Skip to content

Commit 2fe6e25

Browse files
danfiedler-msftkarthiknadig
danfiedler-msft
authored and
karthiknadig
committed
Pin GitHub Actions to full-length commit SHAs
1 parent 4b7a780 commit 2fe6e25

8 files changed

Lines changed: 49 additions & 38 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
groups:
6+
github-actions:
7+
patterns: ["*"]
8+
schedule:
9+
interval: "weekly"
10+
cooldown:
11+
default-days: 7

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
# target: aarch64-unknown-linux-musl
3737
steps:
3838
- name: Checkout
39-
uses: actions/checkout@v4
39+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
4040

4141
- name: Rust Tool Chain setup
4242
uses: dtolnay/rust-toolchain@stable
@@ -51,7 +51,7 @@ jobs:
5151
run: cargo build --release --target ${{ matrix.target }}
5252

5353
- name: Upload Artifact
54-
uses: actions/upload-artifact@v4
54+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5555
with:
5656
name: pet-${{ matrix.target }}
5757
path: target/${{ matrix.target }}/release/pet*

‎.github/workflows/coverage-baseline.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626
target: x86_64-pc-windows-msvc
2727
steps:
2828
- name: Checkout
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3030

3131
- name: Set Python to PATH
32-
uses: actions/setup-python@v5
32+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
3333
with:
3434
python-version: "3.12"
3535

@@ -135,7 +135,7 @@ jobs:
135135
shell: bash
136136

137137
- name: Install Pixi
138-
uses: prefix-dev/setup-pixi@v0.8.1
138+
uses: prefix-dev/setup-pixi@ba3bb36eb2066252b2363392b7739741bb777659 # v0.8.1
139139
with:
140140
run-install: false
141141

@@ -194,7 +194,7 @@ jobs:
194194
shell: bash
195195

196196
- name: Upload Coverage Artifact
197-
uses: actions/upload-artifact@v4
197+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
198198
with:
199199
name: coverage-baseline-${{ matrix.os }}
200200
path: lcov.info

‎.github/workflows/coverage.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ jobs:
3131
comment_header: coverage-windows
3232
steps:
3333
- name: Checkout
34-
uses: actions/checkout@v4
34+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3535

3636
- name: Post Coverage Started Comment
37-
uses: marocchino/sticky-pull-request-comment@v2
37+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
3838
with:
3939
header: ${{ matrix.comment_header }}
4040
message: |
@@ -45,7 +45,7 @@ jobs:
4545
Comparing against exact base `${{ github.event.pull_request.base.sha }}`.
4646
4747
- name: Set Python to PATH
48-
uses: actions/setup-python@v5
48+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
4949
with:
5050
python-version: "3.12"
5151

@@ -151,7 +151,7 @@ jobs:
151151
shell: bash
152152

153153
- name: Install Pixi
154-
uses: prefix-dev/setup-pixi@v0.8.1
154+
uses: prefix-dev/setup-pixi@ba3bb36eb2066252b2363392b7739741bb777659 # v0.8.1
155155
with:
156156
run-install: false
157157

@@ -202,7 +202,7 @@ jobs:
202202

203203
- name: Upload PR Coverage Artifact
204204
if: always()
205-
uses: actions/upload-artifact@v4
205+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
206206
with:
207207
name: coverage-pr-${{ matrix.os }}
208208
path: lcov.info
@@ -225,7 +225,7 @@ jobs:
225225

226226
- name: Download Exact PR Base Coverage
227227
if: always() && steps.wait_for_base_coverage.outcome == 'success'
228-
uses: dawidd6/action-download-artifact@v6
228+
uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
229229
with:
230230
workflow: coverage-baseline.yml
231231
commit: ${{ github.event.pull_request.base.sha }}
@@ -248,7 +248,7 @@ jobs:
248248

249249
- name: Post Coverage Comment
250250
if: always()
251-
uses: marocchino/sticky-pull-request-comment@v2
251+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
252252
with:
253253
header: ${{ matrix.comment_header }}
254254
path: coverage-report.md

‎.github/workflows/lint.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: Checkout
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
2020

2121
- name: Rust Tool Chain setup
2222
uses: dtolnay/rust-toolchain@stable
@@ -39,7 +39,7 @@ jobs:
3939
- macos-latest
4040
steps:
4141
- name: Checkout
42-
uses: actions/checkout@v4
42+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
4343

4444
- name: Rust Tool Chain setup
4545
uses: dtolnay/rust-toolchain@stable

‎.github/workflows/perf-baseline.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ jobs:
2828
target: x86_64-apple-darwin
2929
steps:
3030
- name: Checkout
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3232

3333
- name: Set Python to PATH
34-
uses: actions/setup-python@v5
34+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
3535
with:
3636
python-version: "3.12"
3737

@@ -111,7 +111,7 @@ jobs:
111111
shell: bash
112112

113113
- name: Upload Performance Baseline Artifact
114-
uses: actions/upload-artifact@v4
114+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
115115
with:
116116
name: perf-baseline-${{ matrix.os }}
117117
path: metrics.json

‎.github/workflows/perf-tests.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,11 @@ jobs:
3636
comment_header: perf-macos
3737
steps:
3838
- name: Checkout
39-
uses: actions/checkout@v4
39+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
4040

4141
- name: Post In-Progress Comment
4242
if: github.event_name == 'pull_request'
43-
uses: marocchino/sticky-pull-request-comment@v2
43+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
4444
with:
4545
header: ${{ matrix.comment_header }}
4646
message: |
@@ -49,7 +49,7 @@ jobs:
4949
Running performance tests against baseline `${{ github.event.pull_request.base.sha }}`.
5050
5151
- name: Set Python to PATH
52-
uses: actions/setup-python@v5
52+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
5353
with:
5454
python-version: "3.12"
5555

@@ -122,7 +122,7 @@ jobs:
122122

123123
- name: Upload PR Performance Results
124124
if: always()
125-
uses: actions/upload-artifact@v4
125+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
126126
with:
127127
name: perf-pr-${{ matrix.os }}
128128
path: metrics.json
@@ -147,7 +147,7 @@ jobs:
147147
if: >-
148148
always() && github.event_name == 'pull_request' &&
149149
steps.wait_for_base_performance.outcome == 'success'
150-
uses: dawidd6/action-download-artifact@v6
150+
uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
151151
with:
152152
workflow: perf-baseline.yml
153153
commit: ${{ github.event.pull_request.base.sha }}
@@ -159,7 +159,7 @@ jobs:
159159

160160
- name: Download Main Performance for Manual Run
161161
if: always() && github.event_name == 'workflow_dispatch'
162-
uses: dawidd6/action-download-artifact@v6
162+
uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
163163
with:
164164
workflow: perf-baseline.yml
165165
branch: main
@@ -182,7 +182,7 @@ jobs:
182182

183183
- name: Post Performance Comment
184184
if: always() && github.event_name == 'pull_request'
185-
uses: marocchino/sticky-pull-request-comment@v2
185+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
186186
with:
187187
header: ${{ matrix.comment_header }}
188188
path: performance-report.md

‎.github/workflows/pr-check.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,10 @@ jobs:
4040
run_cli: "yes"
4141
steps:
4242
- name: Checkout
43-
uses: actions/checkout@v4
43+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
4444

4545
- name: Set Python to PATH
46-
uses: actions/setup-python@v5
46+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
4747
with:
4848
python-version: "3.12"
4949

@@ -170,7 +170,7 @@ jobs:
170170

171171
# region Pixi
172172
- name: Install Pixi
173-
uses: prefix-dev/setup-pixi@v0.8.1
173+
uses: prefix-dev/setup-pixi@ba3bb36eb2066252b2363392b7739741bb777659 # v0.8.1
174174
with:
175175
run-install: false
176176

@@ -242,26 +242,26 @@ jobs:
242242
target: x86_64-pc-windows-msvc
243243
steps:
244244
- name: Checkout
245-
uses: actions/checkout@v4
245+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
246246

247247
# region Setup Poetry
248248
- name: Set Python 3.x to PATH
249249
if: startsWith( matrix.feature, 'ci-poetry')
250-
uses: actions/setup-python@v5
250+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
251251
with:
252252
python-version: "3.12"
253253

254254
- name: Set Python 3.12 to PATH
255255
if: startsWith( matrix.feature, 'ci-poetry')
256256
id: setupPython312
257-
uses: actions/setup-python@v5
257+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
258258
with:
259259
python-version: "3.12"
260260

261261
- name: Set Python 3.11 to PATH
262262
if: startsWith( matrix.feature, 'ci-poetry')
263263
id: setupPython311
264-
uses: actions/setup-python@v5
264+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
265265
with:
266266
python-version: "3.11"
267267

@@ -282,23 +282,23 @@ jobs:
282282

283283
- name: Install Poetry (envs globally)
284284
if: startsWith( matrix.feature, 'ci-poetry-global')
285-
uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
285+
uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # v1.3.4
286286
with:
287287
virtualenvs-create: true
288288
virtualenvs-in-project: false
289289
installer-parallel: true
290290

291291
- name: Install Poetry (env locally)
292292
if: startsWith( matrix.feature, 'ci-poetry-project')
293-
uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
293+
uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # v1.3.4
294294
with:
295295
virtualenvs-create: true
296296
virtualenvs-in-project: true
297297
installer-parallel: true
298298

299299
- name: Install Poetry (env locally)
300300
if: startsWith( matrix.feature, 'ci-poetry-custom')
301-
uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
301+
uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b # v1.3.4
302302
with:
303303
virtualenvs-create: true
304304
virtualenvs-in-project: false
@@ -408,7 +408,7 @@ jobs:
408408
target: x86_64-unknown-linux-musl
409409
steps:
410410
- name: Checkout
411-
uses: actions/checkout@v4
411+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
412412

413413
# Homebrew
414414
- name: Homebrew Python
@@ -471,7 +471,7 @@ jobs:
471471
# target: aarch64-unknown-linux-musl
472472
steps:
473473
- name: Checkout
474-
uses: actions/checkout@v4
474+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
475475

476476
- name: Rust Tool Chain setup
477477
uses: dtolnay/rust-toolchain@stable
@@ -494,7 +494,7 @@ jobs:
494494
shell: bash
495495

496496
- name: Upload Artifact
497-
uses: actions/upload-artifact@v4
497+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
498498
with:
499499
name: pet-${{ matrix.target }}
500500
path: target/${{ matrix.target }}/release/pet*

0 commit comments

Comments
 (0)