From 70542c9a942404a4d4f0ab56c029dc0f2e648b61 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Mon, 23 Mar 2026 23:46:44 -0700 Subject: [PATCH] chore: pin GitHub Actions to full-length commit SHAs --- .github/workflows/changelog.yaml | 2 +- .github/workflows/ci.yaml | 6 +++--- .github/workflows/codeql.yaml | 8 ++++---- .github/workflows/image.yaml | 2 +- .github/workflows/release-ghcr-version-tag.yaml | 2 +- .github/workflows/release.yaml | 4 ++-- .github/workflows/validate-pipelines.yaml | 10 +++++----- 7 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml index f8d49759..c715ec07 100644 --- a/.github/workflows/changelog.yaml +++ b/.github/workflows/changelog.yaml @@ -8,7 +8,7 @@ jobs: name: changelog runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5.0.0 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0b544c57..7a114913 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -36,7 +36,7 @@ jobs: all: - added|modified: '**/*' - - uses: actions/setup-go@v6 + - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 # this is way too slow to add to pre-commit - run: go mod tidy @@ -44,7 +44,7 @@ jobs: - run: go install golang.org/x/tools/cmd/goimports@v0.36.0 - name: golangci-lint - uses: golangci/golangci-lint-action@v8 + uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8 with: version: v2.4 install-mode: binary @@ -81,7 +81,7 @@ jobs: - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0 with: fetch-depth: 0 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 with: go-version: stable cache: false diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index f20f9337..8a32f63e 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -40,11 +40,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5.0.0 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@256d634097be96e792d6764f9edaefc4320557b1 # v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -58,7 +58,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@256d634097be96e792d6764f9edaefc4320557b1 # v4 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -71,6 +71,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@256d634097be96e792d6764f9edaefc4320557b1 # v4 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml index 391dc1d5..0b47dd92 100644 --- a/.github/workflows/image.yaml +++ b/.github/workflows/image.yaml @@ -134,7 +134,7 @@ jobs: steps: - name: Run Sentry self-hosted e2e CI - uses: getsentry/self-hosted@master + uses: getsentry/self-hosted@871c182cb0a99dc1fad72cc7ce7889b514b0c5f0 # master with: project_name: vroom image_url: ghcr.io/getsentry/vroom:${{ github.sha }} diff --git a/.github/workflows/release-ghcr-version-tag.yaml b/.github/workflows/release-ghcr-version-tag.yaml index d68ad83d..831af14c 100644 --- a/.github/workflows/release-ghcr-version-tag.yaml +++ b/.github/workflows/release-ghcr-version-tag.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a68bfbd8..22a4f5d0 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -26,12 +26,12 @@ jobs: with: app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }} - - uses: actions/checkout@v5.0.0 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: token: ${{ steps.token.outputs.token }} fetch-depth: 0 - name: Prepare release - uses: getsentry/action-prepare-release@v1 + uses: getsentry/action-prepare-release@c8e1c2009ab08259029170132c384f03c1064c0e # v1 env: GITHUB_TOKEN: ${{ steps.token.outputs.token }} with: diff --git a/.github/workflows/validate-pipelines.yaml b/.github/workflows/validate-pipelines.yaml index d8be8269..c35b1c86 100644 --- a/.github/workflows/validate-pipelines.yaml +++ b/.github/workflows/validate-pipelines.yaml @@ -17,7 +17,7 @@ jobs: outputs: gocd: ${{ steps.changes.outputs.gocd }} steps: - - uses: actions/checkout@v5.0.0 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Check for relevant file changes uses: getsentry/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: changes @@ -39,21 +39,21 @@ jobs: id-token: "write" steps: - - uses: actions/checkout@v5.0.0 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with: workload_identity_provider: 'projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool' service_account: 'gha-gocd-api@sac-prod-sa.iam.gserviceaccount.com' token_format: 'id_token' id_token_audience: '610575311308-9bsjtgqg4jm01mt058rncpopujgk3627.apps.googleusercontent.com' id_token_include_email: true - - uses: getsentry/action-gocd-jsonnet@v1 + - uses: getsentry/action-gocd-jsonnet@2a32414fa9e58a46d1afea9cbfa7b77a928678e2 # v1 with: jb-install: true jsonnet-dir: gocd/templates generated-dir: gocd/generated-pipelines - - uses: getsentry/action-validate-gocd-pipelines@v1 + - uses: getsentry/action-validate-gocd-pipelines@80fde540c1403d52e17783368930fa28bd93447f # v1 with: configrepo: vroom__main gocd_access_token: ${{ secrets.GOCD_ACCESS_TOKEN }}