Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 57a65c1

Browse files
matifalimatifali
authored
chore: use commit sha for GitHub actions (#15019)
Use specific commit SHAs for GitHub actions across various workflows to enhance reliability and reproducibility. This change ensures that actions run against a known version, reducing the risk of unexpected issues due to updates in the third-party action repositories. This contributes to improving the score in #14879
1 parent 208ed1e commit 57a65c1

19 files changed

+106
-105
lines changed

‎.github/actions/setup-go/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ runs:
99
using: "composite"
1010
steps:
1111
- name: Setup Go
12-
uses: actions/setup-go@v5
12+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
1313
with:
1414
go-version: ${{ inputs.version }}
1515

‎.github/actions/setup-node/action.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,16 @@ runs:
1111
using: "composite"
1212
steps:
1313
- name: Install pnpm
14-
uses: pnpm/action-setup@v3
15-
with:
16-
version: 9.6
14+
uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
15+
1716
- name: Setup Node
18-
uses: actions/[email protected].3
17+
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
1918
with:
2019
node-version: 20.16.0
2120
# See https://github.com/actions/setup-node#caching-global-packages-data
2221
cache: "pnpm"
2322
cache-dependency-path: ${{ inputs.directory }}/pnpm-lock.yaml
23+
2424
- name: Install root node_modules
2525
shell: bash
2626
run: ./scripts/pnpm_install.sh

‎.github/actions/setup-sqlc/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ runs:
55
using: "composite"
66
steps:
77
- name: Setup sqlc
8-
uses: sqlc-dev/setup-sqlc@v4
8+
uses: sqlc-dev/setup-sqlc@c0209b9199cd1cce6a14fc27cabcec491b651761 # v4.0.0
99
with:
1010
sqlc-version: "1.25.0"

‎.github/actions/setup-tf/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ runs:
55
using: "composite"
66
steps:
77
- name: Install Terraform
8-
uses: hashicorp/setup-terraform@v3
8+
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
99
with:
1010
terraform_version: 1.9.2
1111
terraform_wrapper: false

‎.github/actions/upload-datadog/action.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
name: Upload tests to datadog
2-
if: always()
2+
description: |
3+
Uploads the test results to datadog.
34
inputs:
45
api-key:
56
description: "Datadog API key"

‎.github/workflows/ci.yaml

+36-36
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,12 @@ jobs:
4343
tailnet-integration: ${{ steps.filter.outputs.tailnet-integration }}
4444
steps:
4545
- name: Checkout
46-
uses: actions/checkout@v4
46+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
4747
with:
4848
fetch-depth: 1
4949
# For pull requests it's not necessary to checkout the code
5050
- name: check changed files
51-
uses: dorny/paths-filter@v3
51+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
5252
id: filter
5353
with:
5454
filters: |
@@ -125,7 +125,7 @@ jobs:
125125
# runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
126126
# steps:
127127
# - name: Checkout
128-
# uses: actions/checkout@v4
128+
# uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
129129
# with:
130130
# fetch-depth: 1
131131
# # See: https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
@@ -138,7 +138,7 @@ jobs:
138138
# run: ./scripts/update-flake.sh
139139

140140
# # auto update flake for dependabot
141-
# - uses: stefanzweifel/git-auto-commit-action@v5
141+
# - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
142142
# if: github.actor == 'dependabot[bot]'
143143
# with:
144144
# # Allows dependabot to still rebase!
@@ -158,7 +158,7 @@ jobs:
158158
runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
159159
steps:
160160
- name: Checkout
161-
uses: actions/checkout@v4
161+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
162162
with:
163163
fetch-depth: 1
164164

@@ -176,7 +176,7 @@ jobs:
176176
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
177177
178178
- name: golangci-lint cache
179-
uses: actions/cache@v4
179+
uses: actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 # v4.1.0
180180
with:
181181
path: |
182182
${{ env.LINT_CACHE_DIR }}
@@ -186,7 +186,7 @@ jobs:
186186
187187
# Check for any typos
188188
- name: Check for typos
189-
uses: crate-ci/[email protected]
189+
uses: crate-ci/typos@6802cc60d4e7f78b9d5454f6cf3935c042d5e1e3 # v1.26.0
190190
with:
191191
config: .github/workflows/typos.toml
192192

@@ -199,7 +199,7 @@ jobs:
199199
200200
# Needed for helm chart linting
201201
- name: Install helm
202-
uses: azure/setup-helm@v4
202+
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
203203
with:
204204
version: v3.9.2
205205

@@ -220,7 +220,7 @@ jobs:
220220
if: needs.changes.outputs.docs-only == 'false' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
221221
steps:
222222
- name: Checkout
223-
uses: actions/checkout@v4
223+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
224224
with:
225225
fetch-depth: 1
226226

@@ -269,7 +269,7 @@ jobs:
269269
timeout-minutes: 7
270270
steps:
271271
- name: Checkout
272-
uses: actions/checkout@v4
272+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
273273
with:
274274
fetch-depth: 1
275275

@@ -305,7 +305,7 @@ jobs:
305305
- windows-2022
306306
steps:
307307
- name: Checkout
308-
uses: actions/checkout@v4
308+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
309309
with:
310310
fetch-depth: 1
311311

@@ -359,7 +359,7 @@ jobs:
359359
timeout-minutes: 25
360360
steps:
361361
- name: Checkout
362-
uses: actions/checkout@v4
362+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
363363
with:
364364
fetch-depth: 1
365365

@@ -399,7 +399,7 @@ jobs:
399399
timeout-minutes: 25
400400
steps:
401401
- name: Checkout
402-
uses: actions/checkout@v4
402+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
403403
with:
404404
fetch-depth: 1
405405

@@ -431,7 +431,7 @@ jobs:
431431
timeout-minutes: 25
432432
steps:
433433
- name: Checkout
434-
uses: actions/checkout@v4
434+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
435435
with:
436436
fetch-depth: 1
437437

@@ -467,7 +467,7 @@ jobs:
467467
timeout-minutes: 20
468468
steps:
469469
- name: Checkout
470-
uses: actions/checkout@v4
470+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
471471
with:
472472
fetch-depth: 1
473473

@@ -488,7 +488,7 @@ jobs:
488488
timeout-minutes: 20
489489
steps:
490490
- name: Checkout
491-
uses: actions/checkout@v4
491+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
492492
with:
493493
fetch-depth: 1
494494

@@ -515,7 +515,7 @@ jobs:
515515
name: ${{ matrix.variant.name }}
516516
steps:
517517
- name: Checkout
518-
uses: actions/checkout@v4
518+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
519519
with:
520520
fetch-depth: 1
521521

@@ -556,15 +556,15 @@ jobs:
556556

557557
- name: Upload Playwright Failed Tests
558558
if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
559-
uses: actions/upload-artifact@v4
559+
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
560560
with:
561561
name: failed-test-videos${{ matrix.variant.enterprise && '-enterprise' || '-agpl' }}
562562
path: ./site/test-results/**/*.webm
563563
retention-days: 7
564564

565565
- name: Upload pprof dumps
566566
if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
567-
uses: actions/upload-artifact@v4
567+
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
568568
with:
569569
name: debug-pprof-dumps${{ matrix.variant.enterprise && '-enterprise' || '-agpl' }}
570570
path: ./site/test-results/**/debug-pprof-*.txt
@@ -577,7 +577,7 @@ jobs:
577577
if: needs.changes.outputs.ts == 'true' || needs.changes.outputs.ci == 'true'
578578
steps:
579579
- name: Checkout
580-
uses: actions/checkout@v4
580+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
581581
with:
582582
# Required by Chromatic for build-over-build history, otherwise we
583583
# only get 1 commit on shallow checkout.
@@ -591,7 +591,7 @@ jobs:
591591
# the check to pass. This is desired in PRs, but not in mainline.
592592
- name: Publish to Chromatic (non-mainline)
593593
if: github.ref != 'refs/heads/main' && github.repository_owner == 'coder'
594-
uses: chromaui/action@v10
594+
uses: chromaui/action@30b6228aa809059d46219e0f556752e8672a7e26 # v11.11.0
595595
env:
596596
NODE_OPTIONS: "--max_old_space_size=4096"
597597
STORYBOOK: true
@@ -622,7 +622,7 @@ jobs:
622622
# infinitely "in progress" in mainline unless we re-review each build.
623623
- name: Publish to Chromatic (mainline)
624624
if: github.ref == 'refs/heads/main' && github.repository_owner == 'coder'
625-
uses: chromaui/action@v10
625+
uses: chromaui/action@30b6228aa809059d46219e0f556752e8672a7e26 # v11.11.0
626626
env:
627627
NODE_OPTIONS: "--max_old_space_size=4096"
628628
STORYBOOK: true
@@ -649,7 +649,7 @@ jobs:
649649

650650
steps:
651651
- name: Checkout
652-
uses: actions/checkout@v4
652+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
653653
with:
654654
# 0 is required here for version.sh to work.
655655
fetch-depth: 0
@@ -750,12 +750,12 @@ jobs:
750750
IMAGE: ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}
751751
steps:
752752
- name: Checkout
753-
uses: actions/checkout@v4
753+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
754754
with:
755755
fetch-depth: 0
756756

757757
- name: GHCR Login
758-
uses: docker/login-action@v3
758+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
759759
with:
760760
registry: ghcr.io
761761
username: ${{ github.actor }}
@@ -830,7 +830,7 @@ jobs:
830830
831831
- name: Prune old images
832832
if: github.ref == 'refs/heads/main'
833-
uses: vlaurin/[email protected]
833+
uses: vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641 # v0.6.0
834834
with:
835835
token: ${{ secrets.GITHUB_TOKEN }}
836836
organization: coder
@@ -845,7 +845,7 @@ jobs:
845845

846846
- name: Upload build artifacts
847847
if: github.ref == 'refs/heads/main'
848-
uses: actions/upload-artifact@v4
848+
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
849849
with:
850850
name: coder
851851
path: |
@@ -869,27 +869,27 @@ jobs:
869869
id-token: write
870870
steps:
871871
- name: Checkout
872-
uses: actions/checkout@v4
872+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
873873
with:
874874
fetch-depth: 0
875875

876876
- name: Authenticate to Google Cloud
877-
uses: google-github-actions/auth@v2
877+
uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
878878
with:
879879
workload_identity_provider: projects/573722524737/locations/global/workloadIdentityPools/github/providers/github
880880
service_account: [email protected]
881881

882882
- name: Set up Google Cloud SDK
883-
uses: google-github-actions/setup-gcloud@v2
883+
uses: google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7 # v2.1.1
884884

885885
- name: Set up Flux CLI
886-
uses: fluxcd/flux2/action@main
886+
uses: fluxcd/flux2/action@9b3958825a314eb79495c6993ef397ddbf87f32f # v2.2.1
887887
with:
888-
# Keep this up to date with the version of flux installed in dogfood cluster
888+
# Keep this and the github action up to date with the version of flux installed in dogfood cluster
889889
version: "2.2.1"
890890

891891
- name: Get Cluster Credentials
892-
uses: "google-github-actions/get-gke-credentials@v2"
892+
uses: google-github-actions/get-gke-credentials@6051de21ad50fbb1767bc93c11357a49082ad116 # v2.2.1
893893
with:
894894
cluster_name: dogfood-v2
895895
location: us-central1-a
@@ -926,12 +926,12 @@ jobs:
926926
if: github.ref == 'refs/heads/main' && !github.event.pull_request.head.repo.fork
927927
steps:
928928
- name: Checkout
929-
uses: actions/checkout@v4
929+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
930930
with:
931931
fetch-depth: 0
932932

933933
- name: Setup flyctl
934-
uses: superfly/flyctl-actions/setup-flyctl@master
934+
uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5
935935

936936
- name: Deploy workspace proxies
937937
run: |
@@ -956,7 +956,7 @@ jobs:
956956
if: needs.changes.outputs.db == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
957957
steps:
958958
- name: Checkout
959-
uses: actions/checkout@v4
959+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
960960
with:
961961
fetch-depth: 1
962962
# We need golang to run the migration main.go

‎.github/workflows/contrib.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ jobs:
2828
pull-requests: write
2929
steps:
3030
- name: auto-approve dependabot
31-
uses: hmarr/auto-approve-action@v4
31+
uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
3232
if: github.actor == 'dependabot[bot]'
3333

3434
cla:
3535
runs-on: ubuntu-latest
3636
steps:
3737
- name: cla
3838
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
39-
uses: contributor-assistant/[email protected]
39+
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
4040
env:
4141
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4242
# the below token should have repo scope and must be manually added by you in the repository's secret
@@ -57,7 +57,7 @@ jobs:
5757
if: ${{ github.event_name == 'pull_request_target' && !github.event.pull_request.draft }}
5858
steps:
5959
- name: release-labels
60-
uses: actions/github-script@v7
60+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
6161
with:
6262
# This script ensures PR title and labels are in sync:
6363
#

0 commit comments

Comments
 (0)