adam/.github
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/.github.git synced 2026-09-30 05:53:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ci(workflows): pin remaining GitHub Actions to SHA (#139)
Some checks failed
ci / ci / ci (push) Has been cancelled
Details
Release on reusable change / version (push) Has been cancelled
Details
Release on reusable change / release (push) Has been cancelled
Details

Browse source 
Mutable tags and the dependency-review v5 branch executed inside every consumer, including OIDC deploy jobs. SHA pins with version comments match the policy scanner and let Renovate advance them.
This commit is contained in:
Adam Moussa 2026-08-26 18:25:53 -04:00 • committed by GitHub
parent 1a45bf286f
commit 4a6cbfd362
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
14 changed files with 39 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/callable-dependency-review.yaml vendored
View file

@ -16,8 +16,8 @@ jobs:
dependency-review: dependency-review:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/dependency-review-action@v5 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
with: with:
fail-on-severity: high fail-on-severity: high
allow-ghsas: ${{ inputs.allow-ghsas }} allow-ghsas: ${{ inputs.allow-ghsas }}

8
.github/workflows/cd-cdk.yaml vendored
View file

@ -70,12 +70,12 @@ jobs:
group: cd-cdk-${{ inputs.region }}-${{ inputs.stacks }}-${{ inputs.stack-name }} group: cd-cdk-${{ inputs.region }}-${{ inputs.stacks }}-${{ inputs.stack-name }}
cancel-in-progress: false cancel-in-progress: false
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
if: ${{ inputs.enable-qemu }} if: ${{ inputs.enable-qemu }}
- uses: actions/setup-dotnet@v6 - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
if: ${{ inputs.dotnet-version != '' }} if: ${{ inputs.dotnet-version != '' }}
with: with:
dotnet-version: ${{ inputs.dotnet-version }} dotnet-version: ${{ inputs.dotnet-version }}
@ -95,11 +95,11 @@ jobs:
--self-contained false \ --self-contained false \
--output "$(dirname "$DOTNET_PUBLISH_PROJECT")/bin/Release/net8.0/linux-arm64/publish" --output "$(dirname "$DOTNET_PUBLISH_PROJECT")/bin/Release/net8.0/linux-arm64/publish"
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
if: ${{ inputs.python-version != '' }} if: ${{ inputs.python-version != '' }}
with: with:
python-version: ${{ inputs.python-version }} python-version: ${{ inputs.python-version }}

4
.github/workflows/cd-dotnet-eb.yaml vendored
View file

@ -82,9 +82,9 @@ jobs:
run: run:
working-directory: ${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-dotnet@v6 - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
with: with:
dotnet-version: ${{ inputs.dotnet-version }} dotnet-version: ${{ inputs.dotnet-version }}

4
.github/workflows/cd-mobile-ios.yaml vendored
View file

@ -69,14 +69,14 @@ jobs:
run: run:
working-directory: ${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with: with:
role-to-assume: ${{ secrets.deploy-role-arn }} role-to-assume: ${{ secrets.deploy-role-arn }}
aws-region: ${{ inputs.region }} aws-region: ${{ inputs.region }}
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
cache: npm cache: npm

6
.github/workflows/cd-sam.yaml vendored
View file

@ -49,13 +49,13 @@ jobs:
group: cd-sam-${{ inputs.region }}-${{ inputs.stack-name }} group: cd-sam-${{ inputs.region }}-${{ inputs.stack-name }}
cancel-in-progress: false cancel-in-progress: false
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with: with:
python-version: ${{ inputs.python-version }} python-version: ${{ inputs.python-version }}
- uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0
- uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with: with:

4
.github/workflows/ci-dotnet.yaml vendored
View file

@ -34,9 +34,9 @@ jobs:
run: run:
working-directory: ${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-dotnet@v6 - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
with: with:
dotnet-version: ${{ inputs.dotnet-version }} dotnet-version: ${{ inputs.dotnet-version }}

8
.github/workflows/ci-mobile-ios.yaml vendored
View file

@ -137,9 +137,9 @@ jobs:
run: run:
working-directory: ${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
cache: npm cache: npm
@ -206,9 +206,9 @@ jobs:
run: run:
working-directory: ${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
cache: npm cache: npm

12
.github/workflows/ci-python-app.yaml vendored
View file

@ -60,9 +60,9 @@ jobs:
group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-lint group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-lint
cancel-in-progress: true cancel-in-progress: true
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with: with:
python-version: ${{ inputs.python-version }} python-version: ${{ inputs.python-version }}
@ -109,9 +109,9 @@ jobs:
group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-test-collect group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-test-collect
cancel-in-progress: true cancel-in-progress: true
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with: with:
python-version: ${{ inputs.python-version }} python-version: ${{ inputs.python-version }}
cache: pip cache: pip
@ -133,9 +133,9 @@ jobs:
group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-subproject-tests group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-subproject-tests
cancel-in-progress: true cancel-in-progress: true
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with: with:
python-version: ${{ inputs.python-version }} python-version: ${{ inputs.python-version }}
cache: pip cache: pip

8
.github/workflows/ci-python-sam.yaml vendored
View file

@ -55,9 +55,9 @@ jobs:
group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }} group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}
cancel-in-progress: true cancel-in-progress: true
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with: with:
python-version: ${{ inputs.python-version }} python-version: ${{ inputs.python-version }}
@ -89,7 +89,7 @@ jobs:
- name: Setup Node.js - name: Setup Node.js
if: ${{ inputs.run-cdk-synth }} if: ${{ inputs.run-cdk-synth }}
uses: actions/setup-node@v7 uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
@ -153,7 +153,7 @@ jobs:
- name: Setup SAM CLI - name: Setup SAM CLI
if: ${{ inputs.run-sam-validate }} if: ${{ inputs.run-sam-validate }}
uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0
- name: SAM validate - name: SAM validate
if: ${{ inputs.run-sam-validate }} if: ${{ inputs.run-sam-validate }}

4
.github/workflows/ci-static.yaml vendored
View file

@ -70,9 +70,9 @@ jobs:
CHECK_DIR: ${{ inputs.check-dir }} CHECK_DIR: ${{ inputs.check-dir }}
BUILD_COMMAND: ${{ inputs.build-command }} BUILD_COMMAND: ${{ inputs.build-command }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
if: ${{ inputs.run-htmlhint || inputs.build-command != '' }} if: ${{ inputs.run-htmlhint || inputs.build-command != '' }}
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}

8
.github/workflows/ci-typescript-cdk.yaml vendored
View file

@ -67,12 +67,12 @@ jobs:
group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }} group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
cancel-in-progress: true cancel-in-progress: true
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
if: ${{ inputs.enable-qemu }} if: ${{ inputs.enable-qemu }}
- uses: actions/setup-dotnet@v6 - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
if: ${{ inputs.dotnet-version != '' }} if: ${{ inputs.dotnet-version != '' }}
with: with:
dotnet-version: ${{ inputs.dotnet-version }} dotnet-version: ${{ inputs.dotnet-version }}
@ -81,7 +81,7 @@ jobs:
if: ${{ inputs.dotnet-publish-project != '' }} if: ${{ inputs.dotnet-publish-project != '' }}
run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
cache: npm cache: npm
@ -159,7 +159,7 @@ jobs:
- name: Setup SAM CLI - name: Setup SAM CLI
if: ${{ inputs.run-sam-validate }} if: ${{ inputs.run-sam-validate }}
uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3 uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3.0.0
- name: SAM validate - name: SAM validate
if: ${{ inputs.run-sam-validate }} if: ${{ inputs.run-sam-validate }}

4
.github/workflows/ci-typescript-frontend.yaml vendored
View file

@ -87,11 +87,11 @@ jobs:
run: run:
working-directory: ${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: actions/setup-node@v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: ${{ inputs.node-version }} node-version: ${{ inputs.node-version }}
cache: npm cache: npm

2
.github/workflows/release-on-merge.yaml vendored
View file

@ -59,7 +59,7 @@ jobs:
outputs: outputs:
version: ${{ steps.next.outputs.version }} version: ${{ steps.next.outputs.version }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
# Tags are the input to the version calculation, so they must be # Tags are the input to the version calculation, so they must be
# fetched; a shallow checkout without them would restart at 1.0.0. # fetched; a shallow checkout without them would restart at 1.0.0.

2
.github/workflows/release.yaml vendored
View file

@ -118,7 +118,7 @@ jobs:
released: ${{ steps.publish.outputs.released || 'false' }} released: ${{ steps.publish.outputs.released || 'false' }}
url: ${{ steps.publish.outputs.url }} url: ${{ steps.publish.outputs.url }}
steps: steps:
- uses: actions/checkout@v7.0.1 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
# Full history + tags: the existing-tag guard reads local refs. # Full history + tags: the existing-tag guard reads local refs.
fetch-depth: 0 fetch-depth: 0