Skip to content

Commit e2f681f

Browse files
antgamdiaantgamdia
authored
Pin GHA to SHA instead of tags (#687)
Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>
1 parent b849f82 commit e2f681f

4 files changed

Lines changed: 54 additions & 54 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ jobs:
3131
ERLANG_BC: ${{ env.ERLANG_BC }}
3232
steps:
3333
- name: Checkout
34-
uses: actions/checkout@v6
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3535
- name: gather versions
36-
uses: endorama/asdf-parse-tool-versions@v1
36+
uses: endorama/asdf-parse-tool-versions@c981d1f09f7fad3a91bc97b6d28ce6ec0c93ded5 # v1
3737
- name: Compute matrix
3838
run: |
3939
echo "ELIXIR_DEV=${{ env.ELIXIR_VERSION }}" >> $GITHUB_OUTPUT
@@ -59,21 +59,21 @@ jobs:
5959
otp: ${{ needs.setup-matrix-env.outputs.ERLANG_DEV }}
6060
steps:
6161
- name: Cancel Previous Runs
62-
uses: styfle/cancel-workflow-action@0.13.1
62+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
6363
with:
6464
access_token: ${{ github.token }}
6565
- name: Checkout
66-
uses: actions/checkout@v6
66+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6767
with:
6868
fetch-depth: 0
6969
- name: Setup
7070
id: setup-elixir
71-
uses: erlef/setup-beam@v1
71+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
7272
with:
7373
otp-version: ${{ matrix.otp }}
7474
elixir-version: ${{ matrix.elixir }}
7575
- name: Retrieve Elixir Cached Dependencies
76-
uses: actions/cache@v5
76+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
7777
id: mix-cache
7878
with:
7979
path: |
@@ -124,21 +124,21 @@ jobs:
124124
- 5674:5672
125125
steps:
126126
- name: Cancel Previous Runs
127-
uses: styfle/cancel-workflow-action@0.13.1
127+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
128128
with:
129129
access_token: ${{ github.token }}
130130
- name: Checkout
131-
uses: actions/checkout@v6
131+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
132132
with:
133133
fetch-depth: 0
134134
- name: Setup
135135
id: setup-elixir
136-
uses: erlef/setup-beam@v1
136+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
137137
with:
138138
otp-version: ${{ matrix.otp }}
139139
elixir-version: ${{ matrix.elixir }}
140140
- name: Retrieve Cached Dependencies
141-
uses: actions/cache@v5
141+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
142142
id: mix-cache
143143
with:
144144
path: |
@@ -174,17 +174,17 @@ jobs:
174174
if: github.event_name == 'pull_request'
175175
steps:
176176
- name: Checkout target branch
177-
uses: actions/checkout@v6
177+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
178178
with:
179179
ref: ${{ github.event.pull_request.base.ref }}
180180
- name: Set up Elixir
181181
id: setup-elixir
182-
uses: erlef/setup-beam@v1
182+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
183183
with:
184184
otp-version: ${{ matrix.otp }}
185185
elixir-version: ${{ matrix.elixir }}
186186
- name: Retrieve Elixir Cached Dependencies - target branch
187-
uses: actions/cache@v5
187+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
188188
id: mix-cache-target
189189
with:
190190
path: |
@@ -216,21 +216,21 @@ jobs:
216216
otp: ${{ needs.setup-matrix-env.outputs.ERLANG_DEV }}
217217
steps:
218218
- name: Cancel Previous Runs
219-
uses: styfle/cancel-workflow-action@0.13.1
219+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
220220
with:
221221
access_token: ${{ github.token }}
222222
- name: Checkout
223-
uses: actions/checkout@v6
223+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
224224
with:
225225
fetch-depth: 0
226226
- name: Set up Elixir
227227
id: setup-elixir
228-
uses: erlef/setup-beam@v1
228+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
229229
with:
230230
otp-version: ${{ matrix.otp }}
231231
elixir-version: ${{ matrix.elixir }}
232232
- name: Retrieve Cached Dependencies - current branch
233-
uses: actions/cache@v5
233+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
234234
id: mix-cache-current
235235
with:
236236
path: |
@@ -239,7 +239,7 @@ jobs:
239239
priv/plts
240240
key: erlang-${{ steps.setup-elixir.outputs.otp-version }}-elixir-${{ steps.setup-elixir.outputs.elixir-version }}-rust-${{ needs.setup-matrix-env.outputs.RUST_DEV }}-${{ hashFiles('mix.lock') }}
241241
- name: Setup Node.js
242-
uses: actions/setup-node@v6
242+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
243243
with:
244244
node-version: 22.15.1
245245
- name: Install API linting tools
@@ -285,19 +285,19 @@ jobs:
285285

286286
steps:
287287
- name: Cancel Previous Runs
288-
uses: styfle/cancel-workflow-action@0.13.1
288+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
289289
with:
290290
access_token: ${{ github.token }}
291291
- name: Checkout current branch
292-
uses: actions/checkout@v6
292+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
293293
- name: Set up Elixir
294294
id: setup-elixir
295-
uses: erlef/setup-beam@v1
295+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
296296
with:
297297
otp-version: ${{ matrix.otp }}
298298
elixir-version: ${{ matrix.elixir }}
299299
- name: Retrieve Cached Dependencies - current branch
300-
uses: actions/cache@v5
300+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
301301
id: mix-cache-current
302302
with:
303303
path: |
@@ -309,11 +309,11 @@ jobs:
309309
run: |
310310
mix openapi.spec.json --start-app=false --spec WandaWeb.Schemas.${{ matrix.version }}.ApiSpec /tmp/specs/current-spec.json
311311
- name: Checkout target branch
312-
uses: actions/checkout@v6
312+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
313313
with:
314314
ref: ${{ github.event.pull_request.base.ref || github.ref_name }}
315315
- name: Retrieve Elixir Cached Dependencies - target branch
316-
uses: actions/cache@v5
316+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
317317
id: mix-cache-target
318318
with:
319319
path: |
@@ -336,7 +336,7 @@ jobs:
336336
--text /specs/changes.txt \
337337
--html /specs/changes.html
338338
- name: Upload OpenAPI diff report
339-
uses: actions/upload-artifact@v7
339+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
340340
if: failure()
341341
with:
342342
name: openapi-diff-report-${{ matrix.version }}
@@ -372,7 +372,7 @@ jobs:
372372
- build-containers
373373
steps:
374374
- name: Remotely trigger trento-web demo deployment
375-
uses: peter-evans/repository-dispatch@v3
375+
uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
376376
with:
377377
token: ${{ secrets.WEB_REPO_DISPATCH_PAT }}
378378
repository: ${{ github.repository_owner }}/${{ vars.DEMO_TRIGGER_TARGET || 'web' }}
@@ -383,15 +383,15 @@ jobs:
383383
runs-on: ubuntu-24.04
384384
if: github.event_name == 'push' && github.ref_name == 'main'
385385
steps:
386-
- uses: actions/checkout@v6
386+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
387387
- name: Set up Elixir
388388
id: setup-elixir
389-
uses: erlef/setup-beam@v1
389+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
390390
with:
391391
version-file: .tool-versions
392392
version-type: strict
393393
- name: Retrieve Cached Dependencies
394-
uses: actions/cache@v5
394+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
395395
id: mix-cache
396396
with:
397397
path: |
@@ -400,17 +400,17 @@ jobs:
400400
priv/plts
401401
key: erlang-${{ steps.setup-elixir.outputs.otp-version }}-elixir-${{ steps.setup-elixir.outputs.elixir-version }}-rust-${{ needs.setup-matrix-env.outputs.RUST_DEV }}-${{ hashFiles('mix.lock') }}
402402
- name: Build docs
403-
uses: lee-dohm/generate-elixir-docs@v1
403+
uses: lee-dohm/generate-elixir-docs@a745603eef443621976df401f45aaff4d849056b # v1
404404
- name: Generate openapi.json
405405
run: mix openapi.spec.json --start-app=false --spec WandaWeb.Schemas.All.ApiSpec
406406
- name: Generate Swagger UI
407-
uses: Legion2/swagger-ui-action@v1
407+
uses: Legion2/swagger-ui-action@eff65dc3f193f0a749872be82f74baa35be0797d # v1
408408
with:
409409
output: ./doc/swaggerui
410410
spec-file: openapi.json
411411
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
412412
- name: Publish to Pages
413-
uses: peaceiris/actions-gh-pages@v4
413+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
414414
with:
415415
github_token: ${{ secrets.GITHUB_TOKEN }}
416416
publish_dir: ./doc

‎.github/workflows/deps.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ jobs:
2323
ERLANG_BC: ${{ env.ERLANG_BC }}
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v6
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2727
with:
2828
ref: ${{ inputs.checkout_ref }}
2929
- name: gather versions
30-
uses: endorama/asdf-parse-tool-versions@v1
30+
uses: endorama/asdf-parse-tool-versions@c981d1f09f7fad3a91bc97b6d28ce6ec0c93ded5 # v1
3131
- name: Compute matrix
3232
run: |
3333
echo "ELIXIR_DEV=${{ env.ELIXIR_VERSION }}" >> $GITHUB_OUTPUT
@@ -51,30 +51,30 @@ jobs:
5151
RHAI_RUSTLER_FORCE_BUILD: "true"
5252
steps:
5353
- name: Cancel Previous Runs
54-
uses: styfle/cancel-workflow-action@0.13.1
54+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
5555
with:
5656
access_token: ${{ github.token }}
5757
- name: Checkout
58-
uses: actions/checkout@v6
58+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5959
with:
6060
ref: ${{ inputs.checkout_ref }}
6161
- name: Setup
6262
id: setup-elixir
63-
uses: erlef/setup-beam@v1
63+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
6464
with:
6565
otp-version: ${{ matrix.otp }}
6666
elixir-version: ${{ matrix.elixir }}
6767
- name: Read .tool-versions
68-
uses: endorama/asdf-parse-tool-versions@v1.4.0
68+
uses: endorama/asdf-parse-tool-versions@d856570ea60164ceed32e71661d8ab2e9ea2069a # v1.4.0
6969
id: tool-versions
7070
- name: Setup rust
7171
id: setup-rust
72-
uses: actions-rs/toolchain@v1
72+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
7373
with:
7474
toolchain: ${{ needs.setup-matrix-env.outputs.RUST_DEV }}
7575
default: true
7676
- name: Retrieve Cached Dependencies
77-
uses: actions/cache@v5
77+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
7878
id: mix-cache
7979
with:
8080
path: |

‎.github/workflows/obs.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ jobs:
3434
options: -u 0:0
3535
steps:
3636
- name: Cancel Previous Runs
37-
uses: styfle/cancel-workflow-action@0.13.1
37+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
3838
with:
3939
access_token: ${{ github.token }}
4040
- name: Checkout
41-
uses: actions/checkout@v6
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4242
with:
4343
fetch-depth: 0
4444
- name: Configure git for in-container operations
@@ -49,10 +49,10 @@ jobs:
4949
VERSION=$(/scripts/get_version_from_git.sh)
5050
echo "version=$VERSION" >> $GITHUB_OUTPUT
5151
- name: Read .tool-versions
52-
uses: endorama/asdf-parse-tool-versions@v1.4.0
52+
uses: endorama/asdf-parse-tool-versions@d856570ea60164ceed32e71661d8ab2e9ea2069a # v1.4.0
5353
id: tool-versions
5454
- name: Setup rust
55-
uses: actions-rs/toolchain@v1
55+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
5656
with:
5757
toolchain: ${{ env.RUST_VERSION }}
5858
- name: Get mix deps
@@ -110,10 +110,10 @@ jobs:
110110
options: -u 0:0
111111
steps:
112112
- name: Cancel Previous Runs
113-
uses: styfle/cancel-workflow-action@0.13.1
113+
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
114114
with:
115115
access_token: ${{ github.token }}
116-
- uses: actions/checkout@v6
116+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
117117
with:
118118
fetch-depth: 0
119119
- name: Configure git for in-container operations
@@ -124,10 +124,10 @@ jobs:
124124
VERSION=$(/scripts/get_version_from_git.sh)
125125
echo "version=$VERSION" >> $GITHUB_OUTPUT
126126
- name: Read .tool-versions
127-
uses: endorama/asdf-parse-tool-versions@v1.4.0
127+
uses: endorama/asdf-parse-tool-versions@d856570ea60164ceed32e71661d8ab2e9ea2069a # v1.4.0
128128
id: tool-versions
129129
- name: Setup rust
130-
uses: actions-rs/toolchain@v1
130+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
131131
with:
132132
toolchain: ${{ env.RUST_VERSION }}
133133
- name: Get mix deps

‎.github/workflows/release.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
version: ${{ steps.detect-version.outputs.current-version }}
1818
steps:
1919
- name: Check out the repository
20-
uses: actions/checkout@v6
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2121
with:
2222
fetch-depth: 2
2323
ssh-key: ${{ secrets.RELEASE_KEY }}
@@ -30,15 +30,15 @@ jobs:
3030
- name: Detect new version
3131
id: detect-version
3232
if: steps.check-parent-commit.outputs.sha
33-
uses: salsify/action-detect-and-tag-new-version@v2
33+
uses: salsify/action-detect-and-tag-new-version@b1778166f13188a9d478e2d1198f993011ba9864 # v2.0.3
3434
with:
3535
create-tag: false
3636
version-command: |
3737
cat VERSION
3838
3939
- name: Draft release
4040
id: draft-release
41-
uses: release-drafter/release-drafter@v7
41+
uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7
4242
with:
4343
publish: false
4444
version: ${{ steps.detect-version.outputs.current-version }}
@@ -48,13 +48,13 @@ jobs:
4848
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4949

5050
- name: Update CHANGELOG.md
51-
uses: stefanzweifel/changelog-updater-action@v1
51+
uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1
5252
with:
5353
latest-version: ${{ steps.draft-release.outputs.tag_name }}
5454
release-notes: ${{ steps.draft-release.outputs.body }}
5555

5656
- name: Commit new changelog
57-
uses: stefanzweifel/git-auto-commit-action@v7
57+
uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
5858
with:
5959
branch: main
6060
commit_message: "Automatically update CHANGELOG.md for release ${{ steps.detect-version.outputs.current-version }}"
@@ -71,7 +71,7 @@ jobs:
7171
steps:
7272
- name: Publish release
7373
id: publish-release
74-
uses: release-drafter/release-drafter@v7
74+
uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7
7575
with:
7676
publish: true
7777
tag: ${{ needs.pre-release.outputs.version }}

0 commit comments

Comments
 (0)