Skip to content

ci: pin GitHub Actions to immutable SHAs #3096

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AmedeeBulle wants to merge 3 commits into
base: main
Choose a base branch
from
Open

ci: pin GitHub Actions to immutable SHAs #3096

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2db5181
ci: pin GitHub Actions to immutable SHAs
AmedeeBulle Jul 8, 2026
db20698
fix(ci): use allowed Super Linter action
AmedeeBulle Jul 8, 2026
66bf1bd
fix(ci): resolve Instant Client workflow lint errors
AmedeeBulle Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions .github/workflows/build-and-push-dev-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# We need "some" commit history to check for changed files
fetch-depth: 32
Expand Down Expand Up @@ -136,25 +136,25 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repo
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
with:
platforms: arm64

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

- name: Log into GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build image - amd64
uses: docker/build-push-action@v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: OracleLinuxDevelopers/${{ matrix.ol }}/${{ matrix.lang }}/${{ matrix.tag }}
platforms: linux/amd64
Expand All @@ -164,7 +164,7 @@ jobs:
"ghcr.io/${{ needs.prepare.outputs.repository_owner }}/${{ matrix.ol }}-${{ matrix.lang }}:${{ matrix.tag }}${{ matrix.multi && '-amd64' || '' }}"

- name: Build image - arm64
uses: docker/build-push-action@v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
if: matrix.multi
with:
context: OracleLinuxDevelopers/${{ matrix.ol }}/${{ matrix.lang }}/${{ matrix.tag }}
Expand Down
38 changes: 22 additions & 16 deletions .github/workflows/build-and-push-instantclient-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# We need "some" commit history to check for changed files
fetch-depth: 32
Expand Down Expand Up @@ -69,47 +69,53 @@ jobs:
ic="19 21 23"
fi
echo "Rebuilding: ${ol} ${ic}"
echo "ol=${ol}" >> $GITHUB_OUTPUT
echo "ic=${ic}" >> $GITHUB_OUTPUT
echo "ol=${ol}" >> "$GITHUB_OUTPUT"
echo "ic=${ic}" >> "$GITHUB_OUTPUT"
rm "${changes}"

- name: Log into GitHub Container Registry
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${GITHUB_ACTOR,,} --password-stdin
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${GITHUB_ACTOR,,}" --password-stdin

- name: Repository owner needs to be lowercase
id: repo-owner
run: |
REPO_OWNER=${{ github.repository_owner }}
echo "repo-owner=${REPO_OWNER,,}" >> $GITHUB_OUTPUT
REPO_OWNER="${{ github.repository_owner }}"
echo "repo-owner=${REPO_OWNER,,}" >> "$GITHUB_OUTPUT"

- name: Build Oracle Instant Client
env:
BUILD_IC: ${{ steps.linux-version.outputs.ic }}
BUILD_OL: ${{ steps.linux-version.outputs.ol }}
run: |
for o in ${{ steps.linux-version.outputs.ol }}
do
for i in ${{ steps.linux-version.outputs.ic }}
do
read -r -a ol_versions <<< "$BUILD_OL"
read -r -a ic_versions <<< "$BUILD_IC"
for o in "${ol_versions[@]}"; do
for i in "${ic_versions[@]}"; do
if [[ ${o} = "oraclelinux7" && ${i} = "23" ]]; then
continue
fi
if [[ ${o} = "oraclelinux9" && ${i} = "21" ]]; then
continue
fi
docker build --tag ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${o}-instantclient:${i} OracleInstantClient/${o}/${i}
docker build --tag "ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${o}-instantclient:${i}" "OracleInstantClient/${o}/${i}"
done
done

- name: Push to GitHub Container Registry
env:
BUILD_IC: ${{ steps.linux-version.outputs.ic }}
BUILD_OL: ${{ steps.linux-version.outputs.ol }}
run: |
for o in ${{ steps.linux-version.outputs.ol }}
do
for i in ${{ steps.linux-version.outputs.ic }}
do
read -r -a ol_versions <<< "$BUILD_OL"
read -r -a ic_versions <<< "$BUILD_IC"
for o in "${ol_versions[@]}"; do
for i in "${ic_versions[@]}"; do
if [[ ${o} = "oraclelinux7" && ${i} = "23" ]]; then
continue
fi
if [[ ${o} = "oraclelinux9" && ${i} = "21" ]]; then
continue
fi
docker push ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${o}-instantclient:${i}
docker push "ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${o}-instantclient:${i}"
done
done
12 changes: 6 additions & 6 deletions .github/workflows/build-and-push-nosql-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
name: Repository owner needs to be lowercase
id: repo-owner
Expand All @@ -44,15 +44,15 @@ jobs:
run: echo "date=$(date +'%Y-%m')" >> "$GITHUB_OUTPUT"
-
name: Login to Docker Hub
uses: docker/login-action@v3
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Generate container image metadata
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${{ env.IMAGE_NAME }}
flavor: |
Expand All @@ -64,7 +64,7 @@ jobs:
TAG: ${{ steps.date.outputs.date }}-ce
-
name: Build and push
uses: docker/build-push-action@v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: ./NoSQL/ce/
platforms: linux/amd64,linux/arm64
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/build-and-push-nosql-sec-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
name: Repository owner needs to be lowercase
id: repo-owner
Expand All @@ -44,15 +44,15 @@ jobs:
run: echo "date=$(date +'%Y-%m')" >> "$GITHUB_OUTPUT"
-
name: Login to Docker Hub
uses: docker/login-action@v3
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Generate container image metadata
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${{ env.IMAGE_NAME }}
flavor: |
Expand All @@ -64,7 +64,7 @@ jobs:
TAG: ${{ steps.date.outputs.date }}-ce-sec
-
name: Build and push
uses: docker/build-push-action@v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: ./NoSQL/ce-sec/
platforms: linux/amd64,linux/arm64
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/build-and-push-oci-cli-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,13 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

- name: Setup Docker BuildX
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

- name: Lowercase repository owner
id: repo-owner
Expand All @@ -44,15 +44,15 @@ jobs:

- name: Log into GitHub Container Registry
if: github.event_name != 'pull_request'
uses: docker/login-action@v3
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Generate container image metadata
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: ghcr.io/${{ steps.repo-owner.outputs.repo-owner }}/${{ env.IMAGE_NAME }}
flavor: |
Expand All @@ -74,7 +74,7 @@ jobs:

- name: Build and push image
id: build-and-push
uses: docker/build-push-action@v6
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
build-args: |
BUILDTIME=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/super-linter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,15 @@ jobs:

steps:
- name: Checkout Git repository with history
uses: actions/checkout@v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

- name: Set environment variables
run: cat .github/super-linter.env >> "$GITHUB_ENV"

- name: Run Super Linter
uses: github/super-linter/slim@v7
uses: github/super-linter/slim@b807e99ddd37e444d189cfd2c2ca1274d8ae8ef1 # v7
env:
DEFAULT_BRANCH: main
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}