From eaf87916f1d3d953b929c4e88f410aca3ab2848e Mon Sep 17 00:00:00 2001 From: Evan Huus Date: Mon, 4 May 2026 15:04:38 -0400 Subject: [PATCH] Harden CI image refs --- .github/workflows/changie-gen.yaml | 6 +++--- .github/workflows/release.yaml | 21 ++++++++++----------- .github/workflows/reports.yml | 4 ++-- .github/workflows/tests-integration.yml | 6 +++--- .github/workflows/tests.yml | 10 +++++----- 5 files changed, 23 insertions(+), 24 deletions(-) diff --git a/.github/workflows/changie-gen.yaml b/.github/workflows/changie-gen.yaml index 7f9f09d8..7d160b93 100644 --- a/.github/workflows/changie-gen.yaml +++ b/.github/workflows/changie-gen.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout branch that Dependabot labeled if: github.event.workflow_run.conclusion == 'success' - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: ref: ${{ env.PR_BRANCH }} token: ${{ secrets.GITHUB_TOKEN }} @@ -43,7 +43,7 @@ jobs: if: >- github.event.workflow_run.conclusion == 'success' && steps.changelog_check.outputs.exists == 'false' - uses: miniscruff/changie-action@v2 + uses: miniscruff/changie-action@6dcc2533cac0495148ed4046c438487e4dceaa23 # v2 with: version: latest args: new --kind Dependency --body "${{ github.event.workflow_run.display_title }}" @@ -59,4 +59,4 @@ jobs: git pull git add . git commit -m "Add automated changelog yaml from template" - git push \ No newline at end of file + git push diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 22455bf4..0ddaec7a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: fetch-depth: 0 submodules: 'true' @@ -22,13 +22,13 @@ jobs: - name: Fetch All Tags run: git fetch --force --tags - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: src/go.mod cache-dependency-path: | src/go.sum - name: Cache Go modules - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: | ~/.cache/go-build @@ -38,17 +38,17 @@ jobs: ${{ runner.os }}-go- - name: Import GPG Key id: import_gpg - uses: crazy-max/ghaction-import-gpg@v6 + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.GPG_PASSPHRASE }} - name: Install Task - uses: arduino/setup-task@v2 + uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0 with: version: 3.x repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Login to Public ECR - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: public.ecr.aws username: ${{ secrets.ECR_PUBLIC_AWS_ACCESS_KEY_ID }} @@ -74,9 +74,8 @@ jobs: then echo "Skip Changie..." else - go install github.com/miniscruff/changie@latest - changie batch ${{ steps.version.outputs.RELEASE_VERSION }} - changie merge + (cd src && go tool changie batch --dir .. ${{ steps.version.outputs.RELEASE_VERSION }}) + (cd src && go tool changie merge --dir ..) git add . git commit -m "Cut Release '${{ steps.version.outputs.RELEASE_VERSION }}'" git push origin HEAD @@ -84,9 +83,9 @@ jobs: git tag -f ${{ steps.version.outputs.RELEASE_VERSION }} -m "Cut Release '${{ steps.version.outputs.RELEASE_VERSION }}'" git push -f origin refs/tags/${{ steps.version.outputs.RELEASE_VERSION }} - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v6.1.0 + uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0 with: args: release --clean --release-notes=../.changes/${{ steps.version.outputs.RELEASE_VERSION }}.md workdir: ./src diff --git a/.github/workflows/reports.yml b/.github/workflows/reports.yml index 31e477a3..a4e84df5 100644 --- a/.github/workflows/reports.yml +++ b/.github/workflows/reports.yml @@ -13,12 +13,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: fetch-depth: 0 submodules: 'true' - name: Snyk Test - uses: snyk/actions/golang@master + uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # master continue-on-error: true env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/tests-integration.yml b/.github/workflows/tests-integration.yml index fe2a2f28..9762e8e8 100644 --- a/.github/workflows/tests-integration.yml +++ b/.github/workflows/tests-integration.yml @@ -10,15 +10,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod cache-dependency-path: | src/go.sum - name: Install Task - uses: arduino/setup-task@v2 + uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0 with: version: 3.x repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 650e33f7..76b9993d 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -16,25 +16,25 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: fetch-depth: 0 submodules: 'true' - name: Fetch all tags run: git fetch --force --tags - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: src/go.mod cache-dependency-path: | src/go.sum - name: Install Task - uses: arduino/setup-task@v2 + uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0 with: version: 3.x repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Cache Go modules - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: | ~/.cache/go-build @@ -45,7 +45,7 @@ jobs: - name: Run quality checks and test code run: task ci - name: Upload Coverage - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5 with: files: ./src/coverage.txt fail_ci_if_error: false