Pin GitHub Actions to specific SHAs, delete unused workflows, and other tidying (#1662)

Author: Scotchester

.github/dependabot.yaml

@@ -1,13 +1,12 @@
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
 
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    # Workflow files stored in the
-    # default location of `.github/workflows`
+    # Workflow files stored in the default location of `.github/workflows`
     directory: "/"
     schedule:
       interval: "daily"

.github/workflows/close-crm-update.yml

@@ -1,4 +1,4 @@
-name: Generate QR code
+name: Generate QR Code
 on:
   workflow_dispatch:
     inputs:
@@ -38,10 +38,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # 7.0.0
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # 6.3.0
         with:
           python-version: "3.11"
           cache: pip
@@ -60,7 +60,7 @@ jobs:
             qr-code.png
 
       - name: Upload QR code as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # 7.0.1
         with:
           name: qr-code.png
           path: qr-code.png

.github/workflows/generate-qr-code.yml

@@ -16,12 +16,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # 7.0.0
         with:
           ref: "refs/pull/${{ github.event.number }}/merge"
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # 6.3.0
         with:
           python-version: "3.10"
           cache: pip
@@ -46,23 +46,18 @@ jobs:
             --site=${{ secrets.NETLIFY_PREVIEW_APP_SITE_ID }}
 
       - name: Find existing comment
-        uses: peter-evans/find-comment@v4
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad  # 4.0.0
         id: find-comment
         with:
           issue-number: ${{ github.event.number }}
           comment-author: "github-actions[bot]"
-          body-includes: "Preview url: https://"
+          body-includes: "Preview URL: https://"
 
       - name: Add Netlify link PR comment
-        uses: actions/github-script@v9
         if: steps.find-comment.outputs.comment-id == ''
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const hostnameSuffix = "cal-itp-previews.netlify.app"
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: `Preview url: https://${context.repo.repo}-${{ github.event.number }}--${hostnameSuffix}`,
-            })
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
+        run: |
+          gh pr comment ${{ github.event.number }} \
+            --body "Preview URL: https://${GITHUB_REPOSITORY#*/}-$PR_NUMBER--cal-itp-previews.netlify.app"

.github/workflows/mkdocs-preview.yml

@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # 7.0.0
 
       - name: Deploy docs
-        uses: mhausenblas/mkdocs-deploy-gh-pages@master
+        uses: mhausenblas/mkdocs-deploy-gh-pages@d77dd03172e96abbcdb081d8c948224762033653
         env:
           REQUIREMENTS: docs/requirements.txt
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/mkdocs.yml

@@ -1,4 +1,4 @@
-name: Create Monthly D5 update issue
+name: Create Monthly D5 Update Issue
 
 on:
   workflow_dispatch:
@@ -13,22 +13,21 @@ jobs:
       issues: write
     steps:
       # Get last month's name as a variable
-      # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-output-parameter
+      # https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#setting-an-output-parameter
       - id: set_output
         run: |
           echo "month=$(date -d 'last month' +%B)" >> $GITHUB_OUTPUT
 
       - id: create_issue
-        uses: imjohnbo/issue-bot@v3
-        with:
-          assignees: "o-ram, laneymangan" 
-          labels: reporting
-          title: Send monthly update to D5 for ${{steps.set_output.outputs.month}}
-          body: |
-            ## To-Do
-
-            - [ ] Inform D5 transit reps of any updates regarding district agencies or relevant Cal-ITP news from ${{steps.set_output.outputs.month}}
-          pinned: false
-          close-previous: false
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # The `--body-file -` option below uses the multiline content from stdin for the body.
+        # See: https://github.com/cli/cli/issues/595
+        run: |
+          echo -e "## To-Do\n\n- [ ] Inform D5 transit reps of any updates regarding district agencies or relevant Cal-ITP news from ${{ steps.set_output.outputs.month }}" | \
+          gh issue create \
+            --title "Send monthly update to D5 for ${{ steps.set_output.outputs.month }}" \
+            --body-file - \
+            --label "reporting" \
+            --assignee o-ram,laneymangan \
+            --repo $GITHUB_REPOSITORY

.github/workflows/monthly-d5-issue.yml

@@ -1,4 +1,4 @@
-name: Notify Slack for New User requests
+name: Notify Slack for New User Requests
 
 on:
   issues:
@@ -10,12 +10,12 @@ jobs:
     if: contains(github.event.issue.labels.*.name, 'new-user')
     steps:
       - name: Slack notification
-        uses: rtCamp/action-slack-notify@v2
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
           SLACK_USERNAME: cal-itp-bot
           SLACK_MSG_AUTHOR: cal-itp-bot
           SLACK_ICON: https://github.com/cal-itp-bot.png?size=48
-          SLACK_MESSAGE: "A Hubspot new user request was submitted: ${{ github.event.issue.html_url }}"
+          SLACK_MESSAGE: "A HubSpot new user request was submitted: ${{ github.event.issue.html_url }}"
           SLACK_FOOTER: ""
           MSG_MINIMAL: true

.github/workflows/monthly-report-issue.yml

@@ -1,4 +1,4 @@
-name: Create Quaterly Report issue
+name: Create Quaterly Report Issue
 
 on:
   workflow_dispatch:
@@ -13,25 +13,21 @@ jobs:
       issues: write
     steps:
       # Get last month's name as a variable
-      # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-output-parameter
+      # https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#setting-an-output-parameter
       - id: set_output
         run: |
           echo "month=$(date -d 'last month' +%B)" >> $GITHUB_OUTPUT
 
       - id: create_issue
-        uses: imjohnbo/issue-bot@v3
-        with:
-          assignees: j-h-sullivan
-          labels: reporting
-          title: Draft and send Quarterly Report for ${{steps.set_output.outputs.month}}
-          body: |
-            ## To-Do
-
-            - [ ] Pull in information from Metabase and Hubspot
-            - [ ] Draft report in Google Doc
-            - [ ] Review from @AnthonyRollins and @o-ram
-            - [ ] Send for design to Colleen
-          pinned: false
-          close-previous: false
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # The `--body-file -` option below uses the multiline content from stdin for the body.
+        # See: https://github.com/cli/cli/issues/595
+        run: |
+          echo -e "## To-Do\n\n- [ ] Pull in information from Metabase and HubSpot\n- [ ] Draft report in Google Doc\n- [ ] Review from @AnthonyRollins and @o-ram\n- [ ] Send for design to Colleen" | \
+          gh issue create \
+            --title "Draft and send Quarterly Report for ${{ steps.set_output.outputs.month }}" \
+            --body-file - \
+            --label "reporting" \
+            --assignee j-h-sullivan \
+            --repo $GITHUB_REPOSITORY