From 11a40c516c8e48580276ba05f89951e5a9e8d41d Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sun, 23 Aug 2026 12:18:56 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .../devcontainer_run_command/action.yml | 2 +- .github/dependabot.yml | 11 ++++++++ .../workflows/build_validation_develop.yml | 14 +++++----- .github/workflows/clean_validation_envs.yml | 4 +-- .github/workflows/deploy_tre_reusable.yml | 26 +++++++++---------- .github/workflows/register_tre_bundle.yml | 10 +++---- 6 files changed, 39 insertions(+), 28 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actions/devcontainer_run_command/action.yml b/.github/actions/devcontainer_run_command/action.yml index fd0e992..f494c48 100644 --- a/.github/actions/devcontainer_run_command/action.yml +++ b/.github/actions/devcontainer_run_command/action.yml @@ -181,7 +181,7 @@ runs: echo "AZURE_ENVIRONMENT=$azure_env" >> $GITHUB_ENV - name: Azure Login - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 if: contains(inputs.COMMAND, 'make bootstrap') != true with: client-id: ${{ inputs.AZURE_CLIENT_ID }} diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2c48305 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build_validation_develop.yml b/.github/workflows/build_validation_develop.yml index 319ad05..52b7a47 100644 --- a/.github/workflows/build_validation_develop.yml +++ b/.github/workflows/build_validation_develop.yml @@ -19,14 +19,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: # Full git history is needed to get a proper list of # changed files within `super-linter` fetch-depth: 0 persist-credentials: false - - uses: hashicorp/setup-terraform@v3 + - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: "1.14.3" - name: Terraform format check @@ -44,7 +44,7 @@ jobs: # the slim image is 2GB smaller and we don't use the extra stuff # Moved this after the Terraform checks above due something similar to this issue: # https://github.com/github/super-linter/issues/2433 - uses: github/super-linter/slim@v5.0.0 + uses: github/super-linter/slim@45fc0d88288beee4701c62761281edfee85655d7 # v5.0.0 env: VALIDATE_ALL_CODEBASE: false DEFAULT_BRANCH: main @@ -59,7 +59,7 @@ jobs: VALIDATE_DOCKERFILE_HADOLINT: true - name: Workspace Tags - uses: github/super-linter/slim@v5.0.0 + uses: github/super-linter/slim@45fc0d88288beee4701c62761281edfee85655d7 # v5.0.0 env: VALIDATE_ALL_CODEBASE: false DEFAULT_BRANCH: main @@ -69,7 +69,7 @@ jobs: FILTER_REGEX_INCLUDE: "./templates/workspaces/.*" - name: Workspace Services Tags - uses: github/super-linter/slim@v5.0.0 + uses: github/super-linter/slim@45fc0d88288beee4701c62761281edfee85655d7 # v5.0.0 env: VALIDATE_ALL_CODEBASE: false DEFAULT_BRANCH: main @@ -80,7 +80,7 @@ jobs: FILTER_REGEX_EXCLUDE: ".*user_resource.*" - name: User Resources Tags - uses: github/super-linter/slim@v5.0.0 + uses: github/super-linter/slim@45fc0d88288beee4701c62761281edfee85655d7 # v5.0.0 env: VALIDATE_ALL_CODEBASE: false DEFAULT_BRANCH: main @@ -90,7 +90,7 @@ jobs: FILTER_REGEX_INCLUDE: "./templates/workspace_services/.*/user_resources/.*" - name: Shared Services Tags - uses: github/super-linter/slim@v5.0.0 + uses: github/super-linter/slim@45fc0d88288beee4701c62761281edfee85655d7 # v5.0.0 env: VALIDATE_ALL_CODEBASE: false DEFAULT_BRANCH: main diff --git a/.github/workflows/clean_validation_envs.yml b/.github/workflows/clean_validation_envs.yml index 0cae184..d81d697 100644 --- a/.github/workflows/clean_validation_envs.yml +++ b/.github/workflows/clean_validation_envs.yml @@ -17,14 +17,14 @@ jobs: environment: Dev timeout-minutes: 30 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: # This is CRITICAL since we're making decisions based on branch existence fetch-depth: 0 persist-credentials: false - name: Azure Login - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/deploy_tre_reusable.yml b/.github/workflows/deploy_tre_reusable.yml index 143db6a..d4d2607 100644 --- a/.github/workflows/deploy_tre_reusable.yml +++ b/.github/workflows/deploy_tre_reusable.yml @@ -181,7 +181,7 @@ jobs: fi - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -189,10 +189,10 @@ jobs: ref: ${{ inputs.prRef }} - name: Set up Docker BuildKit - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Azure Login - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -282,7 +282,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -308,7 +308,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -334,7 +334,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -438,7 +438,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -491,7 +491,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -544,7 +544,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -610,7 +610,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -666,7 +666,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -706,7 +706,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -757,7 +757,7 @@ jobs: environment: ${{ inputs.environmentName }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) diff --git a/.github/workflows/register_tre_bundle.yml b/.github/workflows/register_tre_bundle.yml index 6c47f37..fd0df2e 100644 --- a/.github/workflows/register_tre_bundle.yml +++ b/.github/workflows/register_tre_bundle.yml @@ -106,7 +106,7 @@ jobs: fi - name: Report check status start if: github.sha != '' - uses: LouisBrunner/checks-action@v2.0.0 + uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} sha: ${{ github.sha }} @@ -115,7 +115,7 @@ jobs: details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # if the following values are missing (i.e. not triggered via comment workflow) @@ -123,10 +123,10 @@ jobs: ref: ${{ github.ref }} - name: Set up Docker BuildKit - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Azure Login - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -228,7 +228,7 @@ jobs: id-token: write steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Register Bundle uses: ./.github/actions/devcontainer_run_command