Skip to content

Commit ee80d2f

Browse files
germa89clatapie
germa89
authored and
clatapie
committed
ci: add actions-security job to audit GitHub Actions usage (#4260)
1 parent 99bdf31 commit ee80d2f

File tree

17 files changed

+281
-151
lines changed

17 files changed

+281
-151
lines changed

‎.github/actions/build-matrix/action.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,19 +43,21 @@ runs:
4343
id: get_user
4444
env:
4545
type_event: ${{ inputs.type_event }}
46+
login: ${{ github.event.pull_request.user.login }}
47+
user: ${{ github.actor }}
4648
shell: bash
4749
run: |
4850
if [[ $type_event ]]; then
4951
echo "Event type: $type_event"
5052
echo "event_type=$( echo "$type_event" )" >> $GITHUB_OUTPUT
51-
export user=${{ github.event.pull_request.user.login }}
53+
export user=${login}
5254
else
53-
export user=${{ github.actor }}
55+
export user=${user}
5456
fi
5557
echo "This PR has been opened by: $user"
5658
echo "user=$( echo "$user" )" >> $GITHUB_OUTPUT
5759
58-
- uses: tspascoal/get-user-teams-membership@v3
60+
- uses: tspascoal/get-user-teams-membership@57e9f42acd78f4d0f496b3be4368fc5f62696662 #v3.0.0
5961
id: is_organization_member
6062
if: ${{ github.actor != 'dependabot[bot]' && github.actor != 'pre-commit-ci[bot]' }}
6163
with:

‎.github/actions/pytest-summary/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ runs:
2424
steps:
2525

2626
- name: "Setup Python with cache"
27-
uses: actions/setup-python@v5
27+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c #v6.0.0
2828
with:
2929
cache: 'pip'
3030
python-version: ${{ inputs.python-version }}
@@ -34,7 +34,7 @@ runs:
3434
run: python -m pip install numpy click
3535

3636
- name: "Download artifacts"
37-
uses: actions/download-artifact@v4
37+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5.0.0
3838
with:
3939
pattern: "reports-*"
4040
path: "artifacts"
@@ -84,7 +84,7 @@ runs:
8484
8585
- name: "Upload tests summary"
8686
if: ${{ env.HAS_FILES == 'true' }}
87-
uses: actions/upload-artifact@v4
87+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
8888
with:
8989
name: tests_durations.json
9090
path: tests_durations.json

‎.github/actions/test-julia/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ runs:
1414
using: "composite"
1515
steps:
1616
- name: "Set up Julia"
17-
uses: julia-actions/setup-julia@v2
17+
uses: julia-actions/setup-julia@5c9647d97b78a5debe5164e9eec09d653d29bd71 #v2.6.1
1818
with:
1919
version: ${{ matrix.julia-version }}
2020

‎.github/actions/test-windows/action.yml‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ runs:
2121

2222
# Skipping because it is installed locally.
2323
# - name: Setup Python
24-
# uses: actions/setup-python@v5
24+
# uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c #v6.0.0
2525
# with:
2626
# python-version: 3.9
2727

@@ -50,33 +50,29 @@ runs:
5050
run: |
5151
python -m pip install .[tests]
5252
53-
# - name: DPF Server Activation
54-
# run: |
55-
# docker pull ghcr.io/ansys/dpf-core:22.2dev
56-
# docker run -d --name dpfserver -p ${{ env.DPF_PORT }}:50052 ghcr.io/ansys/dpf-core:22.2dev && echo "DPF Server active on port ${{ env.DPF_PORT }}."
57-
5853
- name: "Unit testing"
5954
shell: powershell
6055
env:
6156
file_name: windows-v22.2.0-local
57+
PYTEST_ARGUMENTS: ${{ env.PYTEST_ARGUMENTS }}
6258
run: |
6359
set PYMAPDL_PORT=
6460
set PYMAPDL_START_INSTANCE=
6561
python -m pytest -k "not test_database and not test_dpf" \
66-
${{ env.PYTEST_ARGUMENTS }} \
62+
${PYTEST_ARGUMENTS} \
6763
--ignore_image_cache \
6864
--report-log=$file_name.jsonl \
6965
--cov-report=xml:$file_name.xml
7066
71-
- uses: codecov/codecov-action@v5
67+
- uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 #v5.5.1
7268
name: "Upload coverage to Codecov"
7369
with:
7470
token: ${{ inputs.codecov_token }} # required
7571
name: windows-v22.2.0-local.xml
7672
flags: windows,local,v22.2.0
7773

7874
- name: "Upload coverage artifacts"
79-
uses: actions/upload-artifact@v4
75+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
8076
with:
8177
name: windows-v22.2.0-local.xml
8278
path: ./windows_local.xml

‎.github/workflows/approver.yml‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ on:
2222
issue_comment:
2323
types: [created, edited]
2424

25+
permissions: {}
26+
2527
jobs:
2628
autoapprove:
2729
# This job only runs for pull request comments
@@ -37,28 +39,36 @@ jobs:
3739

3840
- name: "Settings"
3941
id: settings
42+
env:
43+
event_name: ${{ github.event_name }}
44+
inputs_user: ${{ inputs.user }}
45+
inputs_html_url: ${{ inputs.html_url }}
46+
inputs_pr: ${{ inputs.pr }}
47+
inputs_commentid: ${{ inputs.commentid }}
48+
github_login: ${{ github.event.comment.user.login }}
49+
github_html_url: ${{ github.event.comment.html_url }}
50+
github_number: ${{ github.event.issue.number }}
51+
github_id: ${{ github.event.comment.id }}
4052
run: |
41-
export event_name=${{ github.event_name }}
42-
4353
if [[ $event_name == "workflow_dispatch" ]] ; then
4454
echo "On workflow dispatch"
45-
echo "user=${{ inputs.user }}" >> $GITHUB_OUTPUT
46-
echo "html_url=${{ inputs.html_url }}" >> $GITHUB_OUTPUT
47-
echo "pull_request=${{ inputs.pr }}" >> $GITHUB_OUTPUT
48-
echo "commentid=${{ inputs.commentid }}" >> $GITHUB_OUTPUT
55+
echo "user=${inputs_user}" >> $GITHUB_OUTPUT
56+
echo "html_url=${inputs_html_url}" >> $GITHUB_OUTPUT
57+
echo "pull_request=${inputs_pr}" >> $GITHUB_OUTPUT
58+
echo "commentid=${inputs_commentid}" >> $GITHUB_OUTPUT
4959
5060
else
5161
echo "On $event_name"
52-
echo "user=${{ github.event.comment.user.login }}" >> $GITHUB_OUTPUT
53-
echo "html_url=${{ github.event.comment.html_url }}" >> $GITHUB_OUTPUT
54-
echo "pull_request=${{ github.event.issue.number }}" >> $GITHUB_OUTPUT
55-
echo "commentid=${{ github.event.comment.id }}" >> $GITHUB_OUTPUT
62+
echo "user=${github_login}" >> $GITHUB_OUTPUT
63+
echo "html_url=${github_html_url}" >> $GITHUB_OUTPUT
64+
echo "pull_request=${github_number}" >> $GITHUB_OUTPUT
65+
echo "commentid=${github_id}" >> $GITHUB_OUTPUT
5666
5767
fi;
5868
5969
- name: React to comment
6070
#https://github.com/ansys/pymapdl/pull/2654#issuecomment-1889009514
61-
uses: dkershner6/reaction-action@v2 # You can also use a specific version, e.g. v2.0.0
71+
uses: dkershner6/reaction-action@97ede302a1b145b3739dec3ca84a489a34ef48b5 #v2.2.1
6272
with:
6373
token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
6474
commentId: ${{ steps.settings.outputs.commentid }} # Optional if the trigger is a comment. Use another action to find this otherwise.
@@ -71,7 +81,7 @@ jobs:
7181
export IMG_MSG=$(curl -s 'https://us-central1-lgtm-reloaded.cloudfunctions.net/lgtm' | jq -r '.markdown' | grep -v 'Powered By GIPHY')
7282
echo "IMG_MSG=$IMG_MSG" >> $GITHUB_OUTPUT
7383
74-
- uses: hmarr/auto-approve-action@v4
84+
- uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 #v4.0.0
7585
with:
7686
review-message: |
7787
:white_check_mark: Approving this PR because [${{ steps.settings.outputs.user }}](https://github.com/${{ steps.settings.outputs.user }}) said so in [here](${{ steps.settings.outputs.html_url }}) :grimacing:

‎.github/workflows/cache_cleaner.yml‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,30 @@ on:
55
types:
66
- closed
77

8+
permissions: {}
9+
810
jobs:
911
cleanup:
12+
name: Cleanup caches
1013
runs-on: ubuntu-latest
14+
permissions:
15+
actions: write
1116
steps:
1217
- name: Check out code
13-
uses: actions/checkout@v5
18+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
19+
with:
20+
persist-credentials: false
1421

1522
- name: Cleanup PR caches
1623
if: github.event_name != 'workflow_dispatch'
24+
env:
25+
PR_NUMBER: ${{ github.event.pull_request.number }}
26+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
REPO: ${{ github.repository }}
1728
run: |
1829
gh extension install actions/gh-actions-cache
19-
20-
REPO=${{ github.repository }}
21-
BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"
30+
31+
BRANCH="refs/pull/${PR_NUMBER}/merge"
2232
2333
echo "Fetching list of cache key"
2434
cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
@@ -37,16 +47,16 @@ jobs:
3747
cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
3848
done
3949
echo "Done"
40-
env:
41-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4250
4351
- name: Cleanup by workflow dispatch
4452
if: github.event_name == 'workflow_dispatch'
53+
env:
54+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
REPO: ${{ github.repository }}
4556
run: |
4657
gh extension install actions/gh-actions-cache
47-
48-
REPO=${{ github.repository }}
49-
echo $REPO
58+
59+
echo "The repository is: $REPO"
5060
5161
echo "Fetching list of cache key"
5262
cacheKeysForPR=$(gh actions-cache list -R $REPO | cut -f 1 )
@@ -63,6 +73,4 @@ jobs:
6373
6474
cacheKeysForPR=$(gh actions-cache list -R $REPO | cut -f 1 )
6575
done
66-
echo "Done"
67-
env:
68-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
76+
echo "Done"

0 commit comments

Comments
 (0)