracker https://developercommunity.visualstudio.com/t/Regression-from-1943:-linkexe-crashes/10912960
- name: Setup RUSTFLAGS (Windows)
if: runner.os == 'Windows'
uses: actions/github-script@v7
uses: actions/github-script@450193c5abd4cdb17ba9f3ffcfe8f635c4bb6c2a # v9
with:
script: |
core.exportVariable('RUSTFLAGS', '-Csymbol-mangling-version=v0');
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
- run: cargo integ-test
Expand All @@ -199,16 +199,16 @@ jobs:
timeout-minutes: ${{ github.ref == 'refs/heads/master' && 25 || 20 }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
repo-token: ${{ secrets.GITHUB_TOKEN }}

- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
- run: cargo test --features=test-utilities --test cloud_tests
Expand All @@ -224,19 +224,19 @@ jobs:
timeout-minutes: ${{ github.ref == 'refs/heads/master' && 25 || 20 }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
repo-token: ${{ secrets.GITHUB_TOKEN }}
- name: Start container for otel-collector and prometheus
uses: hoverkraft-tech/compose-action@v2.0.1
uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
with:
compose-file: ./etc/docker/docker-compose-ci.yaml
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
- run: cargo integ-test docker_
Expand All @@ -246,20 +246,20 @@ jobs:
timeout-minutes: 15
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
version: "23.x"
repo-token: ${{ secrets.GITHUB_TOKEN }}
- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
save-if: ${{ github.ref == 'refs/heads/master' }}
- name: Build examples
run: cargo build --examples -p temporalio-sdk --features examples
- name: Install Temporal CLI
uses: temporalio/setup-temporal@v0
uses: temporalio/setup-temporal@1059a504f87e7fa2f385e3fa40d1aa7e62f1c6ca # v0
- name: Start Temporal dev server
run: |
temporal server start-dev --headless &
Expand All @@ -281,10 +281,10 @@ jobs:
name: "C bridge static link test"
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Install protoc
uses: arduino/setup-protoc@v3
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
with:
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
version: "23.x"
Expand Down
Loading