From 6a6a1d484676c939d44314efde9ec5667bf1a108 Mon Sep 17 00:00:00 2001 From: Felddy Date: Fri, 1 Sep 2023 19:27:33 -0400 Subject: [PATCH] Add version tag comments to each sha-pinned use --- .github/workflows/_config.yml | 8 ++++---- .github/workflows/build.yml | 6 +++--- .github/workflows/codeql-analysis.yml | 10 +++++----- .github/workflows/dependency-review.yml | 6 +++--- .github/workflows/docker-pytest-image.yml | 14 +++++++------- .github/workflows/scorecards.yml | 6 +++--- .github/workflows/stale-issues.yml | 4 ++-- .github/workflows/sync-labels.yml | 6 +++--- 8 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/_config.yml b/.github/workflows/_config.yml index 8b3c805fa..7ea533e40 100644 --- a/.github/workflows/_config.yml +++ b/.github/workflows/_config.yml @@ -42,7 +42,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: block allowed-endpoints: > @@ -52,13 +52,13 @@ jobs: www.githubstatus.com:443 - name: Check GitHub Status - uses: crazy-max/ghaction-github-status@f947abedefc0d01e4bae344bd7061897ae4e6de9 + uses: crazy-max/ghaction-github-status@f947abedefc0d01e4bae344bd7061897ae4e6de9 # tag=v3.2.0 with: overall_threshold: major packages_threshold: major_outage - name: Dump context - uses: crazy-max/ghaction-dump-context@8b55fa205ab4530d36f787a4de1009afaaa7f3b4 + uses: crazy-max/ghaction-dump-context@8b55fa205ab4530d36f787a4de1009afaaa7f3b4 # tag=v2.1.0 csv-to-json: name: "Convert platforms CSV to JSON" @@ -67,7 +67,7 @@ jobs: platforms_json: ${{ steps.csv-to-json.outputs.platforms_json }} steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b45607fe0..ae0418396 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -39,7 +39,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: block @@ -61,7 +61,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: block @@ -83,7 +83,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: block diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index eb8e144f2..f055020df 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -44,17 +44,17 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: # TODO: change to 'egress-policy: block' after couple of runs egress-policy: audit - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # tag=v3.6.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a + uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=codeql-bundle-v2.13.4 with: languages: ${{ matrix.language }} @@ -62,7 +62,7 @@ jobs: # Java). If this step fails, then you should remove it and run the build # manually (see below). - name: Autobuild - uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a + uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=codeql-bundle-v2.13.4 # ℹī¸ Command-line programs to run using the OS shell. 📚 # https://git.io/JvXDl @@ -76,4 +76,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a + uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=codeql-bundle-v2.13.4 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 7cdc9f8c8..77626ab2e 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -12,10 +12,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: # TODO: change to 'egress-policy: block' after couple of runs egress-policy: audit - name: 'Checkout Repository' - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # tag=v3.6.0 - name: 'Dependency Review' - uses: actions/dependency-review-action@f6fff72a3217f580d5afd49a46826795305b63c7 + uses: actions/dependency-review-action@f6fff72a3217f580d5afd49a46826795305b63c7 # tag=v3.0.8 diff --git a/.github/workflows/docker-pytest-image.yml b/.github/workflows/docker-pytest-image.yml index 87a6b9cbb..f74bb90e7 100644 --- a/.github/workflows/docker-pytest-image.yml +++ b/.github/workflows/docker-pytest-image.yml @@ -73,7 +73,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: audit # allowed-endpoints: > @@ -108,14 +108,14 @@ jobs: echo "do_decryption=false" >> $GITHUB_OUTPUT fi - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # tag=v3.6.0 - id: setup-python - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # tag=v4.7.0 with: python-version: ${{ inputs.python_version }} - name: Cache testing environments - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # tag=v3.3.1 env: BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ py${{ steps.setup-python.outputs.python-version }}-" @@ -133,7 +133,7 @@ jobs: pip install --upgrade --requirement requirements-test.txt - name: Download Docker image artifact - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # tag=v3.0.2 with: name: ${{ inputs.image_artifact_name }} path: ${{ env.ARTIFACT_WORK_DIR }} @@ -183,7 +183,7 @@ jobs: - name: Upload unencrypted data artifacts if: ( success() || failure() ) && steps.check_data_archive_key.outputs.do_encryption == 'false' - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3.1.2 with: name: ${{ inputs.data_artifact_name }} path: data.tar.gz @@ -191,7 +191,7 @@ jobs: - name: Upload encrypted data artifacts if: ( success() || failure() ) && steps.check_data_archive_key.outputs.do_encryption == 'true' - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3.1.2 with: name: ${{ inputs.data_artifact_name }} path: data.tar.7z diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index fdb5742d4..fd328b9f3 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -28,7 +28,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # tag=v3.0.0 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # tag=v3.6.0 with: persist-credentials: false @@ -52,7 +52,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3.0.0 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3.1.2 with: name: SARIF file path: results.sarif @@ -60,6 +60,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=v1.0.26 + uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=codeql-bundle-v2.13.4 with: sarif_file: results.sarif diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml index c21c1f004..810ca43e9 100644 --- a/.github/workflows/stale-issues.yml +++ b/.github/workflows/stale-issues.yml @@ -14,11 +14,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 + - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # tag=v8.0.0 with: days-before-stale: 28 days-before-close: 7 diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 233df4939..a99244682 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -20,13 +20,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 + uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # tag=v2.5.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # tag=v3.6.0 - name: Sync repository labels if: success() - uses: crazy-max/ghaction-github-labeler@3de87da19416edc45c90cd89e7a4ea922a3aae5a + uses: crazy-max/ghaction-github-labeler@3de87da19416edc45c90cd89e7a4ea922a3aae5a # tag=v4.1.0 with: # This is a hideous ternary equivalent so we only do a dry run unless # this workflow is triggered by the develop branch.