From 56781be009659ea67a9994b1ef74afa20cc74bca Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Sat, 1 Aug 2026 22:36:26 +0200 Subject: [PATCH 1/2] Pin actions from other repositories. --- .github/workflows/_shared-docs-build-pr.yml | 8 ++++---- .../_shared-docs-build-publish-gh-pages.yml | 12 ++++++------ .../workflows/_shared-docs-build-publish-surge.yml | 4 ++-- .github/workflows/_shared-docs-build-push.yml | 6 +++--- .github/workflows/generate-wiki-docs.yml | 6 +++--- .github/workflows/test-action-build-html.yml | 12 ++++++------ .github/workflows/test-action-build-init.yml | 4 ++-- actions/ansible-docs-build-comment/action.yml | 8 ++++---- actions/ansible-docs-build-diff/action.yml | 2 +- actions/ansible-docs-build-html/action.yml | 2 +- 10 files changed, 32 insertions(+), 32 deletions(-) diff --git a/.github/workflows/_shared-docs-build-pr.yml b/.github/workflows/_shared-docs-build-pr.yml index edce30f..bd1e173 100644 --- a/.github/workflows/_shared-docs-build-pr.yml +++ b/.github/workflows/_shared-docs-build-pr.yml @@ -228,7 +228,7 @@ jobs: steps: - name: Variable setup id: vars - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: RUNNER_TEMP: ${{ runner.temp }} EVENT_ACTION: ${{ github.event.action }} @@ -282,7 +282,7 @@ jobs: } - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python }} @@ -301,7 +301,7 @@ jobs: fi - name: Checkout BASE - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} path: ${{ steps.vars.outputs.checkout-path }} @@ -341,7 +341,7 @@ jobs: artifact-upload: 'false' - name: Checkout HEAD - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # It would be better to use # diff --git a/.github/workflows/_shared-docs-build-publish-gh-pages.yml b/.github/workflows/_shared-docs-build-publish-gh-pages.yml index c3c561c..9f46735 100644 --- a/.github/workflows/_shared-docs-build-publish-gh-pages.yml +++ b/.github/workflows/_shared-docs-build-publish-gh-pages.yml @@ -61,7 +61,7 @@ jobs: steps: - name: Process variables id: vars - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const inputs = ${{ toJSON(inputs) }} @@ -89,7 +89,7 @@ jobs: exit 1 - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: gh-pages path: gh-pages-checkout @@ -106,7 +106,7 @@ jobs: - name: Retrieve rendered docs if: inputs.action == 'publish' id: download - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.artifact-name }} path: gh-pages-checkout/${{ steps.vars.outputs.dest }} @@ -129,19 +129,19 @@ jobs: - name: Setup GitHub Pages if: inputs.publish-gh-pages-branch - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 with: token: ${{ secrets.GH_TOKEN }} - name: Upload gh-pages branch as artifact if: inputs.publish-gh-pages-branch - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: gh-pages-checkout - name: Deploy gh-pages branch to GitHub Pages if: inputs.publish-gh-pages-branch id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 with: token: ${{ secrets.GH_TOKEN }} diff --git a/.github/workflows/_shared-docs-build-publish-surge.yml b/.github/workflows/_shared-docs-build-publish-surge.yml index 85b96b0..f8f539e 100644 --- a/.github/workflows/_shared-docs-build-publish-surge.yml +++ b/.github/workflows/_shared-docs-build-publish-surge.yml @@ -36,13 +36,13 @@ jobs: - name: Retrieve rendered docs if: inputs.action == 'publish' id: download - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.artifact-name }} path: html - name: Install Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 diff --git a/.github/workflows/_shared-docs-build-push.yml b/.github/workflows/_shared-docs-build-push.yml index 3a82a44..b584a09 100644 --- a/.github/workflows/_shared-docs-build-push.yml +++ b/.github/workflows/_shared-docs-build-push.yml @@ -158,7 +158,7 @@ jobs: steps: - name: Variable setup id: vars - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: RUNNER_TEMP: ${{ runner.temp }} with: @@ -197,7 +197,7 @@ jobs: core.setOutput('skip-init', skipInit) - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python }} @@ -217,7 +217,7 @@ jobs: fi - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: ${{ steps.vars.outputs.checkout-path }} ref: ${{ inputs.build-ref }} diff --git a/.github/workflows/generate-wiki-docs.yml b/.github/workflows/generate-wiki-docs.yml index 04b512a..d7a6d52 100644 --- a/.github/workflows/generate-wiki-docs.yml +++ b/.github/workflows/generate-wiki-docs.yml @@ -23,19 +23,19 @@ jobs: runs-on: ubuntu-latest steps: - if: fromJSON(env.SHOULD_RUN) - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Checkout wiki if: fromJSON(env.SHOULD_RUN) - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.repository }}.wiki path: ${{ env.WIKI }} persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 if: fromJSON(env.SHOULD_RUN) with: python-version: '3.13' diff --git a/.github/workflows/test-action-build-html.yml b/.github/workflows/test-action-build-html.yml index 000f0c9..b2b32d4 100644 --- a/.github/workflows/test-action-build-html.yml +++ b/.github/workflows/test-action-build-html.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -35,7 +35,7 @@ jobs: artifact-upload: false - name: Simple 1 - Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 id: simple1-artifact with: path: .artifacts/simple1 @@ -69,7 +69,7 @@ jobs: artifact-upload: false - name: Simple 2 - Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 id: simple2-artifact with: path: .artifacts/simple2 @@ -106,7 +106,7 @@ jobs: artifact-name: tests-simple3 - name: Simple 3 - Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 id: simple3-artifact with: name: ${{ steps.simple3.outputs.artifact-name }} @@ -156,7 +156,7 @@ jobs: artifact-name: tests-simple4 - name: Simple 4 - Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 id: simple4-artifact with: name: ${{ steps.simple4.outputs.artifact-name }} @@ -209,7 +209,7 @@ jobs: artifact-name: tests-simple5 - name: Simple 5 - Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 id: simple5-artifact with: name: ${{ steps.simple5.outputs.artifact-name }} diff --git a/.github/workflows/test-action-build-init.yml b/.github/workflows/test-action-build-init.yml index 2b5a211..23f8d3f 100644 --- a/.github/workflows/test-action-build-init.yml +++ b/.github/workflows/test-action-build-init.yml @@ -108,12 +108,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.13 diff --git a/actions/ansible-docs-build-comment/action.yml b/actions/ansible-docs-build-comment/action.yml index d93aa43..1a3a61f 100644 --- a/actions/ansible-docs-build-comment/action.yml +++ b/actions/ansible-docs-build-comment/action.yml @@ -45,7 +45,7 @@ runs: steps: - name: Look for an existing comment id: fc - uses: peter-evans/find-comment@v4 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 with: issue-number: ${{ inputs.pr-number }} body-includes: ${{ inputs.body-includes }} @@ -53,7 +53,7 @@ runs: - name: Determine actions id: vars - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const inputs = ${{ toJSON(inputs )}} @@ -78,7 +78,7 @@ runs: if: >- steps.vars.outputs.action == 'remove' && steps.fc.outputs.comment-id - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | github.rest.issues.deleteComment({ @@ -90,7 +90,7 @@ runs: - name: Post or update comment id: comment if: steps.vars.outputs.action == 'update' - uses: peter-evans/create-or-update-comment@v5 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 with: comment-id: ${{ steps.fc.outputs.comment-id }} issue-number: ${{ inputs.pr-number }} diff --git a/actions/ansible-docs-build-diff/action.yml b/actions/ansible-docs-build-diff/action.yml index 9548582..d01d247 100644 --- a/actions/ansible-docs-build-diff/action.yml +++ b/actions/ansible-docs-build-diff/action.yml @@ -94,7 +94,7 @@ runs: - name: Create diff id: diff - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | // attribution: https://stackoverflow.com/a/3561711/3905079 diff --git a/actions/ansible-docs-build-html/action.yml b/actions/ansible-docs-build-html/action.yml index 1296b14..4a309aa 100644 --- a/actions/ansible-docs-build-html/action.yml +++ b/actions/ansible-docs-build-html/action.yml @@ -68,7 +68,7 @@ runs: - name: Upload artifact if: fromJSON(inputs.artifact-upload) - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: path: ${{ steps.build.outputs.build-html }} name: ${{ inputs.artifact-name }} From 5ca833b1f86cdcdffb764bcfbcfac80f70941f75 Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Sat, 1 Aug 2026 22:39:29 +0200 Subject: [PATCH 2/2] Use new GHA syntax to reference own actions and shared workflows. --- .github/workflows/_shared-docs-build-pr.yml | 10 +++++----- .github/workflows/_shared-docs-build-push.yml | 4 ++-- .github/workflows/test-action-build-html.yml | 10 +++++----- .github/workflows/test-action-build-init.yml | 2 +- samples/pr-build-and-comment.yml | 8 ++++---- samples/pr-with-publish-to-gh-pages.yml | 8 ++++---- samples/push-with-build.yml | 2 +- samples/push-with-publish-to-gh-pages.yml | 4 ++-- 8 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/_shared-docs-build-pr.yml b/.github/workflows/_shared-docs-build-pr.yml index bd1e173..cb83cae 100644 --- a/.github/workflows/_shared-docs-build-pr.yml +++ b/.github/workflows/_shared-docs-build-pr.yml @@ -309,7 +309,7 @@ jobs: - name: Initialize the build environment (BASE) id: init-base - uses: ansible-community/github-docs-build/actions/ansible-docs-build-init@main + uses: $/actions/ansible-docs-build-init with: collections: ${{ inputs.collection-name }} dest-dir: ${{ steps.vars.outputs.init-dir-base }} @@ -333,7 +333,7 @@ jobs: - name: Build BASE id: build-base - uses: ansible-community/github-docs-build/actions/ansible-docs-build-html@main + uses: $/actions/ansible-docs-build-html with: build-script: ${{ steps.init-base.outputs.build-script }} build-html: ${{ steps.init-base.outputs.build-html }} @@ -358,7 +358,7 @@ jobs: - name: Initialize the build environment (HEAD) id: init-head - uses: ansible-community/github-docs-build/actions/ansible-docs-build-init@main + uses: $/actions/ansible-docs-build-init with: collections: ${{ inputs.collection-name }} dest-dir: ${{ steps.vars.outputs.init-dir-head }} @@ -382,7 +382,7 @@ jobs: - name: Build HEAD id: build-head - uses: ansible-community/github-docs-build/actions/ansible-docs-build-html@main + uses: $/actions/ansible-docs-build-html with: build-script: ${{ steps.init-head.outputs.build-script }} build-html: ${{ steps.init-head.outputs.build-html }} @@ -392,7 +392,7 @@ jobs: - name: Get a diff of the changes if: steps.build-base.outputs.hash != steps.build-head.outputs.hash id: diff - uses: ansible-community/github-docs-build/actions/ansible-docs-build-diff@main + uses: $/actions/ansible-docs-build-diff with: build-html-a: ${{ steps.build-base.outputs.build-html }} build-html-b: ${{ steps.build-head.outputs.build-html }} diff --git a/.github/workflows/_shared-docs-build-push.yml b/.github/workflows/_shared-docs-build-push.yml index b584a09..5eacea9 100644 --- a/.github/workflows/_shared-docs-build-push.yml +++ b/.github/workflows/_shared-docs-build-push.yml @@ -228,7 +228,7 @@ jobs: - name: Initialize the build environment id: init - uses: ansible-community/github-docs-build/actions/ansible-docs-build-init@main + uses: $/actions/ansible-docs-build-init with: collections: ${{ steps.vars.outputs.col-name }} dest-dir: ${{ steps.vars.outputs.init-dir }} @@ -252,7 +252,7 @@ jobs: - name: Build id: build - uses: ansible-community/github-docs-build/actions/ansible-docs-build-html@main + uses: $/actions/ansible-docs-build-html with: build-script: ${{ steps.init.outputs.build-script }} build-html: ${{ steps.init.outputs.build-html }} diff --git a/.github/workflows/test-action-build-html.yml b/.github/workflows/test-action-build-html.yml index b2b32d4..417414d 100644 --- a/.github/workflows/test-action-build-html.yml +++ b/.github/workflows/test-action-build-html.yml @@ -28,7 +28,7 @@ jobs: - name: Simple 1 invoke - no copy, no artifact id: simple1 - uses: ./actions/ansible-docs-build-html + uses: $/actions/ansible-docs-build-html with: build-script: .test/simple-build/build.sh build-html: .test/simple-build/build/html @@ -61,7 +61,7 @@ jobs: - name: Simple 2 invoke - with copy, no artifact id: simple2 - uses: ./actions/ansible-docs-build-html + uses: $/actions/ansible-docs-build-html with: build-script: .test/simple-build/build.sh build-html: .test/simple-build/build/html @@ -98,7 +98,7 @@ jobs: - name: Simple 3 invoke - no copy, with artifact id: simple3 - uses: ./actions/ansible-docs-build-html + uses: $/actions/ansible-docs-build-html with: build-script: .test/simple-build/build.sh build-html: .test/simple-build/build/html @@ -147,7 +147,7 @@ jobs: - name: Simple 4 invoke - with copy, with artifact id: simple4 - uses: ./actions/ansible-docs-build-html + uses: $/actions/ansible-docs-build-html with: build-script: .test/simple-build/build.sh build-html: .test/simple-build/build/html @@ -200,7 +200,7 @@ jobs: - name: Simple 5 invoke - with copy, with artifact, trailing slash in input id: simple5 - uses: ./actions/ansible-docs-build-html + uses: $/actions/ansible-docs-build-html with: build-script: .test/simple-build/build.sh build-html: .test/simple-build/build/html/ diff --git a/.github/workflows/test-action-build-init.yml b/.github/workflows/test-action-build-init.yml index 23f8d3f..0d3f3fa 100644 --- a/.github/workflows/test-action-build-init.yml +++ b/.github/workflows/test-action-build-init.yml @@ -124,7 +124,7 @@ jobs: # the id (and we need it in later steps). - name: Init id: init - uses: ./actions/ansible-docs-build-init + uses: $/actions/ansible-docs-build-init with: collections: ${{ matrix.collections }} # combining runner.temp and /docsbuild copies the default from the action diff --git a/samples/pr-build-and-comment.yml b/samples/pr-build-and-comment.yml index 09ba86a..a736706 100644 --- a/samples/pr-build-and-comment.yml +++ b/samples/pr-build-and-comment.yml @@ -13,7 +13,7 @@ jobs: contents: read name: Validate Ansible Docs if: github.event.action != 'closed' - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-push.yml@main + uses: $/.github/workflows/_shared-docs-build-push.yml with: artifact-upload: false init-lenient: false @@ -26,7 +26,7 @@ jobs: permissions: contents: read name: Build Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-pr.yml@main + uses: $/.github/workflows/_shared-docs-build-pr.yml with: init-lenient: true init-fail-on-error: false @@ -40,7 +40,7 @@ jobs: id-token: write needs: [build-docs] name: Publish Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main + uses: $/.github/workflows/_shared-docs-build-publish-gh-pages.yml with: artifact-name: ${{ needs.build-docs.outputs.artifact-name }} action: ${{ (github.event.action == 'closed' || needs.build-docs.outputs.changed != 'true') && 'teardown' || 'publish' }} @@ -56,7 +56,7 @@ jobs: name: PR comments steps: - name: PR comment - uses: ansible-community/github-docs-build/actions/ansible-docs-build-comment@main + uses: $/actions/ansible-docs-build-comment with: body-includes: '## Docs Build' reactions: heart diff --git a/samples/pr-with-publish-to-gh-pages.yml b/samples/pr-with-publish-to-gh-pages.yml index a65515f..d516984 100644 --- a/samples/pr-with-publish-to-gh-pages.yml +++ b/samples/pr-with-publish-to-gh-pages.yml @@ -16,7 +16,7 @@ jobs: contents: read name: Validate Ansible Docs if: github.event.action != 'closed' - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-push.yml@main + uses: $/.github/workflows/_shared-docs-build-push.yml with: artifact-upload: false init-lenient: false @@ -29,7 +29,7 @@ jobs: permissions: contents: read name: Build Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-pr.yml@main + uses: $/.github/workflows/_shared-docs-build-pr.yml with: init-lenient: true init-fail-on-error: false @@ -44,7 +44,7 @@ jobs: id-token: write needs: [build-docs] name: Publish Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main + uses: $/.github/workflows/_shared-docs-build-publish-gh-pages.yml with: artifact-name: ${{ needs.build-docs.outputs.artifact-name }} action: ${{ (github.event.action == 'closed' || needs.build-docs.outputs.changed != 'true') && 'teardown' || 'publish' }} @@ -60,7 +60,7 @@ jobs: name: PR comments steps: - name: PR comment - uses: ansible-community/github-docs-build/actions/ansible-docs-build-comment@main + uses: $/actions/ansible-docs-build-comment with: body-includes: '## Docs Build' reactions: heart diff --git a/samples/push-with-build.yml b/samples/push-with-build.yml index e92c948..3d4d9a8 100644 --- a/samples/push-with-build.yml +++ b/samples/push-with-build.yml @@ -20,7 +20,7 @@ jobs: permissions: contents: read name: Build Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-push.yml@main + uses: $/.github/workflows/_shared-docs-build-push.yml with: init-lenient: false init-fail-on-error: true diff --git a/samples/push-with-publish-to-gh-pages.yml b/samples/push-with-publish-to-gh-pages.yml index ed0ac11..e9473b7 100644 --- a/samples/push-with-publish-to-gh-pages.yml +++ b/samples/push-with-publish-to-gh-pages.yml @@ -16,7 +16,7 @@ jobs: permissions: contents: read name: Build Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-push.yml@main + uses: $/.github/workflows/_shared-docs-build-push.yml with: init-lenient: false init-fail-on-error: true @@ -30,7 +30,7 @@ jobs: id-token: write needs: [build-docs] name: Publish Ansible Docs - uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main + uses: $/.github/workflows/_shared-docs-build-publish-gh-pages.yml with: artifact-name: ${{ needs.build-docs.outputs.artifact-name }} publish-gh-pages-branch: true