From 1cfe692d38d9d40334e2c4d06d4aa5c0eb5580bd Mon Sep 17 00:00:00 2001 From: Pactrover <329246295+pactrover@users.noreply.github.com> Date: Mon, 28 Sep 2026 04:30:49 +0000 Subject: [PATCH] ci: pin GitHub Actions to full commit SHAs --- .github/workflows/build-image.yaml | 10 +++++----- .github/workflows/build.yaml | 12 ++++++------ .github/workflows/issue-clean-up.yaml | 2 +- .github/workflows/release-tag.yaml | 2 +- .github/workflows/release.yaml | 6 +++--- .github/workflows/test.yaml | 10 +++++----- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml index 1b4ebe8d..0e909896 100644 --- a/.github/workflows/build-image.yaml +++ b/.github/workflows/build-image.yaml @@ -20,18 +20,18 @@ jobs: attestations: write artifact-metadata: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: docker/setup-buildx-action@v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - - uses: docker/login-action@v4 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - id: build - uses: docker/build-push-action@v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . file: Dockerfile.${{ inputs.image }} @@ -44,7 +44,7 @@ jobs: sbom: true - name: Sign build provenance - uses: actions/attest@v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-name: ghcr.io/${{ github.repository }} subject-digest: ${{ steps.build.outputs.digest }} diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 4d98b317..c1704b4b 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -12,9 +12,9 @@ jobs: env: NATIVE_IMAGE_OPTIONS: "--static --libc=musl --gc=G1 -R:MaxRAMPercentage=90" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: graalvm/setup-graalvm@v1 + - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1 with: distribution: 'graalvm' java-version: '25' @@ -25,13 +25,13 @@ jobs: native-image-pr-reports-update-existing: true cache: 'gradle' - - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6 - run: ./gradlew --no-daemon nativeCompile - - uses: docker/setup-buildx-action@v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - - uses: docker/login-action@v4 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -39,7 +39,7 @@ jobs: - run: echo "BRANCH_NAME=${GITHUB_REF_NAME//\//_}" >> $GITHUB_ENV - - uses: docker/build-push-action@v7 + - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . pull: true diff --git a/.github/workflows/issue-clean-up.yaml b/.github/workflows/issue-clean-up.yaml index 8314a573..dc48f753 100644 --- a/.github/workflows/issue-clean-up.yaml +++ b/.github/workflows/issue-clean-up.yaml @@ -13,7 +13,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v11 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11 with: days-before-issue-stale: 30 days-before-issue-close: 30 diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml index 0e7e80fc..af9b05e2 100644 --- a/.github/workflows/release-tag.yaml +++ b/.github/workflows/release-tag.yaml @@ -17,7 +17,7 @@ jobs: outputs: next-tag: ${{ steps.set-next-tag.outputs.next-tag }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: git fetch --tags diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a4512494..865983c4 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,13 +15,13 @@ jobs: runs-on: ubuntu-latest environment: ${{ inputs.image }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: git fetch --tags - - uses: docker/setup-buildx-action@v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - - uses: docker/login-action@v4 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.repository_owner }} diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 2686d567..1f4e8e27 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -13,22 +13,22 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: gradle/actions/wrapper-validation@v6 + - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6 - - uses: graalvm/setup-graalvm@v1 + - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1 with: distribution: 'graalvm' java-version: '25' native-image-musl: true cache: 'gradle' - - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6 - run: ./gradlew ${{ inputs.agent_enabled && '-Pagent' || '' }} test --no-daemon --info --fail-fast - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: inputs.agent_enabled with: name: native-image-metadata