From fc5dd92db66ee680c6984cfbf7a83a21faf1fbce Mon Sep 17 00:00:00 2001 From: Jens Polspoel Date: Tue, 14 Jul 2026 13:25:13 +0200 Subject: [PATCH 1/2] Security: GitHub Actions pinnen op volledige commit-SHA Automatische SHA-pinning van GitHub Actions (INBO security-hardening). --- .github/workflows/check_on_different_r_os.yml | 10 +++++----- .github/workflows/check_on_main.yml | 4 ++-- .github/workflows/r-universe-test.yml | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/check_on_different_r_os.yml b/.github/workflows/check_on_different_r_os.yml index a5b4540b..cf36f2e2 100644 --- a/.github/workflows/check_on_different_r_os.yml +++ b/.github/workflows/check_on_different_r_os.yml @@ -33,14 +33,14 @@ jobs: ZENODO_SANDBOX: ${{ secrets.ZENODO_SANDBOX }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - - uses: r-lib/actions/setup-r@v2 + - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: r-version: ${{ matrix.config.r }} extra-repositories: https://inbo.r-universe.dev https://cranhaven.r-universe.dev - - uses: r-lib/actions/setup-pandoc@v2 + - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 - name: linux dependencies if: runner.os == 'linux' @@ -60,12 +60,12 @@ jobs: Rscript --no-save --no-restore -e 'install.packages("pak")' Rscript --no-save --no-restore -e 'pak::pkg_install(c("assertthat", "bookdown", "inbo/citeme", "cli", "covr", "curl", "cyclocomp", "desc", "devtools", "gert", "hexSticker", "hunspell", "knitr", "lintr", "mockery", "pdftools", "pkgdown", "R6", "rcmdcheck", "renv", "rmarkdown", "roxygen2", "rstudioapi", "sessioninfo", "showtext", "sysfonts", "testthat", "withr", "yaml"))' - - uses: r-lib/actions/setup-r-dependencies@v2 + - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 if: runner.os != 'linux' with: extra-packages: any::rcmdcheck needs: check - - uses: r-lib/actions/check-r-package@v2 + - uses: r-lib/actions/check-r-package@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: error-on: '"error"' diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml index 5359e0f1..c36b57cf 100644 --- a/.github/workflows/check_on_main.yml +++ b/.github/workflows/check_on_main.yml @@ -17,7 +17,7 @@ jobs: contents: read steps: - name: "Check package with checklist" - uses: inbo/actions/check_pkg@composite + uses: inbo/actions/check_pkg@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite deploy-pages: name: deploy-gh-pages runs-on: ubuntu-24.04 @@ -27,4 +27,4 @@ jobs: contents: write steps: - name: "Tag and deploy gh-pages" - uses: inbo/actions/check_deploy@composite + uses: inbo/actions/check_deploy@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite diff --git a/.github/workflows/r-universe-test.yml b/.github/workflows/r-universe-test.yml index 3b09c3bd..3a7f1569 100644 --- a/.github/workflows/r-universe-test.yml +++ b/.github/workflows/r-universe-test.yml @@ -8,6 +8,6 @@ on: jobs: build: name: R-universe testing - uses: r-universe-org/workflows/.github/workflows/build.yml@v3 + uses: r-universe-org/workflows/.github/workflows/build.yml@ece5344c6060246ff035f7413816747784d963e7 # v3 with: universe: ${{ github.repository_owner }} From 600b877dd71fd81488bbb4be53fabbd1850a9894 Mon Sep 17 00:00:00 2001 From: Jens Polspoel Date: Tue, 14 Jul 2026 13:49:14 +0200 Subject: [PATCH 2/2] =?UTF-8?q?Enkel=20externe=20actions=20pinnen=20?= =?UTF-8?q?=E2=80=94=20INBO-eigen=20(inbo/*)=20ontpind?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/check_on_main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml index c36b57cf..5359e0f1 100644 --- a/.github/workflows/check_on_main.yml +++ b/.github/workflows/check_on_main.yml @@ -17,7 +17,7 @@ jobs: contents: read steps: - name: "Check package with checklist" - uses: inbo/actions/check_pkg@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite + uses: inbo/actions/check_pkg@composite deploy-pages: name: deploy-gh-pages runs-on: ubuntu-24.04 @@ -27,4 +27,4 @@ jobs: contents: write steps: - name: "Tag and deploy gh-pages" - uses: inbo/actions/check_deploy@a29089fc9a2ea38b9d9bd62c0d1db3b448b224c8 # composite + uses: inbo/actions/check_deploy@composite