Skip to content

Commit 505426b

Browse files
mjameswhmjameswh
authored
chore: Update and pin all GHA actions (#2016)
1 parent 4c644f2 commit 505426b

8 files changed

Lines changed: 52 additions & 52 deletions

File tree

‎.github/actions/setup-bun-deps/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,18 @@ runs:
1414
using: 'composite'
1515
steps:
1616
- name: Install Bun
17-
uses: oven-sh/setup-bun@v2
17+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
1818
with:
1919
bun-version: ${{ inputs.bun-version }}
2020

2121
- name: Install pnpm
22-
uses: pnpm/action-setup@v4
22+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
2323
with:
2424
version: '10'
2525
run_install: false
2626

2727
- name: Install Node (needed for pnpm and some tooling)
28-
uses: actions/setup-node@v4
28+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
2929
with:
3030
node-version: '22'
3131
cache: 'pnpm'
@@ -37,7 +37,7 @@ runs:
3737

3838
- name: Restore PNPM store
3939
id: restore-cache
40-
uses: actions/cache/restore@v4
40+
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
4141
with:
4242
path: ${{ steps.pnpm-cache-dir.outputs.dir }}
4343
key: pnpm-bun-${{ inputs.platform }}-${{ hashFiles('./pnpm-lock.yaml') }}

‎.github/actions/setup-node-deps/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ runs:
2626
using: 'composite'
2727
steps:
2828
- name: Install pnpm
29-
uses: pnpm/action-setup@v4
29+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
3030
with:
3131
version: '10'
3232
run_install: false
3333

3434
- name: Install Node
35-
uses: actions/setup-node@v4
35+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
3636
with:
3737
node-version: ${{ inputs.node-version }}
3838
cache: 'pnpm'
@@ -44,7 +44,7 @@ runs:
4444

4545
- name: Restore PNPM store
4646
id: restore-cache
47-
uses: actions/cache/restore@v4
47+
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
4848
with:
4949
path: ${{ steps.npm-cache-dir.outputs.dir }}
5050
key: pnpm-main-${{ inputs.platform }}-${{ hashFiles('./pnpm-lock.yaml') }}
@@ -58,7 +58,7 @@ runs:
5858
5959
- name: Save PNPM store
6060
if: inputs.save-cache == 'true'
61-
uses: actions/cache/save@v4
61+
uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
6262
with:
6363
path: ${{ steps.npm-cache-dir.outputs.dir }}
6464
key: pnpm-main-${{ inputs.platform }}-${{ hashFiles('./pnpm-lock.yaml') }}

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -61,31 +61,31 @@ jobs:
6161
shell: bash
6262
steps:
6363
- name: 'Checkout code'
64-
uses: actions/checkout@v4
64+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6565
with:
6666
submodules: recursive
6767

6868
- name: 'Cache index.node'
6969
id: cached-artifact
70-
uses: actions/cache@v4
70+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
7171
with:
7272
path: ./packages/core-bridge/releases
7373
key: corebridge-artifactcache-debug-${{ matrix.platform }}-${{ hashFiles('./packages/core-bridge/**/Cargo.lock', './packages/core-bridge/**/*.rs') }}
7474

7575
- name: Install protoc
7676
if: steps.cached-artifact.outputs.cache-hit != 'true'
77-
uses: arduino/setup-protoc@v3
77+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
7878
with:
7979
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
8080
version: '23.x'
8181
repo-token: ${{ secrets.GITHUB_TOKEN }}
8282

8383
- name: Upgrade Rust to latest stable
84-
uses: dtolnay/rust-toolchain@stable
84+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
8585

8686
- name: Rust Cargo and Build cache
8787
if: steps.cached-artifact.outputs.cache-hit != 'true'
88-
uses: Swatinem/rust-cache@v2
88+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
8989
with:
9090
workspaces: packages/core-bridge -> target
9191
prefix-key: corebridge-buildcache-debug
@@ -102,7 +102,7 @@ jobs:
102102
mkdir -p ./releases/${{ matrix.target }}
103103
cp target/${{ matrix.target }}/debug/${{ matrix.out-file }} ./releases/${{ matrix.target }}/index.node
104104
105-
- uses: actions/upload-artifact@v4
105+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
106106
with:
107107
name: corebridge-native-debug-${{ matrix.platform }}
108108
# Actual file will be named ${{ matrix.target }}/index.node
@@ -151,12 +151,12 @@ jobs:
151151
run: git config --global core.autocrlf false
152152

153153
- name: 'Checkout code'
154-
uses: actions/checkout@v4
154+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
155155
with:
156156
submodules: recursive
157157

158158
- name: Download core-bridge native libraries
159-
uses: actions/download-artifact@v4
159+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
160160
with:
161161
name: corebridge-native-debug-${{ matrix.platform }}
162162
path: ./packages/core-bridge/releases
@@ -193,7 +193,7 @@ jobs:
193193
run: pnpm tsx scripts/publish-to-verdaccio.ts --registry-dir ${{ steps.tmp-dir.outputs.dir }}/npm-registry
194194

195195
- name: Install Temporal CLI
196-
uses: temporalio/setup-temporal@v0
196+
uses: temporalio/setup-temporal@1059a504f87e7fa2f385e3fa40d1aa7e62f1c6ca # v0
197197

198198
- name: Run Temporal CLI
199199
working-directory: ${{ runner.temp }}
@@ -281,7 +281,7 @@ jobs:
281281
# End samples
282282

283283
- name: Upload Dev Server logs
284-
uses: actions/upload-artifact@v4
284+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
285285
if: failure() || cancelled()
286286
with:
287287
name: integration-tests-${{ matrix.platform }}-${{ matrix.node }}-${{ matrix.reuse-v8-context && 'reuse' || 'noreuse' }}-devserver-logs

‎.github/workflows/conventions.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2020
with:
2121
submodules: recursive
2222

@@ -27,18 +27,18 @@ jobs:
2727
platform: 'linux-x64'
2828

2929
- name: Install protoc
30-
uses: arduino/setup-protoc@v3
30+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
3131
with:
3232
version: '23.x'
3333
repo-token: ${{ secrets.GITHUB_TOKEN }}
3434

3535
- name: Upgrade Rust to latest stable
36-
uses: dtolnay/rust-toolchain@stable
36+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
3737
with:
3838
components: clippy
3939

4040
- name: Rust Cargo and Build cache
41-
uses: Swatinem/rust-cache@v2
41+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
4242
with:
4343
workspaces: packages/core-bridge -> target
4444
prefix-key: corebridge-buildcache

‎.github/workflows/docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
runs-on: ubuntu-latest
3636
steps:
3737
- name: Checkout code
38-
uses: actions/checkout@v4
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3939
with:
4040
submodules: recursive
4141

‎.github/workflows/nightly-throughput-stress.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -68,20 +68,20 @@ jobs:
6868
echo "=========================================="
6969
7070
- name: Checkout SDK
71-
uses: actions/checkout@v4
71+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7272
with:
7373
submodules: recursive
7474

7575
- name: Checkout OMES
76-
uses: actions/checkout@v4
76+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7777
with:
7878
repository: ${{ env.OMES_REPO }}
7979
ref: ${{ env.OMES_REF }}
8080
path: omes
8181
submodules: recursive
8282

8383
- name: Setup Go
84-
uses: actions/setup-go@v5
84+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
8585
with:
8686
go-version-file: omes/go.mod
8787
cache-dependency-path: omes/go.sum
@@ -95,16 +95,16 @@ jobs:
9595
save-cache: 'true'
9696

9797
- name: Install protoc
98-
uses: arduino/setup-protoc@v3
98+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
9999
with:
100100
version: '23.x'
101101
repo-token: ${{ secrets.GITHUB_TOKEN }}
102102

103103
- name: Setup Rust
104-
uses: dtolnay/rust-toolchain@stable
104+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
105105

106106
- name: Rust cache
107-
uses: Swatinem/rust-cache@v2
107+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
108108
with:
109109
workspaces: packages/core-bridge -> target
110110

@@ -114,7 +114,7 @@ jobs:
114114
BUILD_CORE_RELEASE: true
115115

116116
- name: Install Temporal CLI
117-
uses: temporalio/setup-temporal@v0
117+
uses: temporalio/setup-temporal@1059a504f87e7fa2f385e3fa40d1aa7e62f1c6ca # v0
118118

119119
- name: Install Prometheus
120120
run: |
@@ -169,7 +169,7 @@ jobs:
169169
170170
- name: Configure AWS credentials
171171
if: always()
172-
uses: aws-actions/configure-aws-credentials@v4
172+
uses: aws-actions/configure-aws-credentials@51635dbf418c2cdd8b3e1497529334d8db7e4063 # v6
173173
with:
174174
role-to-assume: ${{ env.AWS_S3_METRICS_UPLOAD_ROLE_ARN }}
175175
aws-region: us-west-2
@@ -189,15 +189,15 @@ jobs:
189189
190190
- name: Upload logs on failure
191191
if: failure() || cancelled()
192-
uses: actions/upload-artifact@v4
192+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
193193
with:
194194
name: throughput-stress-logs
195195
path: ${{ env.WORKER_LOG_DIR }}
196196
retention-days: 30
197197

198198
- name: Notify Slack on failure
199199
if: failure() || cancelled()
200-
uses: slackapi/slack-github-action@v2
200+
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3
201201
with:
202202
webhook-type: incoming-webhook
203203
payload: |

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -59,33 +59,33 @@ jobs:
5959
shell: bash
6060
steps:
6161
- name: 'Checkout code'
62-
uses: actions/checkout@v4
62+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6363
with:
6464
submodules: recursive
6565

6666
- name: 'Cache native index.node artifacts'
6767
id: cached-artifact
68-
uses: actions/cache@v4
68+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
6969
with:
7070
path: ./packages/core-bridge/releases
7171
key: corebridge-artifactcache-${{ matrix.platform }}-${{ hashFiles('./packages/core-bridge/**/Cargo.lock', './packages/core-bridge/**/*.rs') }}
7272

7373
- name: Install protoc
7474
if: steps.cached-artifact.outputs.cache-hit != 'true' && !matrix.container
75-
uses: arduino/setup-protoc@v3
75+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
7676
with:
7777
# TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
7878
version: '23.x'
7979
repo-token: ${{ secrets.GITHUB_TOKEN }}
8080

8181
- name: Upgrade Rust to latest stable
82-
uses: dtolnay/rust-toolchain@stable
82+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
8383

8484
# FIXME: Setup volumes so that we can benefit from the cache in the Docker-build scenario.
8585
# Or maybe just get rid of the cache entirely if it doesn't have sufficient benefits.
8686
- name: Rust Cargo and Build cache
8787
if: steps.cached-artifact.outputs.cache-hit != 'true' && !matrix.container
88-
uses: Swatinem/rust-cache@v2
88+
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
8989
with:
9090
workspaces: packages/core-bridge -> target
9191
prefix-key: corebridge-buildcache
@@ -128,7 +128,7 @@ jobs:
128128
objdump -T ./releases/${{ matrix.target }}/index.node |
129129
grep GLIBC | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -V | tail -1
130130
131-
- uses: actions/upload-artifact@v4
131+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
132132
with:
133133
name: corebridge-native-${{ matrix.platform }}
134134
# Actual file will be named ${{ matrix.target }}/index.node
@@ -154,12 +154,12 @@ jobs:
154154
shell: bash
155155
steps:
156156
- name: Checkout code
157-
uses: actions/checkout@v4
157+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
158158
with:
159159
submodules: recursive
160160

161161
- name: Download core-bridge native libraries
162-
uses: actions/download-artifact@v4
162+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
163163
with:
164164
path: ./packages/core-bridge/releases/tmp
165165

@@ -184,7 +184,7 @@ jobs:
184184
run: pnpm tsx scripts/publish-to-verdaccio.ts --registry-dir ./tmp/registry
185185

186186
- name: Save Verdaccio repo artifact
187-
uses: actions/upload-artifact@v4
187+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
188188
with:
189189
name: verdaccio-repo
190190
path: ./tmp/registry/storage
@@ -231,7 +231,7 @@ jobs:
231231
TEMPORAL_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}
232232
steps:
233233
- name: 'Checkout code'
234-
uses: actions/checkout@v4
234+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
235235
with:
236236
# We don't need the core submodule here since won't build the project
237237
submodules: false
@@ -243,7 +243,7 @@ jobs:
243243
platform: ${{ matrix.platform }}
244244

245245
- name: Restore Verdaccio repo artifact
246-
uses: actions/download-artifact@v4
246+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
247247
with:
248248
name: verdaccio-repo
249249
path: ./tmp/registry/storage
@@ -254,7 +254,7 @@ jobs:
254254

255255
- name: Install Temporal CLI
256256
if: matrix.server == 'cli'
257-
uses: temporalio/setup-temporal@v0
257+
uses: temporalio/setup-temporal@1059a504f87e7fa2f385e3fa40d1aa7e62f1c6ca # v0
258258

259259
- name: Run Temporal CLI
260260
if: matrix.server == 'cli'

0 commit comments

Comments
 (0)