From 3516ec69409e67c704061a7b963db0221fe605f2 Mon Sep 17 00:00:00 2001 From: "Alessandro (Ale) Segala" <43508+ItalyPaleAle@users.noreply.github.com> Date: Mon, 21 Sep 2026 10:32:21 -0700 Subject: [PATCH] chore: pin all GH Actions to a specific SHA (#1772) Co-authored-by: Kyle Mendell --- .github/workflows/backend-linter.yml | 6 +-- .github/workflows/build-next.yml | 33 ++++++---------- .github/workflows/e2e-tests.yml | 19 +++------ .github/workflows/pr-quality.yml | 4 +- .github/workflows/release.yml | 58 ++++++++++------------------ .github/workflows/svelte-check.yml | 12 ++---- .github/workflows/unit-tests.yml | 8 ++-- .github/workflows/update-aaguids.yml | 8 ++-- .node-version | 1 + 9 files changed, 55 insertions(+), 94 deletions(-) create mode 100644 .node-version diff --git a/.github/workflows/backend-linter.yml b/.github/workflows/backend-linter.yml index a0ce2898..c4c7b36e 100644 --- a/.github/workflows/backend-linter.yml +++ b/.github/workflows/backend-linter.yml @@ -24,15 +24,15 @@ jobs: runs-on: depot-ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: backend/go.mod - name: Run Golangci-lint - uses: golangci/golangci-lint-action@v9.3.0 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.13.2 args: --config=.golangci.yml diff --git a/.github/workflows/build-next.yml b/.github/workflows/build-next.yml index f5b70184..4c4e19a4 100644 --- a/.github/workflows/build-next.yml +++ b/.github/workflows/build-next.yml @@ -23,48 +23,39 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - run_install: false - - - name: Setup Node.js - uses: actions/setup-node@v6.5.0 - with: - node-version: 24 - cache: pnpm + - name: Setup Node.js and pnpm + uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: backend/go.mod cache-dependency-path: backend/go.sum - name: Set up Depot CLI - uses: depot/setup-action@v1 - - - name: Setup depot buildx driver - run: depot configure-docker + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 + with: + configure-docker: true - name: Login to GitHub Container Registry - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v7.2.3 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: distribution: goreleaser-pro version: "~> v2" @@ -82,11 +73,11 @@ jobs: MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} - name: Binary attestation - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-checksums: ./dist/checksums.txt - name: Container image attestation - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-checksums: ./dist/digests.txt diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 22eb2875..2a97e879 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -47,22 +47,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Setup pnpm - uses: pnpm/action-setup@v6 - - - name: Setup Node.js - uses: actions/setup-node@v6.5.0 - with: - node-version: 24 - cache: "pnpm" + - name: Setup Node.js and pnpm + uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0 - name: Set up Depot CLI - uses: depot/setup-action@v1 - - - name: Set up Depot Docker builder - run: depot configure-docker + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 + with: + configure-docker: true - name: Cache Playwright Browsers uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml index 869ea7ec..6e9ba396 100644 --- a/.github/workflows/pr-quality.yml +++ b/.github/workflows/pr-quality.yml @@ -12,7 +12,7 @@ jobs: steps: - name: Create bot app token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BOT_APP_CLIENT_ID }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} @@ -20,7 +20,7 @@ jobs: permission-issues: read permission-pull-requests: write - - uses: peakoss/anti-slop@v0 + - uses: peakoss/anti-slop@57858eead489d08b255fab2af45a506c2ca6eab2 # v0.3.0 with: github-token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 50b0a505..0636deb0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,14 +41,14 @@ jobs: fi - name: Checkout release source - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} fetch-depth: 0 persist-credentials: false - name: Setup git-cliff - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17 with: tool: git-cliff@2.14.2 @@ -68,18 +68,9 @@ jobs: echo "tag=v$version" >> "$GITHUB_OUTPUT" echo "Preparing release v$version from $GITHUB_SHA." >> "$GITHUB_STEP_SUMMARY" - - name: Setup pnpm + - name: Setup Node.js and pnpm if: steps.version.outputs.tag != '' - uses: pnpm/action-setup@v6 - with: - run_install: false - - - name: Setup Node.js - if: steps.version.outputs.tag != '' - uses: actions/setup-node@v6.5.0 - with: - node-version: 24 - cache: pnpm + uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0 - name: Install dependencies if: steps.version.outputs.tag != '' @@ -101,7 +92,7 @@ jobs: - name: Create bot app token if: steps.version.outputs.tag != '' id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BOT_APP_CLIENT_ID }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} @@ -147,14 +138,14 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.prepare.outputs.commit }} fetch-depth: 0 - name: Create bot app token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BOT_APP_CLIENT_ID }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} @@ -175,49 +166,40 @@ jobs: gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/release-notes.md" --draft fi - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - run_install: false - - - name: Setup Node.js - uses: actions/setup-node@v6.5.0 - with: - node-version: 24 - cache: pnpm + - name: Setup Node.js and pnpm + uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: backend/go.mod cache-dependency-path: backend/go.sum - name: Setup Syft - uses: anchore/sbom-action/download-syft@v0.24.2 + uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: syft-version: v1.52.0 - name: Set up Depot CLI - uses: depot/setup-action@v1 - - - name: Setup depot buildx driver - run: depot configure-docker + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 + with: + configure-docker: true - name: Login to GitHub Container Registry - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v7.2.3 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: distribution: goreleaser-pro version: "~> v2" @@ -234,12 +216,12 @@ jobs: DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }} - name: Binary attestation - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-checksums: ./dist/checksums.txt - name: Container image attestation - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-checksums: ./dist/digests.txt @@ -251,7 +233,7 @@ jobs: steps: - name: Create bot app token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BOT_APP_CLIENT_ID }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/svelte-check.yml b/.github/workflows/svelte-check.yml index e4e60ff1..2db0415a 100644 --- a/.github/workflows/svelte-check.yml +++ b/.github/workflows/svelte-check.yml @@ -33,16 +33,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Setup pnpm - uses: pnpm/action-setup@v6 - - - name: Setup Node.js - uses: actions/setup-node@v6.5.0 - with: - node-version: 24 - cache: "pnpm" + - name: Setup Node.js and pnpm + uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0 - name: Install dependencies run: pnpm --filter pocket-id-frontend install --frozen-lockfile diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index f75f0903..461abc92 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -25,8 +25,8 @@ jobs: runner: windows-latest runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: "backend/go.mod" cache-dependency-path: "backend/go.sum" @@ -42,8 +42,8 @@ jobs: name: Backend (race detector) runs-on: depot-ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: "backend/go.mod" cache-dependency-path: "backend/go.sum" diff --git a/.github/workflows/update-aaguids.yml b/.github/workflows/update-aaguids.yml index 4362d919..1f2281da 100644 --- a/.github/workflows/update-aaguids.yml +++ b/.github/workflows/update-aaguids.yml @@ -14,12 +14,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable @@ -28,7 +28,7 @@ jobs: - name: Create bot app token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BOT_APP_CLIENT_ID }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} @@ -46,7 +46,7 @@ jobs: echo "identity=Pocket ID Bot <$bot_id+$bot_name@users.noreply.github.com>" >> "$GITHUB_OUTPUT" - name: Create Pull Request - uses: peter-evans/create-pull-request@v7 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ steps.app-token.outputs.token }} author: ${{ steps.bot.outputs.identity }} diff --git a/.node-version b/.node-version new file mode 100644 index 00000000..cabf43b5 --- /dev/null +++ b/.node-version @@ -0,0 +1 @@ +24 \ No newline at end of file