From 185e1c0765631756b9e42208a220062d1ed400d1 Mon Sep 17 00:00:00 2001 From: Eguzki Astiz Lezaun Date: Wed, 29 Jul 2026 17:57:17 +0200 Subject: [PATCH 1/3] harden workflows: pin every use Signed-off-by: Eguzki Astiz Lezaun --- .github/dependabot.yml | 6 ++++++ .github/workflows/code-style.yaml | 6 +++--- .github/workflows/commands.yaml | 6 +++--- .github/workflows/plugins.yaml | 2 +- .github/workflows/release.yaml | 4 ++-- .github/workflows/testing.yaml | 12 ++++++------ 6 files changed, 21 insertions(+), 15 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5ace460 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/code-style.yaml b/.github/workflows/code-style.yaml index 8870122..1cd26ef 100644 --- a/.github/workflows/code-style.yaml +++ b/.github/workflows/code-style.yaml @@ -14,13 +14,13 @@ jobs: steps: - name: Set up Go 1.23.x - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: run lint test run: | @@ -35,5 +35,5 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success" or .result == "skipped")' diff --git a/.github/workflows/commands.yaml b/.github/workflows/commands.yaml index a5ffffc..d0fca8f 100644 --- a/.github/workflows/commands.yaml +++ b/.github/workflows/commands.yaml @@ -19,12 +19,12 @@ jobs: KIND_CLUSTER_NAME: kuadrantctl-local steps: - name: Set up Go 1.23.x - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: build run: | make install @@ -42,5 +42,5 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success" or .result == "skipped")' diff --git a/.github/workflows/plugins.yaml b/.github/workflows/plugins.yaml index e8f621f..a70e4a0 100644 --- a/.github/workflows/plugins.yaml +++ b/.github/workflows/plugins.yaml @@ -33,7 +33,7 @@ jobs: ORG_NAME: ${{ github.repository_owner }} steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Run Bash Script run: | diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index fc023c2..d7f3016 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -20,8 +20,8 @@ jobs: goos: [linux, darwin] goarch: [amd64, arm64] steps: - - uses: actions/checkout@v4 - - uses: wangyoucao577/go-release-action@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.55 with: github_token: ${{ secrets.GITHUB_TOKEN }} goos: ${{ matrix.goos }} diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index 5f2bb37..e308408 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -17,12 +17,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up Go 1.23.x - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: make install run: | make install @@ -34,12 +34,12 @@ jobs: KIND_CLUSTER_NAME: kuadrantctl-local steps: - name: Set up Go 1.23.x - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Run tests run: | make test @@ -48,7 +48,7 @@ jobs: # Only run if the feature branch is in your repo (not in a fork) # as Tokenless uploading is rate limited for public repos if: github.event.pull_request.head.repo.full_name == github.repository - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0 with: token: ${{ secrets.CODECOV_TOKEN }} fail_ci_if_error: false @@ -65,5 +65,5 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success" or .result == "skipped")' From c776e2e3beb7b9fe9bbb13e79da46c7ae6b4e696 Mon Sep 17 00:00:00 2001 From: Eguzki Astiz Lezaun Date: Wed, 29 Jul 2026 18:11:52 +0200 Subject: [PATCH 2/3] remove unused checkout actions Signed-off-by: Eguzki Astiz Lezaun --- .github/workflows/code-style.yaml | 1 - .github/workflows/commands.yaml | 1 - .github/workflows/testing.yaml | 1 - 3 files changed, 3 deletions(-) diff --git a/.github/workflows/code-style.yaml b/.github/workflows/code-style.yaml index 1cd26ef..195fbd2 100644 --- a/.github/workflows/code-style.yaml +++ b/.github/workflows/code-style.yaml @@ -35,5 +35,4 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success" or .result == "skipped")' diff --git a/.github/workflows/commands.yaml b/.github/workflows/commands.yaml index d0fca8f..7b2c8fe 100644 --- a/.github/workflows/commands.yaml +++ b/.github/workflows/commands.yaml @@ -42,5 +42,4 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success" or .result == "skipped")' diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index e308408..e583e72 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -65,5 +65,4 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success" or .result == "skipped")' From ca9d604a48a21da1ff4ee3b7ef799b9a7d18fbaa Mon Sep 17 00:00:00 2001 From: Eguzki Astiz Lezaun Date: Mon, 24 Aug 2026 16:27:03 +0200 Subject: [PATCH 3/3] github checkout action pinned to v7.0.1 Signed-off-by: Eguzki Astiz Lezaun --- .github/workflows/code-style.yaml | 2 +- .github/workflows/commands.yaml | 2 +- .github/workflows/plugins.yaml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/testing.yaml | 4 ++-- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/code-style.yaml b/.github/workflows/code-style.yaml index 195fbd2..8383770 100644 --- a/.github/workflows/code-style.yaml +++ b/.github/workflows/code-style.yaml @@ -20,7 +20,7 @@ jobs: id: go - name: Check out code - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run lint test run: | diff --git a/.github/workflows/commands.yaml b/.github/workflows/commands.yaml index 7b2c8fe..df083cf 100644 --- a/.github/workflows/commands.yaml +++ b/.github/workflows/commands.yaml @@ -24,7 +24,7 @@ jobs: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: build run: | make install diff --git a/.github/workflows/plugins.yaml b/.github/workflows/plugins.yaml index a70e4a0..c0046c2 100644 --- a/.github/workflows/plugins.yaml +++ b/.github/workflows/plugins.yaml @@ -33,7 +33,7 @@ jobs: ORG_NAME: ${{ github.repository_owner }} steps: - name: Checkout Repository - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run Bash Script run: | diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d7f3016..1ed8658 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -20,7 +20,7 @@ jobs: goos: [linux, darwin] goarch: [amd64, arm64] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.55 with: github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index e583e72..8d5eda7 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -22,7 +22,7 @@ jobs: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: make install run: | make install @@ -39,7 +39,7 @@ jobs: go-version: 1.23.x id: go - name: Check out code - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run tests run: | make test