mirror of
https://github.com/pocket-id/pocket-id.git
synced 2026-09-25 04:19:05 +02:00
chore: pin all GH Actions to a specific SHA (#1772)
Co-authored-by: Kyle Mendell <kyle@pocket-id.org>
This commit is contained in:
Alessandro (Ale) Segala
co-authored by
Kyle Mendell
Kyle Mendell
parent
4940df8397
commit
3516ec6940
@@ -41,14 +41,14 @@ jobs:
|
||||
fi
|
||||
|
||||
- name: Checkout release source
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup git-cliff
|
||||
uses: taiki-e/install-action@v2
|
||||
uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17
|
||||
with:
|
||||
tool: git-cliff@2.14.2
|
||||
|
||||
@@ -68,18 +68,9 @@ jobs:
|
||||
echo "tag=v$version" >> "$GITHUB_OUTPUT"
|
||||
echo "Preparing release v$version from $GITHUB_SHA." >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Setup pnpm
|
||||
- name: Setup Node.js and pnpm
|
||||
if: steps.version.outputs.tag != ''
|
||||
uses: pnpm/action-setup@v6
|
||||
with:
|
||||
run_install: false
|
||||
|
||||
- name: Setup Node.js
|
||||
if: steps.version.outputs.tag != ''
|
||||
uses: actions/setup-node@v6.5.0
|
||||
with:
|
||||
node-version: 24
|
||||
cache: pnpm
|
||||
uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
|
||||
|
||||
- name: Install dependencies
|
||||
if: steps.version.outputs.tag != ''
|
||||
@@ -101,7 +92,7 @@ jobs:
|
||||
- name: Create bot app token
|
||||
if: steps.version.outputs.tag != ''
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
||||
with:
|
||||
client-id: ${{ vars.BOT_APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
||||
@@ -147,14 +138,14 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
ref: ${{ needs.prepare.outputs.commit }}
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Create bot app token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
||||
with:
|
||||
client-id: ${{ vars.BOT_APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
||||
@@ -175,49 +166,40 @@ jobs:
|
||||
gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/release-notes.md" --draft
|
||||
fi
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/action-setup@v6
|
||||
with:
|
||||
run_install: false
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v6.5.0
|
||||
with:
|
||||
node-version: 24
|
||||
cache: pnpm
|
||||
- name: Setup Node.js and pnpm
|
||||
uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
|
||||
|
||||
- name: Setup Go
|
||||
uses: actions/setup-go@v6
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
||||
with:
|
||||
go-version-file: backend/go.mod
|
||||
cache-dependency-path: backend/go.sum
|
||||
|
||||
- name: Setup Syft
|
||||
uses: anchore/sbom-action/download-syft@v0.24.2
|
||||
uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
|
||||
with:
|
||||
syft-version: v1.52.0
|
||||
|
||||
- name: Set up Depot CLI
|
||||
uses: depot/setup-action@v1
|
||||
|
||||
- name: Setup depot buildx driver
|
||||
run: depot configure-docker
|
||||
uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
|
||||
with:
|
||||
configure-docker: true
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v4.6.0
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.repository_owner }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v4.6.0
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Run GoReleaser
|
||||
uses: goreleaser/goreleaser-action@v7.2.3
|
||||
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
|
||||
with:
|
||||
distribution: goreleaser-pro
|
||||
version: "~> v2"
|
||||
@@ -234,12 +216,12 @@ jobs:
|
||||
DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
|
||||
|
||||
- name: Binary attestation
|
||||
uses: actions/attest@v4.2.2
|
||||
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
|
||||
with:
|
||||
subject-checksums: ./dist/checksums.txt
|
||||
|
||||
- name: Container image attestation
|
||||
uses: actions/attest@v4.2.2
|
||||
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
|
||||
with:
|
||||
subject-checksums: ./dist/digests.txt
|
||||
|
||||
@@ -251,7 +233,7 @@ jobs:
|
||||
steps:
|
||||
- name: Create bot app token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
||||
with:
|
||||
client-id: ${{ vars.BOT_APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
||||
|
||||
Reference in New Issue
Block a user