Skip to content

Commit 681646d

Browse files
dreamorosidreamorosi
authored
chore(ci): pin all 3rd party actions (aws-powertools#1441)
1 parent 51c3b96 commit 681646d

18 files changed

+62
-76
lines changed

‎.github/workflows/closed-issues-message.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
auto_comment:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: aws-actions/closed-issue-message@v1
9+
- uses: aws-actions/closed-issue-message@36b7048ea77bb834d16e7a7c5b5471ac767a4ca1 # v1.0.0
1010
with:
1111
# These inputs are both required
1212
repo-token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/dispatch_analytics.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
environment: analytics
3131
steps:
3232
- name: Configure AWS credentials
33-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef
33+
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
3434
with:
3535
aws-region: eu-central-1
3636
role-to-assume: ${{ secrets.AWS_ANALYTICS_ROLE_ARN }}

‎.github/workflows/label_pr_on_title.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ jobs:
2222
runs-on: ubuntu-latest
2323
steps:
2424
- name: Checkout repository
25-
uses: actions/checkout@v3
25+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2626
- name: "Label PR based on title"
27-
uses: actions/github-script@v6
27+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2828
env:
2929
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
3030
PR_TITLE: ${{ needs.get_pr_details.outputs.prTitle }}

‎.github/workflows/make-release.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ jobs:
1313
RELEASE_VERSION: ${{ steps.set-release-version.outputs.RELEASE_VERSION }}
1414
steps:
1515
- name: Checkout code
16-
uses: actions/checkout@v3
16+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
1717
with:
1818
# Here `token` is needed to avoid incurring in error GH006 Protected Branch Update Failed,
1919
token: ${{ secrets.GH_PUBLISH_TOKEN }}
2020
# While `fetch-depth` is used to allow the workflow to later commit & push the changes.
2121
fetch-depth: 0
2222
- name: Setup NodeJS
23-
uses: actions/setup-node@v3
23+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
2424
with:
2525
node-version: "18"
2626
cache: "npm"

‎.github/workflows/measure-packages-size.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,16 @@ jobs:
1818
# we need first to use the PR number to retrieve the PR SHA number. This means we need three steps to: checkout the repo,
1919
# run a custom script to get the SHA, and then finally checkout the PR branch
2020
- name: Checkout Repo
21-
uses: actions/checkout@v3
21+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2222
- name: Extract PR details
2323
id: extract_PR_details
24-
uses: actions/github-script@v6
24+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2525
with:
2626
script: |
2727
const script = require('.github/scripts/get_pr_info.js');
2828
await script({github, context, core});
2929
- name: Checkout PR code
30-
uses: actions/checkout@v3
30+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3131
with:
3232
ref: ${{ steps.extract_PR_details.outputs.headSHA }}
3333
- name: Packages size report

‎.github/workflows/on-merge-to-main.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
runs-on: ubuntu-latest
2727
steps:
2828
- name: Checkout code
29-
uses: actions/checkout@v3
29+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3030
- name: Update release draft
3131
uses: release-drafter/release-drafter@569eb7ee3a85817ab916c8f8ff03a5bd96c9c83e # v5.23.0
3232
env:
@@ -35,9 +35,9 @@ jobs:
3535
needs: [get_pr_details, update-release-draft]
3636
runs-on: ubuntu-latest
3737
steps:
38-
- uses: actions/checkout@v3
38+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3939
- name: "Label PR related issue for release"
40-
uses: actions/github-script@v6
40+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
4141
env:
4242
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}
4343
PR_BODY: ${{ needs.get_pr_details.outputs.prBody }}

‎.github/workflows/on-workflows-push-pr.yml

+2-16
Original file line numberDiff line numberDiff line change
@@ -14,20 +14,6 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@v3
17+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
1818
- name: Ensure 3rd party workflows have SHA pinned
19-
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b9ddf6a5153efe6fb94f071c8915175afdce60fa # v2.1.0
20-
with:
21-
# Trusted GitHub Actions and/or organizations
22-
allowlist: |
23-
aws-actions/
24-
actions/stale
25-
actions/checkout
26-
actions/github-script
27-
actions/setup-node
28-
actions/setup-python
29-
actions/upload-artifact
30-
actions/download-artifact
31-
github/codeql-action/init
32-
github/codeql-action/analyze
33-
dependabot/fetch-metadata
19+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@21991cec25093947ff3f62e4c223df0260c39944 # v2.1.2

‎.github/workflows/on_opened_pr.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ jobs:
1919
needs: get_pr_details
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2323
- name: "Debug workflow_run event"
2424
run: echo "${{ github }}"
2525
- name: "Ensure related issue is present"
26-
uses: actions/github-script@v6
26+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2727
env:
2828
PR_BODY: ${{ needs.get_pr_details.outputs.prBody }}
2929
PR_NUMBER: ${{ needs.get_pr_details.outputs.prNumber }}

‎.github/workflows/post-release.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ jobs:
2323
env:
2424
RELEASE_VERSION: ${{ inputs.versionNumber }}
2525
steps:
26-
- uses: actions/checkout@v3
26+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2727
- name: Update issues related to release
28-
uses: actions/github-script@v6
28+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
2929
with:
3030
github-token: ${{ secrets.GITHUB_TOKEN }}
3131
script: |

‎.github/workflows/publish_layer.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,11 @@ jobs:
3333
if: ${{ (github.event.workflow_run.conclusion == 'success') || (github.event_name == 'workflow_dispatch') }}
3434
steps:
3535
- name: checkout
36-
uses: actions/checkout@v3
36+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3737
with:
3838
fetch-depth: 0
3939
- name: Setup Node.js
40-
uses: actions/setup-node@v3
40+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
4141
with:
4242
node-version: "18"
4343
- name: Set release notes tag
@@ -57,7 +57,7 @@ jobs:
5757
- name: Zip output
5858
run: zip -r cdk.out.zip layers/cdk.out
5959
- name: Archive CDK artifacts
60-
uses: actions/upload-artifact@v3
60+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
6161
with:
6262
name: cdk-layer-artifact
6363
path: cdk.out.zip

‎.github/workflows/record_pr.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,14 @@ jobs:
99
runs-on: ubuntu-latest
1010

1111
steps:
12-
- uses: actions/checkout@v3
12+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
1313
- name: "Extract PR details"
14-
uses: actions/github-script@v6
14+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
1515
with:
1616
script: |
1717
const script = require('.github/scripts/save_pr_details.js')
1818
await script({github, context, core})
19-
- uses: actions/upload-artifact@v3
19+
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
2020
with:
2121
name: pr
2222
path: pr.txt

‎.github/workflows/reusable-publish-docs.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -27,19 +27,19 @@ jobs:
2727
runs-on: ubuntu-latest
2828
steps:
2929
- name: Checkout code
30-
uses: actions/checkout@v3
30+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
3131
with:
3232
# While `fetch-depth` is used to allow the workflow to later commit & push the changes.
3333
fetch-depth: 0
3434
- name: Setup NodeJS
35-
uses: actions/setup-node@v3
35+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
3636
with:
3737
node-version: "18"
3838
cache: "npm"
3939
- name: Setup dependencies
4040
uses: ./.github/actions/cached-node-modules
4141
- name: Set up Python
42-
uses: actions/setup-python@v4
42+
uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4.6.0
4343
with:
4444
python-version: "3.8"
4545
- name: Install doc generation dependencies
@@ -81,7 +81,7 @@ jobs:
8181
destination_dir: ${{ env.VERSION }}/api
8282
- name: Release API docs to latest
8383
if: ${{ inputs.alias == 'latest' }}
84-
uses: peaceiris/actions-gh-pages@bd8c6b06eba6b3d25d72b7a1767993c0aeee42e7
84+
uses: peaceiris/actions-gh-pages@bd8c6b06eba6b3d25d72b7a1767993c0aeee42e7 # v3.9.2
8585
with:
8686
github_token: ${{ secrets.GITHUB_TOKEN }}
8787
publish_dir: ./api

‎.github/workflows/reusable-run-linting-check-and-unit-tests.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ jobs:
1414
fail-fast: false
1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@v3
17+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
1818
- name: Setup NodeJS
19-
uses: actions/setup-node@v3
19+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
2020
with:
2121
node-version: ${{ matrix.version }}
2222
cache: "npm"
@@ -43,9 +43,9 @@ jobs:
4343
working-directory: examples/${{ matrix.example }}
4444
steps:
4545
- name: Checkout code
46-
uses: actions/checkout@v3
46+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
4747
- name: Setup NodeJS
48-
uses: actions/setup-node@v3
48+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
4949
with:
5050
node-version: 18
5151
cache: "npm"
@@ -61,9 +61,9 @@ jobs:
6161
NODE_ENV: dev
6262
steps:
6363
- name: Checkout code
64-
uses: actions/checkout@v3
64+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
6565
- name: Setup NodeJS
66-
uses: actions/setup-node@v3
66+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
6767
with:
6868
node-version: 18
6969
cache: "npm"
@@ -83,9 +83,9 @@ jobs:
8383
NODE_ENV: dev
8484
steps:
8585
- name: Checkout code
86-
uses: actions/checkout@v3
86+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
8787
- name: Setup NodeJS
88-
uses: actions/setup-node@v3
88+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
8989
with:
9090
node-version: 18
9191
cache: "npm"

‎.github/workflows/reusable_deploy_layer_stack.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -60,20 +60,20 @@ jobs:
6060
]
6161
steps:
6262
- name: checkout
63-
uses: actions/checkout@v3
63+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
6464
- name: aws credentials
65-
uses: aws-actions/configure-aws-credentials@186395a8644e48f35e7b453e8a7128d9a3948296
65+
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
6666
with:
6767
aws-region: ${{ matrix.region }}
6868
role-to-assume: ${{ secrets.target-account-role }}
6969
- name: Setup Node.js
70-
uses: actions/setup-node@v3
70+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
7171
with:
7272
node-version: "18"
7373
- name: Setup dependencies
7474
uses: ./.github/actions/cached-node-modules
7575
- name: Download artifact
76-
uses: actions/download-artifact@v3
76+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
7777
with:
7878
name: ${{ inputs.artifact-name }}
7979
- name: Unzip artifact
@@ -88,7 +88,7 @@ jobs:
8888
cat cdk-layer-stack/${{ matrix.region }}-layer-version.txt
8989
- name: Save Layer ARN artifact
9090
if: ${{ inputs.stage == 'PROD' }}
91-
uses: actions/upload-artifact@v3
91+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
9292
with:
9393
name: cdk-layer-stack
9494
path: ./cdk-layer-stack/* # NOTE: upload-artifact does not inherit working-directory setting.

‎.github/workflows/reusable_export_pr_details.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -50,9 +50,9 @@ jobs:
5050
prIsMerged: ${{ steps.prIsMerged.outputs.prIsMerged }}
5151
steps:
5252
- name: Checkout repository # in case caller workflow doesn't checkout thus failing with file not found
53-
uses: actions/checkout@v3
53+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
5454
- name: "Download previously saved PR"
55-
uses: actions/github-script@v6
55+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
5656
env:
5757
WORKFLOW_ID: ${{ inputs.record_pr_workflow_id }}
5858
# For security, we only download artifacts tied to the successful PR recording workflow
@@ -68,19 +68,19 @@ jobs:
6868
# otherwise the parent caller won't see them regardless on how outputs are set.
6969
- name: "Export Pull Request Number"
7070
id: prNumber
71-
run: echo "prNumber=$(jq -c '.number' ${FILENAME})" >> $GITHUB_OUTPUT
71+
run: echo prNumber="$(jq -c '.number' "${FILENAME}")" >> "$GITHUB_OUTPUT"
7272
- name: "Export Pull Request Title"
7373
id: prTitle
74-
run: echo "prTitle=$(jq -c '.pull_request.title' ${FILENAME})" >> $GITHUB_OUTPUT
74+
run: echo prTitle="$(jq -c '.pull_request.title' "${FILENAME}")" >> "$GITHUB_OUTPUT"
7575
- name: "Export Pull Request Body"
7676
id: prBody
77-
run: echo "prBody=$(jq -c '.pull_request.body' ${FILENAME})" >> $GITHUB_OUTPUT
77+
run: echo prBody="$(jq -c '.pull_request.body' "${FILENAME}")" >> "$GITHUB_OUTPUT"
7878
- name: "Export Pull Request Author"
7979
id: prAuthor
80-
run: echo "prAuthor=$(jq -c '.pull_request.user.login' ${FILENAME})" >> $GITHUB_OUTPUT
80+
run: echo prAuthor="$(jq -c '.pull_request.user.login' "${FILENAME}")" >> "$GITHUB_OUTPUT"
8181
- name: "Export Pull Request Action"
8282
id: prAction
83-
run: echo "prAction=$(jq -c '.action' ${FILENAME})" >> $GITHUB_OUTPUT
83+
run: echo prAction="$(jq -c '.action' "${FILENAME}")" >> "$GITHUB_OUTPUT"
8484
- name: "Export Pull Request Merged status"
8585
id: prIsMerged
86-
run: echo "prIsMerged=$(jq -c '.pull_request.merged' ${FILENAME})" >> $GITHUB_OUTPUT
86+
run: echo prIsMerged="$(jq -c '.pull_request.merged' "${FILENAME}")" >> "$GITHUB_OUTPUT"

‎.github/workflows/reusable_update_layer_arn_docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Checkout repository # reusable workflows start clean, so we need to checkout again
26-
uses: actions/checkout@v3
26+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
2727
with:
2828
fetch-depth: 0
2929
- name: Git client setup and refresh tip
@@ -34,7 +34,7 @@ jobs:
3434
git config remote.origin.url >&- || git remote add origin https://github.com/"${origin}" # Git Detached mode (release notes) doesn't have origin
3535
git pull origin "${BRANCH}"
3636
- name: Download CDK layer artifact
37-
uses: actions/download-artifact@v3
37+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
3838
with:
3939
name: cdk-layer-stack
4040
path: cdk-layer-stack/

0 commit comments

Comments
 (0)