From 7e03fb80419f8d74908fda274223866e7edd4e74 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 21:37:07 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/check-files.yml | 6 +++--- .github/workflows/codeql.yml | 6 +++--- .github/workflows/create-release.yml | 4 ++-- .github/workflows/e2e-workflow.yml | 12 ++++++------ .github/workflows/helm-chart.yml | 4 ++-- .github/workflows/lint-go.yaml | 2 +- .github/workflows/pr-title-lint.yml | 2 +- .github/workflows/publish-gh-image-and-chart.yml | 8 ++++---- .github/workflows/publish-mcr-image.yaml | 10 +++++----- .github/workflows/tests.yml | 4 ++-- .github/workflows/trivy.yaml | 2 +- 12 files changed, 32 insertions(+), 30 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 600a98c2..10beeb4f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,3 +6,5 @@ updates: interval: "weekly" commit-message: prefix: "chore" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/check-files.yml b/.github/workflows/check-files.yml index 3064fca0..10618766 100644 --- a/.github/workflows/check-files.yml +++ b/.github/workflows/check-files.yml @@ -16,13 +16,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ env.GO_VERSION }} - name: Check spelling with custom config file - uses: crate-ci/typos@v1.44.0 + uses: crate-ci/typos@631208b7aac2daa8b707f55e7331f9112b0e062d # v1.44.0 with: config: ./.github/typos.toml - name: Verify Mod diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7fa6fc09..67aaa5e8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,13 +24,13 @@ jobs: fetch-depth: 0 - name: Initialize CodeQL - uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 + uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 with: languages: go - name: Autobuild - uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 + uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 + uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index f16039ba..6812422e 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -21,7 +21,7 @@ jobs: egress-policy: audit - name: Set up Go ${{ env.GO_VERSION }} - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ env.GO_VERSION }} @@ -33,7 +33,7 @@ jobs: ref: ${{ github.event.client_payload.tag }} - name: Goreleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: version: latest args: release --clean --timeout 60m --verbose diff --git a/.github/workflows/e2e-workflow.yml b/.github/workflows/e2e-workflow.yml index a7e27f0d..f67cc716 100644 --- a/.github/workflows/e2e-workflow.yml +++ b/.github/workflows/e2e-workflow.yml @@ -71,7 +71,7 @@ jobs: echo "VERSION=$(echo ${{ inputs.tag }} | tr -d v)" >> $GITHUB_ENV - name: Set up Go ${{ env.GO_VERSION }} - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ env.GO_VERSION }} @@ -83,7 +83,7 @@ jobs: subscription-id: ${{ secrets.E2E_SUBSCRIPTION_ID }} - name: Install Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 with: token: ${{ secrets.GITHUB_TOKEN }} id: install @@ -97,7 +97,7 @@ jobs: AZURE_ACR_NAME: ${{ env.CLUSTER_NAME }} - name: Create Azure Identity - uses: azure/CLI@v2.2.0 + uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 with: inlineScript: | az identity create --name gpuIdentity --resource-group ${{ env.CLUSTER_NAME }} @@ -143,14 +143,14 @@ jobs: subscription-id: ${{ secrets.E2E_SUBSCRIPTION_ID }} - name: Create Role Assignment - uses: azure/CLI@v2.2.0 + uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 with: inlineScript: | IDENTITY_PRINCIPAL_ID="$(az identity show --name gpuIdentity --resource-group ${{ env.CLUSTER_NAME }} --query 'principalId' -otsv)" az role assignment create --assignee ${IDENTITY_PRINCIPAL_ID} --scope "/subscriptions/${{ secrets.E2E_SUBSCRIPTION_ID }}/resourceGroups/${{ env.CLUSTER_NAME }}" --role "Contributor" - name: Create Azure Federated Identity - uses: azure/CLI@v2.2.0 + uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 with: inlineScript: | AKS_OIDC_ISSUER="$(az aks show -n "${{ env.CLUSTER_NAME }}" -g "${{ env.CLUSTER_NAME }}" --query 'oidcIssuerProfile.issuerUrl' -otsv)" @@ -163,7 +163,7 @@ jobs: - name: Cleanup e2e resources if: ${{ always() }} - uses: azure/CLI@v2.2.0 + uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 with: inlineScript: | set +e diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml index a3733399..f245fd89 100644 --- a/.github/workflows/helm-chart.yml +++ b/.github/workflows/helm-chart.yml @@ -24,7 +24,7 @@ jobs: ref: ${{ github.event.client_payload.tag }} - name: Publish Helm chart - uses: stefanprodan/helm-gh-pages@v1.7.0 + uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0 with: token: ${{ secrets.GITHUB_TOKEN }} charts_dir: charts @@ -37,7 +37,7 @@ jobs: environment: e2e-test steps: - name: 'Dispatch release tag to create release' - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} event-type: create-release diff --git a/.github/workflows/lint-go.yaml b/.github/workflows/lint-go.yaml index 6e5b9070..fdd90d5f 100644 --- a/.github/workflows/lint-go.yaml +++ b/.github/workflows/lint-go.yaml @@ -32,7 +32,7 @@ jobs: fetch-depth: 0 - name: Set up Go ${{ env.GO_VERSION }} - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ env.GO_VERSION }} diff --git a/.github/workflows/pr-title-lint.yml b/.github/workflows/pr-title-lint.yml index 066ab265..08925422 100644 --- a/.github/workflows/pr-title-lint.yml +++ b/.github/workflows/pr-title-lint.yml @@ -12,7 +12,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: thehanimo/pr-title-checker@v1.4.3 + - uses: thehanimo/pr-title-checker@7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70 # v1.4.3 with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} pass_on_octokit_error: true diff --git a/.github/workflows/publish-gh-image-and-chart.yml b/.github/workflows/publish-gh-image-and-chart.yml index e50edd5c..7f8ba792 100644 --- a/.github/workflows/publish-gh-image-and-chart.yml +++ b/.github/workflows/publish-gh-image-and-chart.yml @@ -33,7 +33,7 @@ jobs: echo "tag=$(echo ${{ github.event.inputs.release_version }})" >> $GITHUB_OUTPUT - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 @@ -49,7 +49,7 @@ jobs: - name: 'Create tag' if: steps.check-tag.outputs.create_tag == 'true' - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | github.rest.git.createRef({ @@ -81,7 +81,7 @@ jobs: ref: ${{ needs.check-tag.outputs.tag }} - name: Login to ${{ steps.get-registry.outputs.registry_repository }} - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -114,7 +114,7 @@ jobs: environment: e2e-test steps: - name: 'Dispatch release tag to publish helm chart' - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} event-type: publish-helm-chart diff --git a/.github/workflows/publish-mcr-image.yaml b/.github/workflows/publish-mcr-image.yaml index 165e30a1..e266974c 100644 --- a/.github/workflows/publish-mcr-image.yaml +++ b/.github/workflows/publish-mcr-image.yaml @@ -31,7 +31,7 @@ jobs: run: echo "tag=$(echo ${{ github.event.inputs.release_version }})" >> $GITHUB_OUTPUT - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 @@ -45,7 +45,7 @@ jobs: fi - name: 'Create tag' if: ${{ env.create_tag == 'true' }} - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | github.rest.git.createRef({ @@ -67,11 +67,11 @@ jobs: run: echo "IMG_TAG=$(echo ${{ needs.check-tag.outputs.tag }} | tr -d v)" >> $GITHUB_ENV - name: Set up Go ${{ env.GO_VERSION }} - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ env.GO_VERSION }} - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 submodules: true @@ -99,7 +99,7 @@ jobs: TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} - name: 'Dispatch tag to e2e test' - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} event-type: release-tag diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index d26c5f82..d12c87b6 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -37,7 +37,7 @@ jobs: fetch-depth: 0 - name: Set up Go ${{ env.GO_VERSION }} - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ env.GO_VERSION }} @@ -46,7 +46,7 @@ jobs: make unit-test - name: Upload Codecov report - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 with: ## Comma-separated list of files to upload files: ./coverage.txt diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index 86feb6a7..fb8d3000 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up Go 1.x - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: 1.26.6 id: go