From 1099ef66050cf75d6f542fed62b35d3799d22ca6 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 20:57:16 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 ++++++ .github/workflows/ci.yml | 54 +++++++++++++++++------------------ .github/workflows/cleanup.yml | 6 ++-- 3 files changed, 39 insertions(+), 30 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 60fa0ee1a..5103aa0e3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,3 +7,12 @@ updates: directory: "/" schedule: interval: "daily" + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 274d5b862..8dc333990 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,9 +19,9 @@ jobs: name: "Log Code Metrics" if: github.ref == 'refs/heads/master' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci @@ -32,9 +32,9 @@ jobs: runs-on: ubuntu-latest name: "Compile TypeScript" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci @@ -44,9 +44,9 @@ jobs: runs-on: ubuntu-latest name: "Check Format" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci @@ -55,9 +55,9 @@ jobs: runs-on: ubuntu-latest name: "Lint" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci @@ -66,9 +66,9 @@ jobs: runs-on: ubuntu-latest name: "Unit Tests" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci @@ -77,15 +77,15 @@ jobs: runs-on: ubuntu-latest name: "Build" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci - run: npm run build:contracts - name: Restore Build Cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: .cache key: ${{ runner.os }}-build-cache @@ -94,12 +94,12 @@ jobs: NODE_OPTIONS: "--max-old-space-size=4096" - run: cp -r ./Contracts ./dist/contracts - run: cp -r ./configs ./dist/configs - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: dist path: dist/ - name: "Az CLI login" - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: client-id: ${{ secrets.E2ETESTS_CLIENT_ID }} tenant-id: ${{ secrets.E2ETESTS_TENANT_ID }} @@ -118,7 +118,7 @@ jobs: AZURE_DEVOPS_PAT: ${{ secrets.AZURE_DEVOPS_PAT }} steps: - name: Download Dist Folder - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: dist - run: cp ./configs/prod.json config.json @@ -126,7 +126,7 @@ jobs: - run: dotnet pack DataExplorer.proj /p:PackageVersion="2.0.0-github-${GITHUB_SHA}" - run: dotnet nuget push "bin/Release/*.nupkg" --skip-duplicate --api-key Az --source="$NUGET_SOURCE" - run: dotnet nuget remove source "ADO" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 name: Upload package to Artifacts with: name: prod-package @@ -142,7 +142,7 @@ jobs: AZURE_DEVOPS_PAT: ${{ secrets.AZURE_DEVOPS_PAT }} steps: - name: Download Dist Folder - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: dist - run: cp ./configs/mpac.json config.json @@ -151,7 +151,7 @@ jobs: - run: dotnet pack DataExplorer.proj /p:PackageVersion="2.0.0-github-${GITHUB_SHA}" - run: dotnet nuget push "bin/Release/*.nupkg" --skip-duplicate --api-key Az --source="$NUGET_SOURCE" - run: dotnet nuget remove source "ADO" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 name: Upload package to Artifacts with: name: mpac-package @@ -172,22 +172,22 @@ jobs: shardIndex: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20] shardTotal: [20] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci - run: npx playwright install --with-deps - name: "Az CLI login" - uses: Azure/login@v2 + uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.E2ETESTS_CLIENT_ID }} tenant-id: ${{ secrets.E2ETESTS_TENANT_ID }} subscription-id: ${{ secrets.E2ETESTS_SUBSCRIPTION_ID }} # We can't use MSAL within playwright so we acquire tokens prior to running the tests - name: "Acquire RBAC tokens for test accounts" - uses: azure/cli@v2 + uses: azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0 env: DE_ACCOUNT_PREFIX: ${{ secrets.E2ETESTS_ACCOUNT_PREFIX }} DE_TEST_RESOURCE_GROUP: ${{ secrets.E2ETESTS_RESOURCEGROUP_NAME }} @@ -231,7 +231,7 @@ jobs: run: npx playwright test --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --workers=3 - name: "Re-auth for upload (refresh OIDC token)" if: ${{ !cancelled() }} - uses: Azure/login@v2 + uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.E2ETESTS_CLIENT_ID }} tenant-id: ${{ secrets.E2ETESTS_TENANT_ID }} @@ -262,15 +262,15 @@ jobs: pull-requests: write id-token: write steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - name: Install dependencies run: npm ci - name: "Az CLI login" - uses: Azure/login@v2 + uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.E2ETESTS_CLIENT_ID }} tenant-id: ${{ secrets.E2ETESTS_TENANT_ID }} diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index add9f15e1..5382dc11e 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -23,16 +23,16 @@ jobs: AZURE_SUBSCRIPTION_ID: ${{ secrets.E2ETESTS_SUBSCRIPTION_ID }} E2ETESTS_RESOURCEGROUP_NAME : ${{ secrets.E2ETESTS_RESOURCEGROUP_NAME }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: "Az CLI login" - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.E2ETESTS_CLIENT_ID }} tenant-id: ${{ secrets.E2ETESTS_TENANT_ID }} subscription-id: ${{ secrets.E2ETESTS_SUBSCRIPTION_ID }} - name: Use Node.js 22.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x - run: npm ci