From 3af34e8697e756b133b5b38fae0fd1dad273353d Mon Sep 17 00:00:00 2001 From: Jens Polspoel Date: Tue, 14 Jul 2026 13:49:05 +0200 Subject: [PATCH 1/2] Security: GitHub Actions pinnen op volledige commit-SHA Automatische SHA-pinning van GitHub Actions (INBO security-hardening). --- .github/workflows/check_on_branch.yml | 4 ++-- .github/workflows/check_on_different_r_os.yml | 12 ++++++------ .github/workflows/check_on_main.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check_on_branch.yml b/.github/workflows/check_on_branch.yml index 56e41486..69456034 100644 --- a/.github/workflows/check_on_branch.yml +++ b/.github/workflows/check_on_branch.yml @@ -19,8 +19,8 @@ jobs: contents: read steps: - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with: role-to-assume: arn:aws:iam::347082780157:role/inbo-n2kmonitoring-shared-infra-eu-west-1-unittest-role aws-region: eu-west-1 - - uses: inbo/actions/check_pkg@main + - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main diff --git a/.github/workflows/check_on_different_r_os.yml b/.github/workflows/check_on_different_r_os.yml index aa6334a4..e70f201a 100644 --- a/.github/workflows/check_on_different_r_os.yml +++ b/.github/workflows/check_on_different_r_os.yml @@ -37,14 +37,14 @@ jobs: contents: read steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - - uses: r-lib/actions/setup-r@v2 + - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: r-version: ${{ matrix.config.r }} extra-repositories: https://inla.r-inla-download.org/R/stable - - uses: r-lib/actions/setup-pandoc@v2 + - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 - name: linux dependencies if: runner.os == 'linux' @@ -59,17 +59,17 @@ jobs: sudo make install ldd --version - - uses: r-lib/actions/setup-r-dependencies@v2 + - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: extra-packages: any::rcmdcheck needs: check - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with: role-to-assume: arn:aws:iam::347082780157:role/inbo-n2kmonitoring-shared-infra-eu-west-1-unittest-role aws-region: eu-west-1 - - uses: r-lib/actions/check-r-package@v2 + - uses: r-lib/actions/check-r-package@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: error-on: '"error"' diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml index 25efebe3..17a6a931 100644 --- a/.github/workflows/check_on_main.yml +++ b/.github/workflows/check_on_main.yml @@ -21,8 +21,8 @@ jobs: contents: write steps: - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with: role-to-assume: arn:aws:iam::347082780157:role/inbo-n2kmonitoring-shared-infra-eu-west-1-unittest-role aws-region: eu-west-1 - - uses: inbo/actions/check_pkg@main + - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b10b9f6..71a2bd6e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Get tag run: | git fetch --tags --force @@ -23,7 +23,7 @@ jobs: TAG_BODY=$(git tag --contains $(git rev-parse HEAD) --format='%(contents)') echo "tag=$TAG" >> $GITHUB_ENV echo "$TAG_BODY" > body.md - - uses: ncipollo/release-action@v1 + - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: name: Release ${{ env.tag }} tag: ${{ env.tag }} From 36c61571506a8aa17953208004604a8fe5df0356 Mon Sep 17 00:00:00 2001 From: Jens Polspoel Date: Tue, 14 Jul 2026 14:22:25 +0200 Subject: [PATCH 2/2] =?UTF-8?q?Enkel=20externe=20actions=20pinnen=20?= =?UTF-8?q?=E2=80=94=20INBO-eigen=20(inbo/*)=20ontpind?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/check_on_branch.yml | 2 +- .github/workflows/check_on_main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check_on_branch.yml b/.github/workflows/check_on_branch.yml index 69456034..390e14d8 100644 --- a/.github/workflows/check_on_branch.yml +++ b/.github/workflows/check_on_branch.yml @@ -23,4 +23,4 @@ jobs: with: role-to-assume: arn:aws:iam::347082780157:role/inbo-n2kmonitoring-shared-infra-eu-west-1-unittest-role aws-region: eu-west-1 - - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main + - uses: inbo/actions/check_pkg@main diff --git a/.github/workflows/check_on_main.yml b/.github/workflows/check_on_main.yml index 17a6a931..bd7420e3 100644 --- a/.github/workflows/check_on_main.yml +++ b/.github/workflows/check_on_main.yml @@ -25,4 +25,4 @@ jobs: with: role-to-assume: arn:aws:iam::347082780157:role/inbo-n2kmonitoring-shared-infra-eu-west-1-unittest-role aws-region: eu-west-1 - - uses: inbo/actions/check_pkg@5ad8ad6a75c216b77713aa14ebaef30d76ee1463 # main + - uses: inbo/actions/check_pkg@main