From 4a6cbfd362140a68810f0f46d338026863b8e827 Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Wed, 26 Aug 2026 18:25:53 -0400 Subject: [PATCH] ci(workflows): pin remaining GitHub Actions to SHA (#139) Mutable tags and the dependency-review v5 branch executed inside every consumer, including OIDC deploy jobs. SHA pins with version comments match the policy scanner and let Renovate advance them. --- .github/workflows/callable-dependency-review.yaml | 4 ++-- .github/workflows/cd-cdk.yaml | 8 ++++---- .github/workflows/cd-dotnet-eb.yaml | 4 ++-- .github/workflows/cd-mobile-ios.yaml | 4 ++-- .github/workflows/cd-sam.yaml | 6 +++--- .github/workflows/ci-dotnet.yaml | 4 ++-- .github/workflows/ci-mobile-ios.yaml | 8 ++++---- .github/workflows/ci-python-app.yaml | 12 ++++++------ .github/workflows/ci-python-sam.yaml | 8 ++++---- .github/workflows/ci-static.yaml | 4 ++-- .github/workflows/ci-typescript-cdk.yaml | 8 ++++---- .github/workflows/ci-typescript-frontend.yaml | 4 ++-- .github/workflows/release-on-merge.yaml | 2 +- .github/workflows/release.yaml | 2 +- 14 files changed, 39 insertions(+), 39 deletions(-) diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml index dc3b2b5..0d1545a 100644 --- a/.github/workflows/callable-dependency-review.yaml +++ b/.github/workflows/callable-dependency-review.yaml @@ -16,8 +16,8 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 - - uses: actions/dependency-review-action@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: fail-on-severity: high allow-ghsas: ${{ inputs.allow-ghsas }} diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml index b84537b..616acc0 100644 --- a/.github/workflows/cd-cdk.yaml +++ b/.github/workflows/cd-cdk.yaml @@ -70,12 +70,12 @@ jobs: group: cd-cdk-${{ inputs.region }}-${{ inputs.stacks }}-${{ inputs.stack-name }} cancel-in-progress: false steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 if: ${{ inputs.enable-qemu }} - - uses: actions/setup-dotnet@v6 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 if: ${{ inputs.dotnet-version != '' }} with: dotnet-version: ${{ inputs.dotnet-version }} @@ -95,11 +95,11 @@ jobs: --self-contained false \ --output "$(dirname "$DOTNET_PUBLISH_PROJECT")/bin/Release/net8.0/linux-arm64/publish" - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 if: ${{ inputs.python-version != '' }} with: python-version: ${{ inputs.python-version }} diff --git a/.github/workflows/cd-dotnet-eb.yaml b/.github/workflows/cd-dotnet-eb.yaml index bad2939..070bafb 100644 --- a/.github/workflows/cd-dotnet-eb.yaml +++ b/.github/workflows/cd-dotnet-eb.yaml @@ -82,9 +82,9 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-dotnet@v6 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version }} diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml index df79a2b..e0d64d4 100644 --- a/.github/workflows/cd-mobile-ios.yaml +++ b/.github/workflows/cd-mobile-ios.yaml @@ -69,14 +69,14 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.deploy-role-arn }} aws-region: ${{ inputs.region }} - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} cache: npm diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml index 2b776a5..959db1e 100644 --- a/.github/workflows/cd-sam.yaml +++ b/.github/workflows/cd-sam.yaml @@ -49,13 +49,13 @@ jobs: group: cd-sam-${{ inputs.region }}-${{ inputs.stack-name }} cancel-in-progress: false steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} - - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 + - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0 - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: diff --git a/.github/workflows/ci-dotnet.yaml b/.github/workflows/ci-dotnet.yaml index 15c9201..cd9fb0d 100644 --- a/.github/workflows/ci-dotnet.yaml +++ b/.github/workflows/ci-dotnet.yaml @@ -34,9 +34,9 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-dotnet@v6 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version }} diff --git a/.github/workflows/ci-mobile-ios.yaml b/.github/workflows/ci-mobile-ios.yaml index d51b776..aa8fd12 100644 --- a/.github/workflows/ci-mobile-ios.yaml +++ b/.github/workflows/ci-mobile-ios.yaml @@ -137,9 +137,9 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} cache: npm @@ -206,9 +206,9 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} cache: npm diff --git a/.github/workflows/ci-python-app.yaml b/.github/workflows/ci-python-app.yaml index 7006257..04fbe28 100644 --- a/.github/workflows/ci-python-app.yaml +++ b/.github/workflows/ci-python-app.yaml @@ -60,9 +60,9 @@ jobs: group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-lint cancel-in-progress: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} @@ -109,9 +109,9 @@ jobs: group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-test-collect cancel-in-progress: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} cache: pip @@ -133,9 +133,9 @@ jobs: group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-subproject-tests cancel-in-progress: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} cache: pip diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml index 29a752e..3204967 100644 --- a/.github/workflows/ci-python-sam.yaml +++ b/.github/workflows/ci-python-sam.yaml @@ -55,9 +55,9 @@ jobs: group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }} cancel-in-progress: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} @@ -89,7 +89,7 @@ jobs: - name: Setup Node.js if: ${{ inputs.run-cdk-synth }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} @@ -153,7 +153,7 @@ jobs: - name: Setup SAM CLI if: ${{ inputs.run-sam-validate }} - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 + uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0 - name: SAM validate if: ${{ inputs.run-sam-validate }} diff --git a/.github/workflows/ci-static.yaml b/.github/workflows/ci-static.yaml index 3e85a60..b8f5543 100644 --- a/.github/workflows/ci-static.yaml +++ b/.github/workflows/ci-static.yaml @@ -70,9 +70,9 @@ jobs: CHECK_DIR: ${{ inputs.check-dir }} BUILD_COMMAND: ${{ inputs.build-command }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 if: ${{ inputs.run-htmlhint || inputs.build-command != '' }} with: node-version: ${{ inputs.node-version }} diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml index bf494aa..260434b 100644 --- a/.github/workflows/ci-typescript-cdk.yaml +++ b/.github/workflows/ci-typescript-cdk.yaml @@ -67,12 +67,12 @@ jobs: group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }} cancel-in-progress: true steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 if: ${{ inputs.enable-qemu }} - - uses: actions/setup-dotnet@v6 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 if: ${{ inputs.dotnet-version != '' }} with: dotnet-version: ${{ inputs.dotnet-version }} @@ -81,7 +81,7 @@ jobs: if: ${{ inputs.dotnet-publish-project != '' }} run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} cache: npm @@ -159,7 +159,7 @@ jobs: - name: Setup SAM CLI if: ${{ inputs.run-sam-validate }} - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 + uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0 - name: SAM validate if: ${{ inputs.run-sam-validate }} diff --git a/.github/workflows/ci-typescript-frontend.yaml b/.github/workflows/ci-typescript-frontend.yaml index a96d9a6..4c7c1a4 100644 --- a/.github/workflows/ci-typescript-frontend.yaml +++ b/.github/workflows/ci-typescript-frontend.yaml @@ -87,11 +87,11 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} cache: npm diff --git a/.github/workflows/release-on-merge.yaml b/.github/workflows/release-on-merge.yaml index b2df093..211885a 100644 --- a/.github/workflows/release-on-merge.yaml +++ b/.github/workflows/release-on-merge.yaml @@ -59,7 +59,7 @@ jobs: outputs: version: ${{ steps.next.outputs.version }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Tags are the input to the version calculation, so they must be # fetched; a shallow checkout without them would restart at 1.0.0. diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bbac516..7923e5c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -118,7 +118,7 @@ jobs: released: ${{ steps.publish.outputs.released || 'false' }} url: ${{ steps.publish.outputs.url }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Full history + tags: the existing-tag guard reads local refs. fetch-depth: 0