Skip to content

Commit 67e24dd

Browse files
hhvrchhvrc
authored
security: Pin Github Actions (#58)
1 parent 0b920f2 commit 67e24dd

3 files changed

Lines changed: 32 additions & 32 deletions

File tree

‎.github/workflows/build-module-base.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323

2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v6
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727

2828
- name: Check host dependency list is in sync
2929
run: bash scripts/sync-host-deps.sh
@@ -34,15 +34,15 @@ jobs:
3434

3535
steps:
3636
- name: Checkout
37-
uses: actions/checkout@v6
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838

3939
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
40-
uses: actions/setup-dotnet@v5
40+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
4141
with:
4242
dotnet-version: ${{ env.DOTNET_VERSION }}
4343

4444
- name: Cache NuGet packages
45-
uses: actions/cache@v5
45+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
4646
with:
4747
path: ~/.nuget/packages
4848
key: module-base-nuget
@@ -70,7 +70,7 @@ jobs:
7070
run: dotnet build ModuleBase/ModuleBase.csproj -c Release -o ./publish/ModuleBase -p:PackageVersion=${{ steps.version.outputs.package_version }}
7171

7272
- name: Upload artifacts
73-
uses: actions/upload-artifact@v7
73+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
7474
with:
7575
name: OpenShock Desktop Module Base
7676
path: ./publish/ModuleBase/**
@@ -87,7 +87,7 @@ jobs:
8787

8888
steps:
8989
- name: Download artifacts
90-
uses: actions/download-artifact@v8
90+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
9191
with:
9292
name: OpenShock Desktop Module Base
9393
path: ./packages
@@ -105,18 +105,18 @@ jobs:
105105

106106
steps:
107107
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
108-
uses: actions/setup-dotnet@v5
108+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
109109
with:
110110
dotnet-version: ${{ env.DOTNET_VERSION }}
111111

112112
- name: Download artifacts
113-
uses: actions/download-artifact@v8
113+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
114114
with:
115115
name: OpenShock Desktop Module Base
116116
path: ./packages
117117

118118
- name: Login to NuGet.org with trusted publishing
119-
uses: NuGet/login@v1
119+
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
120120
id: nuget-login
121121
with:
122122
user: ${{ secrets.NUGET_USER }}

‎.github/workflows/ci-build.yml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -43,18 +43,18 @@ jobs:
4343

4444
steps:
4545
- name: Checkout
46-
uses: actions/checkout@v6
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4747

4848
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
49-
uses: actions/setup-dotnet@v5
49+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
5050
with:
5151
dotnet-version: ${{ env.DOTNET_VERSION }}
5252

5353
- name: Install maui workload for windows
5454
run: dotnet workload install maui-windows
5555

5656
- name: Cache NuGet packages
57-
uses: actions/cache@v5
57+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
5858
with:
5959
path: ~/.nuget/packages
6060
key: windows-maui-nuget
@@ -65,7 +65,7 @@ jobs:
6565
run: dotnet publish Desktop/Desktop.csproj -c Release-Windows -o ./publish/Windows-Maui
6666

6767
- name: Upload OpenShock Desktop Windows artifacts
68-
uses: actions/upload-artifact@v7
68+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
6969
with:
7070
name: OpenShock Desktop Windows MAUI
7171
path: publish/Windows-Maui/*
@@ -79,13 +79,13 @@ jobs:
7979

8080
steps:
8181
- name: Checkout
82-
uses: actions/checkout@v6
82+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8383
with:
8484
sparse-checkout: |
8585
Installer
8686
8787
- name: Download artifacts
88-
uses: actions/download-artifact@v8
88+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
8989
with:
9090
name: OpenShock Desktop Windows MAUI
9191
path: publish/
@@ -94,13 +94,13 @@ jobs:
9494
run: choco install nsis -y
9595

9696
- name: Create nsis installer
97-
uses: joncloud/makensis-action@publish
97+
uses: joncloud/makensis-action@971ef20f43e4f9f3af2c7f276cb7348d033da1cd # v5.0
9898
with:
9999
script-file: ${{ github.workspace }}/Installer/installer.nsi
100100
additional-plugin-paths: ${{ github.workspace }}/Installer/Plugins
101101

102102
- name: Upload OpenShock Desktop Windows Setup
103-
uses: actions/upload-artifact@v7
103+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
104104
with:
105105
name: OpenShock_Desktop_Setup
106106
path: Installer/OpenShock_Desktop_Setup.exe
@@ -114,21 +114,21 @@ jobs:
114114

115115
steps:
116116
- name: Checkout
117-
uses: actions/checkout@v6
117+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
118118

119119
- name: Set up Docker Buildx
120-
uses: docker/setup-buildx-action@v4
120+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
121121

122122
- name: Log in to Container Registry
123-
uses: docker/login-action@v4
123+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
124124
with:
125125
registry: ${{ env.REGISTRY }}
126126
username: ${{ github.actor }}
127127
password: ${{ secrets.GITHUB_TOKEN }}
128128

129129
- name: Extract metadata (tags, labels) for Docker
130130
id: meta
131-
uses: docker/metadata-action@v6
131+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
132132
with:
133133
images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/desktop
134134
flavor: |
@@ -144,7 +144,7 @@ jobs:
144144
type=semver,pattern={{major}}.{{minor}}.{{patch}}
145145
146146
- name: Build and push
147-
uses: docker/build-push-action@v7
147+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
148148
with:
149149
context: .
150150
file: Dockerfile
@@ -163,15 +163,15 @@ jobs:
163163

164164
steps:
165165
- name: Checkout
166-
uses: actions/checkout@v6
166+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
167167

168168
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
169-
uses: actions/setup-dotnet@v5
169+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
170170
with:
171171
dotnet-version: ${{ env.DOTNET_VERSION }}
172172

173173
- name: Cache NuGet packages
174-
uses: actions/cache@v5
174+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
175175
with:
176176
path: ~/.nuget/packages
177177
key: linux-photino-nuget
@@ -182,7 +182,7 @@ jobs:
182182
run: dotnet publish Desktop/Desktop.csproj -c Release-Photino -o ./publish/Photino-Linux
183183

184184
- name: Upload OpenShock Desktop Photino Linux artifacts
185-
uses: actions/upload-artifact@v7
185+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
186186
with:
187187
name: OpenShock Desktop Photino Linux
188188
path: publish/Photino-Linux/*

‎.github/workflows/ci-tag.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
steps:
1818
- name: Find latest tag
1919
id: latest-tag
20-
uses: oprypin/find-latest-tag@v1
20+
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
2121
continue-on-error: true
2222
with:
2323
repository: ${{ github.repository }}
@@ -36,7 +36,7 @@ jobs:
3636
steps:
3737
- name: Find latest RC tag
3838
id: latest-rc
39-
uses: oprypin/find-latest-tag@v1
39+
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
4040
continue-on-error: true
4141
with:
4242
repository: ${{ github.repository }}
@@ -68,19 +68,19 @@ jobs:
6868
contents: write
6969
steps:
7070
- name: Download Windows installer
71-
uses: actions/download-artifact@v8
71+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
7272
with:
7373
name: OpenShock_Desktop_Setup
7474
path: artifacts/
7575

7676
- name: Download Linux Photino
77-
uses: actions/download-artifact@v8
77+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
7878
with:
7979
name: OpenShock Desktop Photino Linux
8080
path: artifacts/photino-linux/
8181

8282
- name: Download Module Base
83-
uses: actions/download-artifact@v8
83+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
8484
with:
8585
name: OpenShock Desktop Module Base
8686
path: artifacts/module-base/
@@ -91,7 +91,7 @@ jobs:
9191
cd artifacts/module-base && zip -r ../OpenShock.Desktop.Module.Base.zip . && cd ../..
9292
9393
- name: Create draft release
94-
uses: softprops/action-gh-release@v2
94+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
9595
with:
9696
tag_name: ${{ github.ref_name }}
9797
name: ${{ github.ref_name }}

0 commit comments

Comments
 (0)
⚡