From ed8f798c4419ab5b6a2ddc57541a86f15161a754 Mon Sep 17 00:00:00 2001 From: Jens Polspoel Date: Tue, 14 Jul 2026 13:27:11 +0200 Subject: [PATCH 1/2] Security: GitHub Actions pinnen op volledige commit-SHA Automatische SHA-pinning van GitHub Actions (INBO security-hardening). --- .github/workflows/check_on_branch.yml | 2 +- .github/workflows/check_on_different_r_os.yml | 10 +++++----- .github/workflows/check_on_main.yml | 2 +- .github/workflows/release.yml | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/check_on_branch.yml b/.github/workflows/check_on_branch.yml index 2f09f44..b0256ba 100755 --- a/.github/workflows/check_on_branch.yml +++ b/.github/workflows/check_on_branch.yml @@ -17,4 +17,4 @@ jobs: permissions: contents: read steps: - - uses: inbo/actions/check_pkg@checklist-0.3.6 + - uses: inbo/actions/check_pkg@c5183328c3481a353e1be0ab1b621c294e71b4ce # checklist-0.3.6 diff --git a/.github/workflows/check_on_different_r_os.yml b/.github/workflows/check_on_different_r_os.yml index 10c4a14..d5339b8 100644 --- a/.github/workflows/check_on_different_r_os.yml +++ b/.github/workflows/check_on_different_r_os.yml @@ -32,20 +32,20 @@ jobs: GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - - uses: r-lib/actions/setup-r@v2 + - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: r-version: ${{ matrix.config.r }} extra-repositories: https://inbo.r-universe.dev - - uses: r-lib/actions/setup-pandoc@v2 + - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 - - uses: r-lib/actions/setup-r-dependencies@v2 + - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: extra-packages: any::rcmdcheck needs: check - - uses: r-lib/actions/check-r-package@v2 + - uses: r-lib/actions/check-r-package@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: error-on: '"error"' diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml index d5a137b..ab22d47 100755 --- a/.github/workflows/check_on_main.yml +++ b/.github/workflows/check_on_main.yml @@ -16,4 +16,4 @@ jobs: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: inbo/actions/check_pkg@checklist-0.3.6 + - uses: inbo/actions/check_pkg@c5183328c3481a353e1be0ab1b621c294e71b4ce # checklist-0.3.6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b10b9f..71a2bd6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Get tag run: | git fetch --tags --force @@ -23,7 +23,7 @@ jobs: TAG_BODY=$(git tag --contains $(git rev-parse HEAD) --format='%(contents)') echo "tag=$TAG" >> $GITHUB_ENV echo "$TAG_BODY" > body.md - - uses: ncipollo/release-action@v1 + - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: name: Release ${{ env.tag }} tag: ${{ env.tag }} From 6bd772a8987996373d114e095d8e4fce892a36ed Mon Sep 17 00:00:00 2001 From: Jens Polspoel Date: Tue, 14 Jul 2026 13:51:12 +0200 Subject: [PATCH 2/2] =?UTF-8?q?Enkel=20externe=20actions=20pinnen=20?= =?UTF-8?q?=E2=80=94=20INBO-eigen=20(inbo/*)=20ontpind?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/check_on_branch.yml | 2 +- .github/workflows/check_on_main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check_on_branch.yml b/.github/workflows/check_on_branch.yml index b0256ba..2f09f44 100755 --- a/.github/workflows/check_on_branch.yml +++ b/.github/workflows/check_on_branch.yml @@ -17,4 +17,4 @@ jobs: permissions: contents: read steps: - - uses: inbo/actions/check_pkg@c5183328c3481a353e1be0ab1b621c294e71b4ce # checklist-0.3.6 + - uses: inbo/actions/check_pkg@checklist-0.3.6 diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml index ab22d47..d5a137b 100755 --- a/.github/workflows/check_on_main.yml +++ b/.github/workflows/check_on_main.yml @@ -16,4 +16,4 @@ jobs: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: inbo/actions/check_pkg@c5183328c3481a353e1be0ab1b621c294e71b4ce # checklist-0.3.6 + - uses: inbo/actions/check_pkg@checklist-0.3.6