Actionsのバージョンをコミットハッシュで固定する (#4569)

* chore(deps): pin dependencies * super-linterのバージョン取得処理修正 --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
dev-hato · Oct 18, 2024 · f43cf45 · f43cf45
1 parent 46eb0f6
commit f43cf45
Show file tree

Hide file tree

Showing 16 changed files with 93 additions and 92 deletions.
diff --git a/.github/workflows/add-to-task-list.yml b/.github/workflows/add-to-task-list.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Generate a token
         id: generate_token
-        uses: actions/[email protected]
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
         with:
           app-id: ${{ secrets.PROJECT_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.PROJECT_AUTOMATION_PRIVATE_KEY }}

diff --git a/.github/workflows/dependency_review.yml b/.github/workflows/dependency_review.yml
@@ -7,8 +7,8 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected]
-      - uses: actions/[email protected]
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
         with:
           base-ref: ${{ github.base_ref || github.event.merge_group.base_ref }}
           head-ref: ${{ github.head_ref || github.event.merge_group.head_ref }}
diff --git a/.github/workflows/fail-notify.yml b/.github/workflows/fail-notify.yml
@@ -22,17 +22,17 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.workflow_run.conclusion == 'failure'
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - name: Get slack payload
         id: get_slack_payload
-        uses: actions/[email protected]
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           result-encoding: string
           script: |
             const script = require(`${process.env.GITHUB_WORKSPACE}/scripts/fail_notify/fail_notify/get_slack_payload.js`)
             return script({context})
-      - uses: slackapi/[email protected]
+      - uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
         with:
           channel-id: ${{secrets.SLACK_CHANNEL_ID}}
           payload: ${{steps.get_slack_payload.outputs.result}}

diff --git a/.github/workflows/fix-fail-notify.yml b/.github/workflows/fix-fail-notify.yml
@@ -10,17 +10,17 @@ jobs:
     steps:
       - name: Generate a token
         id: generate_token
-        uses: actions/[email protected]
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
         with:
           app-id: ${{ secrets.PROJECT_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.PROJECT_AUTOMATION_PRIVATE_KEY }}
-      - uses: actions/[email protected]
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
           token: ${{steps.generate_token.outputs.token}}
       - run: bash "${GITHUB_WORKSPACE}/scripts/fix_fail_notify/fix_fail_notify/fix_fail_notify.sh"
-      - uses: dev-hato/[email protected]
+      - uses: dev-hato/actions-diff-pr-management@e5c78b251a69f44f93b2f1398e06b129bcf151ec # v1.2.0
         with:
           github-token: ${{steps.generate_token.outputs.token}}
           branch-name-prefix: fix-fail-notify

diff --git a/.github/workflows/format-json-yml.yml b/.github/workflows/format-json-yml.yml
@@ -17,17 +17,17 @@ jobs:
     steps:
       - name: Generate a token
         id: generate_token
-        uses: actions/[email protected]
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
         with:
           app-id: ${{ secrets.PROJECT_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.PROJECT_AUTOMATION_PRIVATE_KEY }}
-      - uses: actions/[email protected]
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         if: github.event_name != 'pull_request' || github.event.action != 'closed'
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
           token: ${{steps.generate_token.outputs.token}}
-      - uses: dev-hato/[email protected]
+      - uses: dev-hato/actions-format-json-yml@c049d2dbbb97a565135fa12fb0502ac1efbcbd35 # v0.0.76
         with:
           github-token: ${{steps.generate_token.outputs.token}}
 concurrency:

diff --git a/.github/workflows/gcr-cleaner.yml b/.github/workflows/gcr-cleaner.yml
@@ -14,10 +14,10 @@ jobs:
   gcr-cleaner:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - id: "auth"
         name: "Authenticate to GCP"
-        uses: google-github-actions/[email protected]
+        uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
         with:
           workload_identity_provider: ${{env.GCP_WORKLOAD_IDENTITY_PROVIDER}}
           service_account: ${{env.GCP_SERVICE_ACCOUNT}}

diff --git a/.github/workflows/github-actions-cache-cleaner.yml b/.github/workflows/github-actions-cache-cleaner.yml
@@ -13,7 +13,7 @@ jobs:
   github-actions-cache-cleaner:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected]
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - uses: dev-hato/github-actions-cache-cleaner@0a731b19b53bac2c5e7f2b9cb9f9a17d91c50604 # v0.0.56
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}