From cd0bb1c4af87976616e7f426e1646eafad3683b8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 22:59:44 +0000 Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@ # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins. --- .github/workflows/boj-build.yml | 2 +- .github/workflows/casket-pages.yml | 14 +++++----- .github/workflows/instant-sync.yml | 2 +- .github/workflows/pages.yml | 8 +++--- .github/workflows/push-email-notify.yml | 2 +- journal-theme/.github/workflows/ci.yml | 28 ++++++++++--------- .../.github/workflows/php-security.yml | 2 +- .../.github/workflows/php-standards.yml | 10 +++---- journal-theme/.github/workflows/release.yml | 16 ++++++----- .../.github/workflows/rescript-deno-ci.yml | 4 +-- journal-theme/.github/workflows/rust-ci.yml | 9 +++--- journal-theme/.github/workflows/scorecard.yml | 2 +- .../generator-generic-ossf-slsa3-publish.yml | 2 +- praxis/.github/workflows/test.yml | 26 ++++++++--------- praxis/.github/workflows/verification.yml | 4 +-- .../generator-generic-ossf-slsa3-publish.yml | 2 +- resurrect/.github/workflows/scorecard.yml | 2 +- .../generator-generic-ossf-slsa3-publish.yml | 2 +- 18 files changed, 71 insertions(+), 66 deletions(-) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 6e84820..c41980c 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -11,7 +11,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 7dacdfb..9bc81c0 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -18,19 +18,19 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout casket-ssg - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@v2.12.0 + uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cabal/packages @@ -88,9 +88,9 @@ jobs: cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site touch ../_site/.nojekyll - name: Setup Pages - uses: actions/configure-pages@v6.0.0 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@v5.0.0 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: '_site' deploy: @@ -103,4 +103,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5.0.1 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index eb26e3d..1c78bb3 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -15,7 +15,7 @@ jobs: timeout-minutes: 15 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@v4.0.1 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index b6001fd..81de5db 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -20,9 +20,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -39,7 +39,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@v5.0.0 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: '_site' deploy: @@ -52,4 +52,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5.0.1 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 8d1f093..521f1e5 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -40,7 +40,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@v0.3.0 # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) + uses: hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/journal-theme/.github/workflows/ci.yml b/journal-theme/.github/workflows/ci.yml index a5d9c6c..33b6034 100644 --- a/journal-theme/.github/workflows/ci.yml +++ b/journal-theme/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' coverage: none @@ -62,7 +62,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: mbstring, mysql @@ -75,7 +75,7 @@ jobs: - name: Run PHPUnit tests run: vendor/bin/phpunit --coverage-clover=coverage.xml --testdox - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: files: ./coverage.xml flags: php-${{ matrix.php }}-wp-${{ matrix.wordpress }} @@ -114,7 +114,7 @@ jobs: - name: Run Jest tests run: npm test -- --coverage --coverageReporters=json --coverageReporters=lcov - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: files: ./coverage/lcov.info flags: javascript @@ -127,7 +127,9 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + with: + toolchain: stable with: targets: wasm32-unknown-unknown components: rustfmt, clippy @@ -167,7 +169,7 @@ jobs: node-version: '20' cache: 'npm' - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: targets: wasm32-unknown-unknown - name: Install wasm-pack @@ -177,7 +179,7 @@ jobs: - name: Build all assets run: npm run build - name: Upload build artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: build-artifacts path: | @@ -199,7 +201,7 @@ jobs: run: npm audit --audit-level=moderate continue-on-error: true - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer @@ -209,7 +211,7 @@ jobs: run: composer audit continue-on-error: true - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - name: Install cargo-audit run: cargo install cargo-audit - name: Cargo audit @@ -223,9 +225,9 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build container - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./Containerfile @@ -234,13 +236,13 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # master with: image-ref: sinople-theme:test format: 'sarif' output: 'trivy-results.sarif' - name: Upload Trivy results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: sarif_file: 'trivy-results.sarif' accessibility: diff --git a/journal-theme/.github/workflows/php-security.yml b/journal-theme/.github/workflows/php-security.yml index 0f57e1f..ad90ac3 100644 --- a/journal-theme/.github/workflows/php-security.yml +++ b/journal-theme/.github/workflows/php-security.yml @@ -71,7 +71,7 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' tools: composer diff --git a/journal-theme/.github/workflows/php-standards.yml b/journal-theme/.github/workflows/php-standards.yml index 18654a1..5775d8a 100644 --- a/journal-theme/.github/workflows/php-standards.yml +++ b/journal-theme/.github/workflows/php-standards.yml @@ -30,7 +30,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' coverage: none @@ -65,7 +65,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' coverage: none @@ -95,7 +95,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP ${{ matrix.php }} - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} coverage: none @@ -135,7 +135,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP ${{ matrix.php }} - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: mysqli, mbstring @@ -156,7 +156,7 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' coverage: none diff --git a/journal-theme/.github/workflows/release.yml b/journal-theme/.github/workflows/release.yml index 8c190ea..9eabef7 100644 --- a/journal-theme/.github/workflows/release.yml +++ b/journal-theme/.github/workflows/release.yml @@ -21,7 +21,9 @@ jobs: node-version: '20' cache: 'npm' - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + with: + toolchain: stable with: targets: wasm32-unknown-unknown - name: Install wasm-pack @@ -57,7 +59,7 @@ jobs: npm install -g @cyclonedx/cyclonedx-npm cyclonedx-npm --output-file sbom.json - name: Create Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: files: | dist/sinople-${{ steps.version.outputs.VERSION }}.zip @@ -73,16 +75,16 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ghcr.io/${{ github.repository }} tags: | @@ -91,7 +93,7 @@ jobs: type=semver,pattern={{major}} type=sha - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./Containerfile @@ -101,7 +103,7 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max - name: Install cosign - uses: sigstore/cosign-installer@v3 + uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3 - name: Sign container image run: | cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.meta.outputs.digest }} diff --git a/journal-theme/.github/workflows/rescript-deno-ci.yml b/journal-theme/.github/workflows/rescript-deno-ci.yml index 150abeb..568d27d 100644 --- a/journal-theme/.github/workflows/rescript-deno-ci.yml +++ b/journal-theme/.github/workflows/rescript-deno-ci.yml @@ -7,7 +7,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: denoland/setup-deno@v2 + - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2 with: deno-version: v1.x - name: Deno lint @@ -29,7 +29,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: denoland/setup-deno@v2 + - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2 - name: Check permissions run: | # Audit for dangerous permissions diff --git a/journal-theme/.github/workflows/rust-ci.yml b/journal-theme/.github/workflows/rust-ci.yml index 8d214a5..c0318a9 100644 --- a/journal-theme/.github/workflows/rust-ci.yml +++ b/journal-theme/.github/workflows/rust-ci.yml @@ -10,8 +10,9 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: + toolchain: stable components: rustfmt, clippy - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - name: Check formatting @@ -27,7 +28,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - name: Install cargo-audit run: cargo install cargo-audit - name: Security audit @@ -39,11 +40,11 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - name: Install tarpaulin run: cargo install cargo-tarpaulin - name: Generate coverage run: cargo tarpaulin --out Xml - - uses: codecov/codecov-action@v5 + - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: files: cobertura.xml diff --git a/journal-theme/.github/workflows/scorecard.yml b/journal-theme/.github/workflows/scorecard.yml index 5d87703..4a874b0 100644 --- a/journal-theme/.github/workflows/scorecard.yml +++ b/journal-theme/.github/workflows/scorecard.yml @@ -23,6 +23,6 @@ jobs: results_file: results.sarif results_format: sarif - name: Upload results - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: sarif_file: results.sarif diff --git a/plugin-conflict-mapper/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/plugin-conflict-mapper/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 49a45ce..38ee537 100644 --- a/plugin-conflict-mapper/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/plugin-conflict-mapper/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -57,7 +57,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@68bad40844440577b33778c9f29077a3388838e9 # v1.4.0 with: base64-subjects: "${{ needs.build.outputs.digests }}" upload-assets: true # Optional: Upload to a new release diff --git a/praxis/.github/workflows/test.yml b/praxis/.github/workflows/test.yml index dc8217c..afcc940 100644 --- a/praxis/.github/workflows/test.yml +++ b/praxis/.github/workflows/test.yml @@ -62,7 +62,7 @@ jobs: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Rust - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: ${{ env.RUST_VERSION }} override: true @@ -78,27 +78,27 @@ jobs: wp_injector/target/ key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - name: Check Rust formatting - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: fmt args: --manifest-path wp_injector/Cargo.toml --all -- --check - name: Run Clippy - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: clippy args: --manifest-path wp_injector/Cargo.toml --all-targets --all-features -- -D warnings - name: Run Rust tests - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: test args: --manifest-path wp_injector/Cargo.toml --all-features --verbose - name: Generate coverage report - uses: actions-rs/tarpaulin@v0.1 + uses: actions-rs/tarpaulin@044a1e5bdace8dd2f727b1af63c1d9a1d3572068 # v0.1 with: version: '0.22.0' args: '--manifest-path wp_injector/Cargo.toml --out Xml --output-dir tests/coverage' - name: Upload Rust coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: files: ./tests/coverage/cobertura.xml flags: rust @@ -117,7 +117,7 @@ jobs: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Elixir - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1 with: elixir-version: ${{ env.ELIXIR_VERSION }} otp-version: ${{ env.OTP_VERSION }} @@ -148,7 +148,7 @@ jobs: working-directory: Core/cli-wrapper run: mix test --cover - name: Upload Elixir coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: files: ./Core/db-schema/cover/excoveralls.json flags: elixir @@ -170,7 +170,7 @@ jobs: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ env.PHP_VERSION }} extensions: mbstring, xml, mysql, mysqli @@ -195,7 +195,7 @@ jobs: run: | if [ -f phpunit.xml ]; then vendor/bin/phpunit --configuration phpunit.xml; fi - name: Upload PHP coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: files: ./tests/coverage/php-clover.xml flags: php @@ -211,7 +211,7 @@ jobs: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Bun - uses: oven-sh/setup-bun@v1 + uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # v1 with: bun-version: ${{ env.BUN_VERSION }} - name: Install dependencies (swarm) @@ -224,7 +224,7 @@ jobs: run: bun install || true working-directory: SymbolicEngine/dashboard run: bun test --coverage || true - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: files: ./SymbolicEngine/swarm/coverage/coverage-final.json # E2E Tests @@ -267,7 +267,7 @@ jobs: echo "Coverage artifacts downloaded" ls -R coverage-artifacts/ - name: Upload combined coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: directory: ./coverage-artifacts flags: combined diff --git a/praxis/.github/workflows/verification.yml b/praxis/.github/workflows/verification.yml index 9ed9741..fbfeb4b 100644 --- a/praxis/.github/workflows/verification.yml +++ b/praxis/.github/workflows/verification.yml @@ -19,7 +19,7 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1 with: toolchain: stable - name: Install Kani @@ -57,7 +57,7 @@ jobs: retention-days: 30 - name: Comment PR with verification results if: github.event_name == 'pull_request' && always() - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const fs = require('fs'); diff --git a/project-wharf/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/project-wharf/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 3214b30..4c79635 100644 --- a/project-wharf/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/project-wharf/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -34,7 +34,7 @@ jobs: actions: read id-token: write contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0 with: base64-subjects: "${{ needs.build.outputs.digests }}" upload-assets: true diff --git a/resurrect/.github/workflows/scorecard.yml b/resurrect/.github/workflows/scorecard.yml index 5d87703..4a874b0 100644 --- a/resurrect/.github/workflows/scorecard.yml +++ b/resurrect/.github/workflows/scorecard.yml @@ -23,6 +23,6 @@ jobs: results_file: results.sarif results_format: sarif - name: Upload results - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: sarif_file: results.sarif diff --git a/sinople-theme/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/sinople-theme/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 49a45ce..38ee537 100644 --- a/sinople-theme/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/sinople-theme/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -57,7 +57,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@68bad40844440577b33778c9f29077a3388838e9 # v1.4.0 with: base64-subjects: "${{ needs.build.outputs.digests }}" upload-assets: true # Optional: Upload to a new release