Skip to content

Repository navigation

Commit 1f5857f

Browse files
lelialelia
committed
ci: pin all GitHub Actions to latest release SHAs with version comments
Bump every third-party action to its latest git-tagged release, pinned to the resolved commit SHA with a trailing '# vX.Y.Z' comment for readability: actions/checkout -> v6.0.2 actions/setup-python -> v6.2.0 actions/setup-node -> v6.4.0 actions/github-script -> v9.0.0 pypa/gh-action-pypi-publish -> v1.14.0 docker/setup-qemu-action -> v4.1.0 docker/setup-buildx-action -> v4.1.0 docker/login-action -> v4.2.0 docker/build-push-action -> v7.2.0 socketdev/action -> v1.3.2 (comment only) Applied across the setup-sfw composite action and all workflows, including docker-stable.yml which previously used floating major-version comments. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
1 parent 728bb15 commit 1f5857f

8 files changed

Lines changed: 38 additions & 38 deletions

File tree

‎.github/actions/setup-sfw/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,18 +19,18 @@ runs:
1919
using: "composite"
2020
steps:
2121
- if: ${{ inputs.python == 'true' || inputs.uv == 'true' }}
22-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
22+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2323
with:
2424
python-version: "3.12"
2525

2626
- if: ${{ inputs.node == 'true' }}
27-
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
27+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2828
with:
2929
node-version: "20"
3030

3131
# Official Socket setup action. Wires up sfw routing correctly -- preferred
32-
# over a hand-rolled `npm install -g sfw`. Pinned to a commit SHA (v1.3.2).
33-
- uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f
32+
# over a hand-rolled `npm install -g sfw`.
33+
- uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
3434
with:
3535
mode: firewall-free
3636

‎.github/workflows/dependabot-review.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
dockerfile_changed: ${{ steps.diff.outputs.dockerfile_changed }}
3535
workflow_or_action_changed: ${{ steps.diff.outputs.workflow_or_action_changed }}
3636
steps:
37-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
37+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838
with:
3939
fetch-depth: 0
4040
persist-credentials: false
@@ -89,7 +89,7 @@ jobs:
8989
runs-on: ubuntu-latest
9090
timeout-minutes: 15
9191
steps:
92-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
92+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9393
with:
9494
fetch-depth: 1
9595
persist-credentials: false
@@ -126,7 +126,7 @@ jobs:
126126
runs-on: ubuntu-latest
127127
timeout-minutes: 15
128128
steps:
129-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
129+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
130130
with:
131131
fetch-depth: 1
132132
persist-credentials: false
@@ -145,7 +145,7 @@ jobs:
145145
runs-on: ubuntu-latest
146146
timeout-minutes: 15
147147
steps:
148-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
148+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
149149
with:
150150
fetch-depth: 1
151151
persist-credentials: false
@@ -168,7 +168,7 @@ jobs:
168168
runs-on: ubuntu-latest
169169
timeout-minutes: 20
170170
steps:
171-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
171+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
172172
with:
173173
fetch-depth: 1
174174
persist-credentials: false

‎.github/workflows/docker-stable.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
stable:
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1717
with:
1818
persist-credentials: false
1919

@@ -29,19 +29,19 @@ jobs:
2929
echo "Version ${INPUT_VERSION} found on PyPI - proceeding with release"
3030
3131
- name: Set up QEMU
32-
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
32+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
3333

3434
- name: Set up Docker Buildx
35-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
35+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
3636

3737
- name: Login to Docker Hub with Organization Token
38-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
38+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
3939
with:
4040
username: ${{ secrets.DOCKERHUB_USERNAME }}
4141
password: ${{ secrets.DOCKERHUB_TOKEN }}
4242

4343
- name: Build & Push Stable Docker
44-
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
44+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
4545
with:
4646
push: true
4747
platforms: linux/amd64,linux/arm64

‎.github/workflows/e2e-test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,16 +70,16 @@ jobs:
7070

7171
name: e2e-${{ matrix.name }}
7272
steps:
73-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
73+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7474
with:
7575
fetch-depth: 0
7676
persist-credentials: false
7777

78-
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
78+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
7979
with:
8080
python-version: '3.12'
8181

82-
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
82+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
8383
if: matrix.setup-node == 'true'
8484
with:
8585
node-version: '20'

‎.github/workflows/pr-preview.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,11 @@ jobs:
1818
contents: read
1919
pull-requests: write
2020
steps:
21-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222
with:
2323
fetch-depth: 0
2424
persist-credentials: false
25-
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
25+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2626
with:
2727
python-version: '3.13'
2828

@@ -63,14 +63,14 @@ jobs:
6363
6464
- name: Publish to Test PyPI
6565
if: steps.version_check.outputs.exists != 'true'
66-
uses: pypa/gh-action-pypi-publish@ab69e431e9c9f48a3310be0a56527c679f56e04d
66+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
6767
with:
6868
repository-url: https://test.pypi.org/legacy/
6969
verbose: true
7070

7171
- name: Comment on PR
7272
if: steps.version_check.outputs.exists != 'true'
73-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
73+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
7474
env:
7575
VERSION: ${{ env.VERSION }}
7676
with:
@@ -140,21 +140,21 @@ jobs:
140140
exit 1
141141
142142
- name: Set up QEMU
143-
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
143+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
144144

145145
- name: Set up Docker Buildx
146-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349
146+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
147147

148148
- name: Login to Docker Hub with Organization Token
149149
if: steps.verify_package.outputs.success == 'true'
150-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
150+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
151151
with:
152152
username: ${{ secrets.DOCKERHUB_USERNAME }}
153153
password: ${{ secrets.DOCKERHUB_TOKEN }}
154154

155155
- name: Build & Push Docker Preview
156156
if: steps.verify_package.outputs.success == 'true'
157-
uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
157+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
158158
env:
159159
VERSION: ${{ env.VERSION }}
160160
with:

‎.github/workflows/python-tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,12 @@ jobs:
3535
runs-on: ubuntu-latest
3636
timeout-minutes: 20
3737
steps:
38-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
38+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3939
with:
4040
fetch-depth: 1
4141
persist-credentials: false
4242
- name: 🐍 setup python
43-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
43+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
4444
with:
4545
python-version: ${{ env.PYTHON_VERSION }}
4646
- name: 🛠️ install deps
@@ -71,12 +71,12 @@ jobs:
7171
runs-on: ubuntu-latest
7272
timeout-minutes: 10
7373
steps:
74-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
74+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7575
with:
7676
fetch-depth: 1
7777
persist-credentials: false
7878
- name: 🐍 setup python
79-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
79+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
8080
with:
8181
python-version: "3.10"
8282
- name: 🚫 verify install is rejected on unsupported python

‎.github/workflows/release.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ jobs:
1010
id-token: write
1111
contents: read
1212
steps:
13-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1414
with:
1515
fetch-depth: 0
1616
persist-credentials: false
17-
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
17+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1818
with:
1919
python-version: '3.13'
2020

@@ -70,16 +70,16 @@ jobs:
7070
7171
- name: Publish to PyPI
7272
if: steps.version_check.outputs.pypi_exists != 'true'
73-
uses: pypa/gh-action-pypi-publish@ab69e431e9c9f48a3310be0a56527c679f56e04d
73+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
7474

7575
- name: Set up QEMU
76-
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
76+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
7777

7878
- name: Set up Docker Buildx
79-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349
79+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
8080

8181
- name: Login to Docker Hub with Organization Token
82-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
82+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
8383
with:
8484
username: ${{ secrets.DOCKERHUB_USERNAME }}
8585
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -106,7 +106,7 @@ jobs:
106106
if: |
107107
steps.verify_package.outputs.success == 'true' &&
108108
steps.docker_check.outputs.docker_exists != 'true'
109-
uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
109+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
110110
env:
111111
VERSION: ${{ env.VERSION }}
112112
with:

‎.github/workflows/version-check.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
if: github.event.pull_request.user.login != 'dependabot[bot]'
2121
runs-on: ubuntu-latest
2222
steps:
23-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2424
with:
2525
fetch-depth: 0 # Fetch all history for all branches
2626
persist-credentials: false
@@ -90,7 +90,7 @@ jobs:
9090
fi
9191
9292
- name: Manage PR Comment
93-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
93+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
9494
if: always() && github.event.pull_request.head.repo.full_name == github.repository
9595
env:
9696
MAIN_VERSION: ${{ env.MAIN_VERSION }}

0 commit comments

Comments
 (0)