ci: pin third-party actions to SHAs and gate PRs on an in-repo build

.github/workflows/build.yml

@@ -0,0 +1,29 @@
+# PR 建置門檻: 讓 auto-merge 的 PR (如 bump-spring 開的相依升版 PR) 在合併前
+# 有一個 in-repo 的建置/測試狀態可被 branch protection 要求, 不必只依賴 repo 外的 Jenkins。
+# 註: 完整的 java/spring 交叉測試仍由 Jenkinsfile 的 Matrix Tests 負責, 這裡只跑 pom.xml 當前組合。
+name: Build
+
+on:
+  pull_request:
+    branches: [jakarta]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: 'maven'
+      - run: make test

.github/workflows/bump-snapshot.yml

@@ -32,7 +32,7 @@ jobs:
       - id: get-current-version
         run: echo "current_version=$(make version)" >> "$GITHUB_OUTPUT"
       - id: bump
-        uses: "WyriHaximus/github-action-next-semvers@v1"
+        uses: WyriHaximus/github-action-next-semvers@d079934efaf011a4cf8912d4637097fe35d32b93 # v1
         with:
           version: ${{ steps.get-current-version.outputs.current_version }}
     outputs:
@@ -58,7 +58,7 @@ jobs:
             exit 1;
           fi
       - id: check-version
-        uses: mukunku/[email protected]
+        uses: mukunku/tag-exists-action@5c39604fe8aef7e65acb6fbcf96ec580f7680313 # v1.7.0
         with:
           tag: '${{ steps.determine-version.outputs.final_version }}'
       - id: fail-if-version-exists
@@ -73,7 +73,7 @@ jobs:
     needs: ensure-version-not-exists
     steps:
       - id: specification-mapper-bump-snapshot
-        uses: shihyuho/go-jenkins-trigger@v2
+        uses: shihyuho/go-jenkins-trigger@d6f3216fa650324688da24cbf081472e29d35d57 # v2
         with:
           jenkins-url: "${{ secrets.JENKINS_URL }}"
           jenkins-user: "${{ secrets.JENKINS_USER }}"

.github/workflows/bump-spring.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: get-latest-version
-        uses: shihyuho/go-spring-version@v1
+        uses: shihyuho/go-spring-version@9f72980d26ef9ec6b1b4858724135a4dc65e409a # v1
         with:
           boot-version: "~3.x"
     outputs:
@@ -39,7 +39,7 @@ jobs:
     needs: [latest-version, current-version]
     steps:
       - id: semver-compare
-        uses: madhead/semver-utils@latest
+        uses: madhead/semver-utils@4cf918affe9106ea59f86c6250e5ec4570ac4389 # v5.0.0
         with:
           version: ${{ needs.latest-version.outputs.spring-boot }}
           compare-to: ${{ needs.current-version.outputs.spring-boot }}
@@ -73,7 +73,7 @@ jobs:
           private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
       - name: Create Pull Request
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
           commit-message: "chore: bump spring-boot from ${{ needs.current-version.outputs.spring-boot }} to ${{ needs.latest-version.outputs.spring-boot }}"
@@ -98,4 +98,4 @@ jobs:
       actions: write
     steps:
       - uses: actions/checkout@v7
-      - uses: liskin/gh-workflow-keepalive@v1
+      - uses: liskin/gh-workflow-keepalive@f72ff1a1336129f29bf0166c0fd0ca6cf1bcb38c # v1.2.1

.github/workflows/commitlint.yml

@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
 
   # squash_merge_commit_title=COMMIT_OR_PR_TITLE -> 多 commit PR 的 squash subject = PR 標題,
   # 即 release-please 解析的 conventional commit。wagoid 只 lint commits 不 lint 標題,故額外補這個 job。

.github/workflows/release-please.yml

@@ -30,7 +30,7 @@ jobs:
         with:
           client-id: ${{ vars.CI_APP_CLIENT_ID }}
           private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
-      - uses: googleapis/[email protected]
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: rp
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -43,7 +43,7 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     steps:
       - id: specification-mapper-release
-        uses: shihyuho/go-jenkins-trigger@v2
+        uses: shihyuho/go-jenkins-trigger@d6f3216fa650324688da24cbf081472e29d35d57 # v2
         with:
           jenkins-url: "${{ secrets.JENKINS_URL }}"
           jenkins-user: "${{ secrets.JENKINS_USER }}"

.github/workflows/site-build.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
           hugo-version: '0.157.0'
           extended: true
@@ -44,7 +44,7 @@ jobs:
       - run: hugo --baseURL https://${REPO_OWNER}.github.io/${REPO_NAME} --environment production --minify
         working-directory: site
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         if: ${{ github.ref == 'refs/heads/jakarta' }}
         with:
           github_token: ${{ github.token }}

Jenkinsfile

@@ -154,7 +154,10 @@ spec:
     }
     failure {
       script {
-        if (env.BRANCH_NAME == 'main'
+        // BRANCH_IS_PRIMARY 由 multibranch 的 branch-api 在 SCM 預設分支上設為 'true',
+        // 不必隨預設分支改名而改這裡; 非 multibranch job 不會有這個變數, 故 fallback 比對分支名
+        def isPrimaryBranch = env.BRANCH_IS_PRIMARY == 'true' || env.BRANCH_NAME == 'jakarta'
+        if (isPrimaryBranch
             // 若短時間太密集的 push, 之前的 job 會被 jenkins 中斷，這樣就可能會就連第一步都還沒執行的狀況，但也算是失敗
             // 然而取得 git 資訊就在第一步，所以至少要第一步都有執行完才發佈 slack 吧
             && env.LAST_COMMIT_AUTHOR_NAME && env.LAST_COMMIT_AUTHOR_EMAIL && env.LAST_COMMIT_TIME) {