From da83f5614b580ed9878206c1f2149fce6f8ea2b4 Mon Sep 17 00:00:00 2001 From: Elisa Date: Tue, 19 May 2026 22:15:08 +0200 Subject: [PATCH] feat: pin GitHub Actions to SHA digests and add pin-check workflow --- .github/workflows/conventional-commits.yml | 6 ++--- .github/workflows/golang.yaml | 14 +++++------ .github/workflows/issues-add-to-project.yml | 2 +- .github/workflows/osv-scanner.yml | 4 +-- .github/workflows/release-drafter.yaml | 2 +- .github/workflows/release.yaml | 18 +++++++------- .github/workflows/update-action-pins.yml | 27 +++++++++++++++++++++ 7 files changed, 50 insertions(+), 23 deletions(-) create mode 100644 .github/workflows/update-action-pins.yml diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml index 44ca2a5..21eafba 100644 --- a/.github/workflows/conventional-commits.yml +++ b/.github/workflows/conventional-commits.yml @@ -13,7 +13,7 @@ jobs: name: PR Title runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -33,9 +33,9 @@ jobs: name: Commit Messages runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 - - uses: wagoid/commitlint-github-action@v6 + - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6 with: configFile: .commitlintrc.yml diff --git a/.github/workflows/golang.yaml b/.github/workflows/golang.yaml index d71013d..964cc4f 100644 --- a/.github/workflows/golang.yaml +++ b/.github/workflows/golang.yaml @@ -29,7 +29,7 @@ jobs: outputs: go-version: ${{ steps.get-go-version.outputs.version }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: get-go-version id: get-go-version run: | @@ -39,32 +39,32 @@ jobs: exit 1 fi echo "version=$GO_VERSION" >> $GITHUB_OUTPUT - - uses: actions/setup-go@v6 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version: ${{ steps.get-go-version.outputs.version }} - name: lint-no-golangci run: | make lint-no-golangci - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9 test: needs: lint runs-on: arc-scale-set steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version: ${{ needs.lint.outputs.go-version }} - name: test run: | make test - name: Convert coverage to lcov - uses: jandelgado/gcov2lcov-action@v1.2.0 + uses: jandelgado/gcov2lcov-action@e4612787670fc5b5f49026b8c29c5569921de1db # v1.2.0 with: infile: ocm-kit.coverprofile - name: Coveralls GitHub Action - uses: coverallsapp/github-action@v2.3.7 + uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7 with: github-token: ${{ secrets.github_token }} path-to-lcov: coverage.lcov diff --git a/.github/workflows/issues-add-to-project.yml b/.github/workflows/issues-add-to-project.yml index 9d9281c..b285e62 100644 --- a/.github/workflows/issues-add-to-project.yml +++ b/.github/workflows/issues-add-to-project.yml @@ -13,7 +13,7 @@ jobs: name: Add issue to project runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@v2 + - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2 with: project-url: https://github.com/orgs/opendefensecloud/projects/3 github-token: ${{ secrets.ADD_TO_PROJECT_PAT }} diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 69cd76b..0f1e451 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -21,7 +21,7 @@ permissions: jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5 # v2.3.5 with: # Example of specifying custom arguments scan-args: |- @@ -31,7 +31,7 @@ jobs: ./ scan-pr: if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c51854704019a247608d928f370c98740469d4b5 # v2.3.5 with: # Example of specifying custom arguments scan-args: |- diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml index 59885cb..e9c2925 100644 --- a/.github/workflows/release-drafter.yaml +++ b/.github/workflows/release-drafter.yaml @@ -33,7 +33,7 @@ jobs: # echo "GHE_HOST=${GITHUB_SERVER_URL##https:\/\/}" >> $GITHUB_ENV # Drafts your next Release notes as Pull Requests are merged into "master" - - uses: release-drafter/release-drafter@v7 + - uses: release-drafter/release-drafter@c2e2804cc59f45f57076a99af580d0fedb697927 # v7 # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml # with: # config-name: my-config.yml diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 413ab0a..8f64bca 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 @@ -32,7 +32,7 @@ jobs: exit 1 fi echo "version=$GO_VERSION" >> $GITHUB_OUTPUT - - uses: actions/setup-go@v6 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version: ${{ steps.get-go-version.outputs.version }} @@ -64,7 +64,7 @@ jobs: sha256sum * > checksums.txt - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: files: | bin/* @@ -78,16 +78,16 @@ jobs: needs: release steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 - name: Log in to Container Registry - uses: docker/login-action@v4 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -95,7 +95,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -105,7 +105,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 with: context: . file: ./Dockerfile diff --git a/.github/workflows/update-action-pins.yml b/.github/workflows/update-action-pins.yml new file mode 100644 index 0000000..7531952 --- /dev/null +++ b/.github/workflows/update-action-pins.yml @@ -0,0 +1,27 @@ +name: Update Action Pins + +on: + pull_request: + paths: + - ".github/workflows/**" + +jobs: + check-pins: + name: Check action pins + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false + - name: Verify all actions are pinned to a SHA + run: | + unpinned=$(grep -rE '^\s+(- )?uses: ' .github/workflows/ \ + | grep -vE '^\s+(- )?uses: \.\/' \ + | grep -vE '@[0-9a-f]{40}($|\s)' || true) + if [[ -n "$unpinned" ]]; then + echo "::error::Found unpinned GitHub Actions (must use SHA digest, not tag):" + echo "$unpinned" + echo "" + echo "Run 'GITHUB_TOKEN=\$(gh auth token) update-action-pins .github/workflows/' to fix." + exit 1 + fi