Skip to content

chore(ci): pin all GitHub Actions to SHA digests #1233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fcanogab wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(ci): pin all GitHub Actions to SHA digests #1233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/branch-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
outputs:
should_run: ${{ steps.gate.outputs.should_run }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- id: gate
uses: ./.github/actions/pr-gate
Expand All @@ -46,7 +46,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Mark workspace as safe for git
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
Expand All @@ -70,7 +70,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install tools
run: mise install --locked
Expand All @@ -95,7 +95,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install tools
run: mise install --locked
Expand Down Expand Up @@ -148,7 +148,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install tools
run: mise install --locked
Expand All @@ -173,7 +173,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install tools
run: mise install --locked
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/branch-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Check Fern preview availability
id: fern-preview
Expand All @@ -34,7 +34,7 @@ jobs:
fi

- name: Setup Node.js
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: "24"

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/branch-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
outputs:
should_run: ${{ steps.gate.outputs.should_run }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- id: gate
uses: ./.github/actions/pr-gate
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/ci-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,10 @@ jobs:
runs-on: ${{ matrix.runner }}
timeout-minutes: 60
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Log in to GitHub Container Registry
uses: docker/login-action@v4
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
Expand Down Expand Up @@ -92,7 +92,7 @@ jobs:
timeout-minutes: 10
steps:
- name: Log in to GitHub Container Registry
uses: docker/login-action@v4
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/deb-package.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,24 +42,24 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs['checkout-ref'] }}

- name: Download CLI artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: cli-linux-${{ matrix.arch }}
path: package-input/

- name: Download gateway artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: gateway-binary-linux-${{ matrix.arch }}
path: package-input/

- name: Download VM driver artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: driver-vm-linux-${{ matrix.arch }}
path: package-input/
Expand All @@ -85,7 +85,7 @@ jobs:
tasks/scripts/package-deb.sh

- name: Upload Debian package artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: deb-linux-${{ matrix.arch }}
path: artifacts/*.deb
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/docker-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ jobs:
DOCKER_PUSH: ${{ inputs.push && '1' || '0' }}
DOCKER_PLATFORM: ${{ matrix.platform }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0

Expand All @@ -200,7 +200,7 @@ jobs:
buildkitd-config: /etc/buildkit/buildkitd.toml

- name: Download Rust binary artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: ${{ needs.resolve.outputs.artifact_prefix }}-linux-${{ matrix.arch }}
path: prebuilt-rust-binary
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/driver-vm-linux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs['checkout-ref'] }}

Expand Down Expand Up @@ -66,7 +66,7 @@ jobs:
done

- name: Upload runtime artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: vm-driver-kernel-runtime-tarballs
path: runtime-artifacts/vm-runtime-*.tar.zst
Expand Down Expand Up @@ -100,7 +100,7 @@ jobs:
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs['checkout-ref'] }}
fetch-depth: 0
Expand All @@ -125,7 +125,7 @@ jobs:
run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*

- name: Download kernel runtime tarball
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: vm-driver-kernel-runtime-tarballs
path: runtime-download/
Expand Down Expand Up @@ -202,7 +202,7 @@ jobs:
-C target/release openshell-driver-vm

- name: Upload artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: driver-vm-linux-${{ matrix.arch }}
path: artifacts/*.tar.gz
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/driver-vm-macos.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs['checkout-ref'] }}

Expand Down Expand Up @@ -60,7 +60,7 @@ jobs:
run: test -f runtime-artifacts/vm-runtime-darwin-aarch64.tar.zst

- name: Upload runtime artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: vm-driver-macos-kernel-runtime-tarball
path: runtime-artifacts/vm-runtime-darwin-aarch64.tar.zst
Expand All @@ -79,7 +79,7 @@ jobs:
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs['checkout-ref'] }}
fetch-depth: 0
Expand Down Expand Up @@ -113,7 +113,7 @@ jobs:
run: mise x -- sccache --show-stats

- name: Upload supervisor bundle
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: driver-vm-supervisor-arm64
path: target/vm-runtime-compressed/openshell-sandbox.zst
Expand All @@ -135,7 +135,7 @@ jobs:
env:
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs['checkout-ref'] }}
fetch-depth: 0
Expand All @@ -158,7 +158,7 @@ jobs:
run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*

- name: Download kernel runtime tarball
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: vm-driver-macos-kernel-runtime-tarball
path: runtime-download/
Expand Down Expand Up @@ -187,7 +187,7 @@ jobs:
ls -lah "$COMPRESSED_DIR"

- name: Download bundled supervisor
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: driver-vm-supervisor-arm64
path: target/vm-runtime-compressed-macos/
Expand Down Expand Up @@ -230,7 +230,7 @@ jobs:
ls -lh artifacts/

- name: Upload artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: driver-vm-macos
path: artifacts/*.tar.gz
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e-gpu-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ jobs:
OPENSHELL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
OPENSHELL_GATEWAY: ${{ matrix.cluster }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Log in to GHCR
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ jobs:
OPENSHELL_REGISTRY_USERNAME: ${{ github.actor }}
OPENSHELL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install OS test dependencies
if: matrix.apt_packages != ''
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/issue-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
steps:
- name: Check contributor permissions
id: contributor
uses: actions/github-script@v9
uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
with:
result-encoding: string
script: |
Expand Down Expand Up @@ -46,7 +46,7 @@ jobs:

- name: Add triage label
if: steps.contributor.outputs.result == 'true'
uses: actions/github-script@v9
uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
with:
script: |
await github.rest.issues.addLabels({
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-auto-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
create-tag:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-canary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ jobs:
# to advertise a reachable address instead.
OPENSHELL_GATEWAY_HOST: host.docker.internal
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Determine release tag
id: release
Expand Down
Loading
Loading