Skip to content

Commit f9435b4

Browse files
fcanogabfcanogab
authored
chore(ci): pin all GitHub Actions to SHA digests (#1233)
1 parent 04a39ca commit f9435b4

20 files changed

Lines changed: 115 additions & 115 deletions

‎.github/workflows/branch-checks.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
outputs:
3131
should_run: ${{ steps.gate.outputs.should_run }}
3232
steps:
33-
- uses: actions/checkout@v6
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3434

3535
- id: gate
3636
uses: ./.github/actions/pr-gate
@@ -46,7 +46,7 @@ jobs:
4646
username: ${{ github.actor }}
4747
password: ${{ secrets.GITHUB_TOKEN }}
4848
steps:
49-
- uses: actions/checkout@v6
49+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5050

5151
- name: Mark workspace as safe for git
5252
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
@@ -70,7 +70,7 @@ jobs:
7070
username: ${{ github.actor }}
7171
password: ${{ secrets.GITHUB_TOKEN }}
7272
steps:
73-
- uses: actions/checkout@v6
73+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7474

7575
- name: Install tools
7676
run: mise install --locked
@@ -95,7 +95,7 @@ jobs:
9595
username: ${{ github.actor }}
9696
password: ${{ secrets.GITHUB_TOKEN }}
9797
steps:
98-
- uses: actions/checkout@v6
98+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9999

100100
- name: Install tools
101101
run: mise install --locked
@@ -148,7 +148,7 @@ jobs:
148148
username: ${{ github.actor }}
149149
password: ${{ secrets.GITHUB_TOKEN }}
150150
steps:
151-
- uses: actions/checkout@v6
151+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
152152

153153
- name: Install tools
154154
run: mise install --locked
@@ -173,7 +173,7 @@ jobs:
173173
username: ${{ github.actor }}
174174
password: ${{ secrets.GITHUB_TOKEN }}
175175
steps:
176-
- uses: actions/checkout@v6
176+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
177177

178178
- name: Install tools
179179
run: mise install --locked

‎.github/workflows/branch-docs.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout repository
22-
uses: actions/checkout@v6
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2323

2424
- name: Check Fern preview availability
2525
id: fern-preview
@@ -34,7 +34,7 @@ jobs:
3434
fi
3535
3636
- name: Setup Node.js
37-
uses: actions/setup-node@v6
37+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3838
with:
3939
node-version: "24"
4040

‎.github/workflows/branch-e2e.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
outputs:
1919
should_run: ${{ steps.gate.outputs.should_run }}
2020
steps:
21-
- uses: actions/checkout@v6
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2222
- id: gate
2323
uses: ./.github/actions/pr-gate
2424
with:

‎.github/workflows/ci-image.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,10 @@ jobs:
3535
runs-on: ${{ matrix.runner }}
3636
timeout-minutes: 60
3737
steps:
38-
- uses: actions/checkout@v6
38+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3939

4040
- name: Log in to GitHub Container Registry
41-
uses: docker/login-action@v4
41+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
4242
with:
4343
registry: ${{ env.REGISTRY }}
4444
username: ${{ github.actor }}
@@ -91,7 +91,7 @@ jobs:
9191
timeout-minutes: 10
9292
steps:
9393
- name: Log in to GitHub Container Registry
94-
uses: docker/login-action@v4
94+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
9595
with:
9696
registry: ${{ env.REGISTRY }}
9797
username: ${{ github.actor }}

‎.github/workflows/deb-package.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,24 +42,24 @@ jobs:
4242
username: ${{ github.actor }}
4343
password: ${{ secrets.GITHUB_TOKEN }}
4444
steps:
45-
- uses: actions/checkout@v6
45+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4646
with:
4747
ref: ${{ inputs['checkout-ref'] }}
4848

4949
- name: Download CLI artifact
50-
uses: actions/download-artifact@v4
50+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
5151
with:
5252
name: cli-linux-${{ matrix.arch }}
5353
path: package-input/
5454

5555
- name: Download gateway artifact
56-
uses: actions/download-artifact@v4
56+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
5757
with:
5858
name: gateway-binary-linux-${{ matrix.arch }}
5959
path: package-input/
6060

6161
- name: Download VM driver artifact
62-
uses: actions/download-artifact@v4
62+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
6363
with:
6464
name: driver-vm-linux-${{ matrix.arch }}
6565
path: package-input/
@@ -85,7 +85,7 @@ jobs:
8585
tasks/scripts/package-deb.sh
8686
8787
- name: Upload Debian package artifact
88-
uses: actions/upload-artifact@v7
88+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
8989
with:
9090
name: deb-linux-${{ matrix.arch }}
9191
path: artifacts/*.deb

‎.github/workflows/docker-build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ jobs:
186186
DOCKER_PUSH: ${{ inputs.push && '1' || '0' }}
187187
DOCKER_PLATFORM: ${{ matrix.platform }}
188188
steps:
189-
- uses: actions/checkout@v6
189+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
190190
with:
191191
ref: ${{ inputs['checkout-ref'] || github.sha }}
192192
fetch-depth: 0
@@ -207,7 +207,7 @@ jobs:
207207
buildkitd-config: /etc/buildkit/buildkitd.toml
208208

209209
- name: Download Rust binary artifact
210-
uses: actions/download-artifact@v4
210+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
211211
with:
212212
name: ${{ needs.resolve.outputs.artifact_prefix }}-linux-${{ matrix.arch }}
213213
path: prebuilt-rust-binary

‎.github/workflows/driver-vm-linux.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
username: ${{ github.actor }}
3333
password: ${{ secrets.GITHUB_TOKEN }}
3434
steps:
35-
- uses: actions/checkout@v6
35+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3636
with:
3737
ref: ${{ inputs['checkout-ref'] }}
3838

@@ -66,7 +66,7 @@ jobs:
6666
done
6767
6868
- name: Upload runtime artifacts
69-
uses: actions/upload-artifact@v7
69+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
7070
with:
7171
name: vm-driver-kernel-runtime-tarballs
7272
path: runtime-artifacts/vm-runtime-*.tar.zst
@@ -100,7 +100,7 @@ jobs:
100100
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101101
OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
102102
steps:
103-
- uses: actions/checkout@v6
103+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
104104
with:
105105
ref: ${{ inputs['checkout-ref'] }}
106106
fetch-depth: 0
@@ -125,7 +125,7 @@ jobs:
125125
run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
126126

127127
- name: Download kernel runtime tarball
128-
uses: actions/download-artifact@v4
128+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
129129
with:
130130
name: vm-driver-kernel-runtime-tarballs
131131
path: runtime-download/
@@ -188,7 +188,7 @@ jobs:
188188
-C target/release openshell-driver-vm
189189
190190
- name: Upload artifact
191-
uses: actions/upload-artifact@v7
191+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
192192
with:
193193
name: driver-vm-linux-${{ matrix.arch }}
194194
path: artifacts/*.tar.gz

‎.github/workflows/driver-vm-macos.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
username: ${{ github.actor }}
3333
password: ${{ secrets.GITHUB_TOKEN }}
3434
steps:
35-
- uses: actions/checkout@v6
35+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3636
with:
3737
ref: ${{ inputs['checkout-ref'] }}
3838

@@ -60,7 +60,7 @@ jobs:
6060
run: test -f runtime-artifacts/vm-runtime-darwin-aarch64.tar.zst
6161

6262
- name: Upload runtime artifact
63-
uses: actions/upload-artifact@v7
63+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
6464
with:
6565
name: vm-driver-macos-kernel-runtime-tarball
6666
path: runtime-artifacts/vm-runtime-darwin-aarch64.tar.zst
@@ -79,7 +79,7 @@ jobs:
7979
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8080
OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
8181
steps:
82-
- uses: actions/checkout@v6
82+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
8383
with:
8484
ref: ${{ inputs['checkout-ref'] }}
8585
fetch-depth: 0
@@ -113,7 +113,7 @@ jobs:
113113
run: mise x -- sccache --show-stats
114114

115115
- name: Upload supervisor bundle
116-
uses: actions/upload-artifact@v7
116+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
117117
with:
118118
name: driver-vm-supervisor-arm64
119119
path: target/vm-runtime-compressed/openshell-sandbox.zst
@@ -135,7 +135,7 @@ jobs:
135135
env:
136136
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
137137
steps:
138-
- uses: actions/checkout@v6
138+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
139139
with:
140140
ref: ${{ inputs['checkout-ref'] }}
141141
fetch-depth: 0
@@ -156,7 +156,7 @@ jobs:
156156
run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
157157

158158
- name: Download kernel runtime tarball
159-
uses: actions/download-artifact@v4
159+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
160160
with:
161161
name: vm-driver-macos-kernel-runtime-tarball
162162
path: runtime-download/
@@ -171,7 +171,7 @@ jobs:
171171
tasks/scripts/vm/compress-vm-runtime.sh
172172
173173
- name: Download bundled supervisor
174-
uses: actions/download-artifact@v4
174+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
175175
with:
176176
name: driver-vm-supervisor-arm64
177177
path: target/vm-runtime-compressed-macos/
@@ -214,7 +214,7 @@ jobs:
214214
ls -lh artifacts/
215215
216216
- name: Upload artifact
217-
uses: actions/upload-artifact@v7
217+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
218218
with:
219219
name: driver-vm-macos
220220
path: artifacts/*.tar.gz

‎.github/workflows/e2e-gpu-test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
# probe below and by the e2e tests in e2e/rust/tests/gpu_device_selection.rs.
5656
OPENSHELL_E2E_GPU_PROBE_IMAGE: "nvcr.io/nvidia/base/ubuntu:noble-20251013"
5757
steps:
58-
- uses: actions/checkout@v6
58+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5959

6060
- name: Log in to GHCR
6161
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

‎.github/workflows/e2e-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ jobs:
5858
OPENSHELL_REGISTRY_USERNAME: ${{ github.actor }}
5959
OPENSHELL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
6060
steps:
61-
- uses: actions/checkout@v6
61+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6262
with:
6363
ref: ${{ inputs['checkout-ref'] || github.sha }}
6464

0 commit comments

Comments
 (0)