From 246456710a8060db15fd3acc6fbcece61e20fc1d Mon Sep 17 00:00:00 2001 From: Roy Dahan Date: Mon, 8 Jun 2026 03:59:07 +0300 Subject: [PATCH] ci: pin GitHub Actions to commit SHAs Pin all external GitHub Actions to full commit SHAs to reduce supply chain attack surface. Upgrade outdated actions to their latest versions. Reference: https://github.com/scylladb/scylladb/pull/29421 --- .github/workflows/build.yml | 6 +++--- .../workflows/close_issue_for_scylla_employee.yml | 2 +- .github/workflows/docker-description.yml | 4 ++-- .github/workflows/docker.yml | 12 ++++++------ .github/workflows/release.yml | 14 +++++++------- .github/workflows/test.yml | 4 ++-- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8a51e06666..79b78ceaec 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -34,12 +34,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: "temurin" java-version: ${{ inputs.java }} @@ -56,7 +56,7 @@ jobs: --output-dir . - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ycsb-java${{ inputs.java }} path: | diff --git a/.github/workflows/close_issue_for_scylla_employee.yml b/.github/workflows/close_issue_for_scylla_employee.yml index 1b3e28558e..bb7fb197d5 100644 --- a/.github/workflows/close_issue_for_scylla_employee.yml +++ b/.github/workflows/close_issue_for_scylla_employee.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Comment and close if author email is scylladb.com - uses: actions/github-script@v7 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/docker-description.yml b/.github/workflows/docker-description.yml index 33ce6c922a..8b77a87c1a 100644 --- a/.github/workflows/docker-description.yml +++ b/.github/workflows/docker-description.yml @@ -10,10 +10,10 @@ jobs: description: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Docker Hub Description - uses: peter-evans/dockerhub-description@v4 + uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 30f8861204..9f4be10f7e 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -71,18 +71,18 @@ jobs: BUILDX_GIT_INFO: 1 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Login to Docker Registry - uses: docker/login-action@v3 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ${{ secrets.REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -90,7 +90,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 with: images: ${{ inputs.image }} tags: | @@ -99,7 +99,7 @@ jobs: type=sha,prefix= - name: Build and Push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 with: context: . file: Dockerfile diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bb87ca4696..4b66e37a35 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,13 +15,13 @@ jobs: outputs: version: ${{ steps.version_tag.outputs.tag }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 1 - name: Get Tag if: startsWith(github.ref, 'refs/tags/v') - uses: olegtarasov/get-tag@v2.1.4 + uses: olegtarasov/get-tag@9a8716825750e73195b02db42777b92ffe960605 # v2.1.4 id: version_tag with: tagRegex: "v(.*)" @@ -33,11 +33,11 @@ jobs: env: MAVEN_OPTS: "-Xmx2g -XX:+UseG1GC" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: "temurin" java-version: "21" @@ -84,7 +84,7 @@ jobs: needs: [tag, docker, build] runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ycsb-java21 @@ -92,7 +92,7 @@ jobs: run: ls -la - name: Create Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 id: release with: make_latest: true @@ -107,7 +107,7 @@ jobs: scylla-ycsb-${{ needs.tag.outputs.version }}-java21.tar.gz.sha256 - name: Generate Changelog - uses: heinrichreimer/action-github-changelog-generator@v2.4 + uses: heinrichreimer/action-github-changelog-generator@e60b5a2bd9fcd88dadf6345ff8327863fb8b490f # v2.4 with: token: ${{ secrets.GITHUB_TOKEN }} author: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4ddf8a4d0e..1a18c36ddf 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -25,11 +25,11 @@ jobs: matrix: java: ["21"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-tags: true - - uses: actions/setup-java@v4 + - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: "temurin" java-version: "${{ matrix.java }}"