From 62547bd033902d52d2637399c2e43fdc80dddf51 Mon Sep 17 00:00:00 2001 From: Divya Madala Date: Fri, 22 May 2026 11:47:37 -0700 Subject: [PATCH] Pin GitHub Actions to commit SHAs Signed-off-by: Divya Madala --- .github/workflows/backport.yml | 4 ++-- .github/workflows/create-documentation-issue.yml | 6 +++--- .github/workflows/dco.yml | 4 ++-- .github/workflows/delete_backport_branch.yml | 2 +- .github/workflows/links.yml | 4 ++-- .github/workflows/maven-publish.yml | 8 ++++---- .github/workflows/release-drafter.yml | 8 ++++---- 7 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index cc046cc..ba9804c 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -15,14 +15,14 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@1901dc7d52169e70c27a8da37aef0d423e2867a2 # v1.5.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} installation_id: 22958780 - name: Backport - uses: VachaShah/backport@v1.1.4 + uses: VachaShah/backport@28c49d91ceec57d7c9f625f1031c1a4d637251f5 # v1.1.4 with: github_token: ${{ steps.github_app_token.outputs.token }} branch_name: backport/backport-${{ github.event.number }} \ No newline at end of file diff --git a/.github/workflows/create-documentation-issue.yml b/.github/workflows/create-documentation-issue.yml index 549745f..17f8e02 100644 --- a/.github/workflows/create-documentation-issue.yml +++ b/.github/workflows/create-documentation-issue.yml @@ -14,14 +14,14 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@1901dc7d52169e70c27a8da37aef0d423e2867a2 # v1.5.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} installation_id: 22958780 - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Edit the issue template run: | @@ -29,7 +29,7 @@ jobs: - name: Create Issue From File id: create-issue - uses: peter-evans/create-issue-from-file@v4 + uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f # v4 with: title: Add documentation related to new feature content-filepath: ./.github/ISSUE_TEMPLATE/documentation-issue.md diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index 53ed530..0b6a32e 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -9,10 +9,10 @@ jobs: steps: - name: Get PR Commits id: 'get-pr-commits' - uses: tim-actions/get-pr-commits@v1.1.0 + uses: tim-actions/get-pr-commits@55b867b9b28954e6f5c1a0fe2f729dc926c306d0 # v1.1.0 with: token: ${{ secrets.GITHUB_TOKEN }} - name: DCO Check - uses: tim-actions/dco@v1.1.0 + uses: tim-actions/dco@f2279e6e62d5a7d9115b0cb8e837b777b1b02e21 # v1.1.0 with: commits: ${{ steps.get-pr-commits.outputs.commits }} \ No newline at end of file diff --git a/.github/workflows/delete_backport_branch.yml b/.github/workflows/delete_backport_branch.yml index 5881df9..b8fac1c 100644 --- a/.github/workflows/delete_backport_branch.yml +++ b/.github/workflows/delete_backport_branch.yml @@ -10,6 +10,6 @@ jobs: if: startsWith(github.event.pull_request.head.ref,'backport/') steps: - name: Delete merged branch - uses: SvanBoxel/delete-merged-branch@main + uses: SvanBoxel/delete-merged-branch@2b5b058e3db41a3328fd9a6a58fd4c2545a14353 # main env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml index a52a751..582b980 100644 --- a/.github/workflows/links.yml +++ b/.github/workflows/links.yml @@ -6,9 +6,9 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Lychee Link Checker - uses: lycheeverse/lychee-action@v1.2.0 + uses: lycheeverse/lychee-action@f76b8412c668f78311212d16d33c4784a7d8762c # v1.2.0 with: args: --accept=200,403,429 --exclude-mail **/*.html **/*.md **/*.txt **/*.json --exclude-file .lychee.excludes fail: true diff --git a/.github/workflows/maven-publish.yml b/.github/workflows/maven-publish.yml index ba98a53..f6571ea 100644 --- a/.github/workflows/maven-publish.yml +++ b/.github/workflows/maven-publish.yml @@ -15,14 +15,14 @@ jobs: contents: write steps: - - uses: actions/setup-java@v3 + - uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: distribution: temurin # Temurin is a distribution of adoptium java-version: 21 - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Load secret - uses: 1password/load-secrets-action@v2 + uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2 with: # Export loaded secrets as environment variables export-env: true @@ -32,7 +32,7 @@ jobs: MAVEN_SNAPSHOTS_S3_ROLE: op://opensearch-infra-secrets/maven-snapshots-s3/role - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5 with: role-to-assume: ${{ env.MAVEN_SNAPSHOTS_S3_ROLE }} aws-region: us-east-1 diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml index 129ece8..bc99e1a 100644 --- a/.github/workflows/release-drafter.yml +++ b/.github/workflows/release-drafter.yml @@ -17,12 +17,12 @@ jobs: permissions: write-all steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - id: get_data run: | echo "approvers=$(cat .github/CODEOWNERS | grep @ | tr -d '*\n ' | sed 's/@/,/g' | sed 's/,//1')" >> $GITHUB_OUTPUT echo "version=$(cat version.properties)" >> $GITHUB_OUTPUT - - uses: trstringer/manual-approval@v1 + - uses: trstringer/manual-approval@74d99dff7380e3e4b122d4ededcbca2b6ce59367 # v1 with: secret: ${{ github.TOKEN }} approvers: ${{ steps.get_data.outputs.approvers }} @@ -31,7 +31,7 @@ jobs: issue-body: "Please approve or deny the release of performance-analyzer-commons **TAG**: ${{ github.ref_name }} **COMMIT**: ${{ github.sha }} **VERSION** : ${{ steps.get_data.outputs.version }} " exclude-workflow-initiator-as-approver: true - name: Set up JDK 25 - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: 21 distribution: 'temurin' @@ -40,7 +40,7 @@ jobs: run: | ./gradlew --no-daemon -Dbuild.snapshot=false publishCreatePublicationToLocalRepoRepository && tar -C build -cvf artifacts.tar.gz repository - name: Draft a release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 with: draft: true generate_release_notes: true