Skip to content

Commit 415e20a

Browse files
say-paulsay-paul
committed
ci: pin all GitHub Actions to full commit SHAs
Pins every `uses:` reference to its commit SHA to prevent supply-chain attacks via mutable tags. Also replaces the abandoned actions-rs/toolchain and actions-rs/cargo wrappers with dtolnay/rust-toolchain and plain `run: cargo` steps. Fixes OpenSSF Scorecard Pinned-Dependencies check (0/10). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Sayan Paul <paul.sayan@gmail.com>
1 parent 9facd43 commit 415e20a

4 files changed

Lines changed: 31 additions & 36 deletions

File tree

‎.github/workflows/analysis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,16 @@ jobs:
1818
security-events: write
1919
steps:
2020
- name: Checkout code
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2222
with:
2323
fetch-depth: 0
2424

2525
- name: Run DevSkim scanner
26-
uses: microsoft/DevSkim-Action@v1
26+
uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1
2727
with:
2828
ignore-globs: '**/examples/**'
2929

3030
- name: Upload DevSkim scan results to GitHub Security tab
31-
uses: github/codeql-action/upload-sarif@v3
31+
uses: github/codeql-action/upload-sarif@7fd177fa680c9881b53cdab4d346d32574c9f7f4 # v3.35.4
3232
with:
3333
sarif_file: devskim-results.sarif

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ jobs:
1313
name: Check spelling
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1717
- name: Check spelling
18-
uses: codespell-project/actions-codespell@master
18+
uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
1919
with:
2020
builtin: clear,rare,usage,code,en-GB_to_en-US
2121
check_filenames: true
@@ -27,28 +27,23 @@ jobs:
2727
name: Cargo fmt
2828
runs-on: ubuntu-latest
2929
steps:
30-
- uses: actions/checkout@v4
31-
- uses: actions-rs/toolchain@v1
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
31+
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
3232
with:
3333
toolchain: stable
34-
- uses: actions-rs/cargo@v1
35-
with:
36-
command: fmt
37-
args: --check --all
34+
components: rustfmt
35+
- run: cargo fmt --check --all
3836

3937
clippy:
4038
name: Clippy
4139
runs-on: ubuntu-latest
4240
container: fedora:latest
4341
steps:
44-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4543
- name: Install deps
4644
run: |
4745
dnf install -y make gcc git clippy cargo rust
48-
- uses: actions-rs/cargo@v1
49-
with:
50-
command: clippy
51-
args: -- -D warnings -D clippy::panic -D clippy::todo
46+
- run: cargo clippy -- -D warnings -D clippy::panic -D clippy::todo
5247

5348
build_and_test_with_coverage:
5449
name: Build, test with coverage
@@ -64,7 +59,7 @@ jobs:
6459
- name: Install deps
6560
run: |
6661
dnf install -y make gcc git cargo rust git grub2-efi grub2-efi-modules shim llvm
67-
- uses: actions/checkout@v4
62+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6863
with:
6964
persist-credentials: false
7065
- name: Fix git trust
@@ -74,14 +69,14 @@ jobs:
7469
- name: Run tests with coverage
7570
run: make test-coverage
7671
- name: Upload coverage report (HTML artifact)
77-
uses: actions/upload-artifact@v4
72+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
7873
with:
7974
name: coverage-report
8075
path: tests/coverage/
8176
retention-days: 14
8277
- name: Upload coverage report (GitHub Pages)
8378
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
84-
uses: actions/upload-pages-artifact@v3
79+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
8580
with:
8681
path: tests/coverage/
8782

@@ -96,4 +91,4 @@ jobs:
9691
environment: github-pages
9792
steps:
9893
- name: Deploy to GitHub Pages
99-
uses: actions/deploy-pages@v4
94+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

‎.github/workflows/comment-ci.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ jobs:
1414
(endsWith(github.event.comment.body, '/test')) }}
1515
steps:
1616
- name: Get information for pull request
17-
uses: octokit/request-action@v2.x
17+
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
1818
id: pr-api
1919
with:
2020
route: GET /repos/${{ github.repository }}/pulls/${{ github.event.issue.number }}
2121
env:
2222
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2323
- name: Query author repository permissions
24-
uses: octokit/request-action@v2.x
24+
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
2525
id: user_permission
2626
with:
2727
route: GET /repos/${{ github.repository }}/collaborators/${{ github.event.sender.login }}/permission
@@ -48,7 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Run the tests
51-
uses: sclorg/testing-farm-as-github-action@v3.1.2
51+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
5252
with:
5353
compose: CentOS-Stream-10
5454
api_key: ${{ secrets.TF_API_KEY }}
@@ -71,7 +71,7 @@ jobs:
7171

7272
steps:
7373
- name: Run the tests
74-
uses: sclorg/testing-farm-as-github-action@v3.1.2
74+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
7575
with:
7676
compose: Fedora-44
7777
api_key: ${{ secrets.TF_API_KEY }}
@@ -94,7 +94,7 @@ jobs:
9494

9595
steps:
9696
- name: Run the tests
97-
uses: sclorg/testing-farm-as-github-action@v3.1.2
97+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
9898
with:
9999
compose: Fedora-Rawhide
100100
api_key: ${{ secrets.TF_API_KEY }}
@@ -118,7 +118,7 @@ jobs:
118118

119119
# steps:
120120
# - name: Run the tests
121-
# uses: sclorg/testing-farm-as-github-action@v3.1.2
121+
# uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
122122
# with:
123123
# compose: CentOS-Stream-9
124124
# api_key: ${{ secrets.TF_API_KEY }}
@@ -142,7 +142,7 @@ jobs:
142142

143143
# steps:
144144
# - name: Run the tests
145-
# uses: sclorg/testing-farm-as-github-action@v3.1.2
145+
# uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
146146
# with:
147147
# compose: RHEL-9.8.0-Nightly
148148
# api_key: ${{ secrets.TF_API_KEY }}
@@ -165,7 +165,7 @@ jobs:
165165

166166
steps:
167167
- name: Run the tests
168-
uses: sclorg/testing-farm-as-github-action@v3.1.2
168+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
169169
with:
170170
compose: RHEL-10.2-Nightly
171171
api_key: ${{ secrets.TF_API_KEY }}

‎.github/workflows/greenboot-ci.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Query author repository permissions
15-
uses: octokit/request-action@v2.x
15+
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
1616
id: user_permission
1717
with:
1818
route: GET /repos/${{ github.repository }}/collaborators/${{ github.event.sender.login }}/permission
@@ -27,7 +27,7 @@ jobs:
2727
echo "allowed_user=true" >> $GITHUB_OUTPUT
2828
2929
- name: Get information for pull request
30-
uses: octokit/request-action@v2.x
30+
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
3131
id: pr-api
3232
with:
3333
route: GET /repos/${{ github.repository }}/pulls/${{ github.event.number }}
@@ -48,7 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Run the tests
51-
uses: sclorg/testing-farm-as-github-action@v3.1.2
51+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
5252
with:
5353
compose: CentOS-Stream-10
5454
api_key: ${{ secrets.TF_API_KEY }}
@@ -71,7 +71,7 @@ jobs:
7171

7272
steps:
7373
- name: Run the tests
74-
uses: sclorg/testing-farm-as-github-action@v3.1.2
74+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
7575
with:
7676
compose: Fedora-44
7777
api_key: ${{ secrets.TF_API_KEY }}
@@ -94,7 +94,7 @@ jobs:
9494

9595
steps:
9696
- name: Run the tests
97-
uses: sclorg/testing-farm-as-github-action@v3.1.2
97+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
9898
with:
9999
compose: Fedora-Rawhide
100100
api_key: ${{ secrets.TF_API_KEY }}
@@ -118,7 +118,7 @@ jobs:
118118

119119
# steps:
120120
# - name: Run the tests
121-
# uses: sclorg/testing-farm-as-github-action@v3.1.2
121+
# uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
122122
# with:
123123
# compose: CentOS-Stream-9
124124
# api_key: ${{ secrets.TF_API_KEY }}
@@ -142,7 +142,7 @@ jobs:
142142

143143
# steps:
144144
# - name: Run the tests
145-
# uses: sclorg/testing-farm-as-github-action@v3.1.2
145+
# uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
146146
# with:
147147
# compose: RHEL-9.8.0-Nightly
148148
# api_key: ${{ secrets.TF_API_KEY }}
@@ -165,7 +165,7 @@ jobs:
165165

166166
steps:
167167
- name: Run the tests
168-
uses: sclorg/testing-farm-as-github-action@v3.1.2
168+
uses: sclorg/testing-farm-as-github-action@270f0d1d89dad513588fb5cc2cdd512c3459f3fe # v3.1.2
169169
with:
170170
compose: RHEL-10.2-Nightly
171171
api_key: ${{ secrets.TF_API_KEY }}

0 commit comments

Comments
 (0)