From fb697fb0f78eba243b803da7cdf6712eae4b9299 Mon Sep 17 00:00:00 2001 From: harshitasao Date: Thu, 15 Aug 2024 19:06:30 +0530 Subject: [PATCH] ci: github action pin dependencies The openSSF scorecard report warns that the github actions are not pinned by hash. This PR aims at improving this by pinning the github actions by hash. Signed-off-by: harshitasao --- .../integration-test-smoke-suite.yaml | 4 ++-- .../integration-test-upgrade-suite.yaml | 8 +++---- .../integration-tests-on-release.yaml | 24 +++++++++---------- .github/workflows/linters.yaml | 10 ++++---- .github/workflows/mod-check.yml | 4 ++-- .github/workflows/multus.yaml | 6 ++--- .github/workflows/push-build.yaml | 10 ++++---- .github/workflows/rbac-gen.yaml | 4 ++-- .github/workflows/shellcheck.yaml | 4 ++-- .github/workflows/snyk.yaml | 4 ++-- .github/workflows/stale.yaml | 2 +- .github/workflows/unit-test.yml | 6 ++--- 12 files changed, 43 insertions(+), 43 deletions(-) diff --git a/.github/workflows/integration-test-smoke-suite.yaml b/.github/workflows/integration-test-smoke-suite.yaml index 4f0a0d6a7..8b1d18fba 100644 --- a/.github/workflows/integration-test-smoke-suite.yaml +++ b/.github/workflows/integration-test-smoke-suite.yaml @@ -31,7 +31,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -60,7 +60,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-smoke-suite-artifact-${{ matrix.kubernetes-versions }} diff --git a/.github/workflows/integration-test-upgrade-suite.yaml b/.github/workflows/integration-test-upgrade-suite.yaml index 07ce172f4..694d60fe7 100644 --- a/.github/workflows/integration-test-upgrade-suite.yaml +++ b/.github/workflows/integration-test-upgrade-suite.yaml @@ -31,7 +31,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -60,7 +60,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-upgrade-suite-artifact-${{ matrix.kubernetes-versions }} @@ -75,7 +75,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -107,7 +107,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-upgrade-helm-suite-artifact-${{ matrix.kubernetes-versions }} diff --git a/.github/workflows/integration-tests-on-release.yaml b/.github/workflows/integration-tests-on-release.yaml index dfea5dfe3..3a0ec7052 100644 --- a/.github/workflows/integration-tests-on-release.yaml +++ b/.github/workflows/integration-tests-on-release.yaml @@ -24,7 +24,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.28.12", "v1.29.7", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -50,7 +50,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-helm-suite-artifact-${{ matrix.kubernetes-versions }} @@ -64,7 +64,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.28.12", "v1.29.7", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -91,7 +91,7 @@ jobs: CLUSTER_NAMESPACE="multi-external" tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-multi-cluster-deploy-suite-artifact-${{ matrix.kubernetes-versions }} @@ -105,7 +105,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.28.12", "v1.29.7", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -129,7 +129,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-smoke-suite-artifact-${{ matrix.kubernetes-versions }} @@ -143,7 +143,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.28.12", "v1.29.7", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -167,7 +167,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-upgrade-suite-artifact-${{ matrix.kubernetes-versions }} @@ -181,7 +181,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.28.12", "v1.29.7", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -208,7 +208,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-upgrade-suite-artifact-${{ matrix.kubernetes-versions }} @@ -222,7 +222,7 @@ jobs: kubernetes-versions: ["v1.26.15", "v1.31.0"] steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 @@ -246,7 +246,7 @@ jobs: tests/scripts/collect-logs.sh - name: Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 if: failure() with: name: ceph-object-suite-artifact-${{ matrix.kubernetes-versions }} diff --git a/.github/workflows/linters.yaml b/.github/workflows/linters.yaml index f0b710465..3ce34e4ef 100644 --- a/.github/workflows/linters.yaml +++ b/.github/workflows/linters.yaml @@ -23,12 +23,12 @@ jobs: yaml-linter: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1 with: python-version: 3.9 @@ -41,12 +41,12 @@ jobs: pylint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1 with: python-version: 3.9 @@ -61,4 +61,4 @@ jobs: run: pylint $(git ls-files '*.py') -E - name: Setup black for py - uses: psf/black@stable + uses: psf/black@b965c2a5026f8ba399283ba3e01898b012853c79 # stable diff --git a/.github/workflows/mod-check.yml b/.github/workflows/mod-check.yml index 02d1c0fd3..0e852fc61 100644 --- a/.github/workflows/mod-check.yml +++ b/.github/workflows/mod-check.yml @@ -29,11 +29,11 @@ jobs: runs-on: ubuntu-22.04 steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: go-version: "1.22" diff --git a/.github/workflows/multus.yaml b/.github/workflows/multus.yaml index 18955b1f9..8462e9115 100644 --- a/.github/workflows/multus.yaml +++ b/.github/workflows/multus.yaml @@ -35,17 +35,17 @@ jobs: NUMBER_OF_COMPUTE_NODES: 5 steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - name: Set up Go version - uses: actions/setup-go@v5 + uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: go-version: "1.22" - name: Create KinD Cluster - uses: helm/kind-action@v1.10.0 + uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0 with: config: tests/scripts/multus/kind-config.yaml cluster_name: kind diff --git a/.github/workflows/push-build.yaml b/.github/workflows/push-build.yaml index bb86c6128..6427b86e7 100644 --- a/.github/workflows/push-build.yaml +++ b/.github/workflows/push-build.yaml @@ -21,28 +21,28 @@ jobs: if: github.repository == 'rook/rook' steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: go-version: "1.22" # docker/setup-qemu action installs QEMU static binaries, which are used to run builders for architectures other than the host. - name: set up QEMU - uses: docker/setup-qemu-action@master + uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # master with: platforms: all - name: log in to container registry - uses: docker/login-action@v3 + uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 with: aws-access-key-id: ${{ secrets.AWS_USR }} aws-secret-access-key: ${{ secrets.AWS_PSW }} diff --git a/.github/workflows/rbac-gen.yaml b/.github/workflows/rbac-gen.yaml index 49c1566db..7123d2a91 100644 --- a/.github/workflows/rbac-gen.yaml +++ b/.github/workflows/rbac-gen.yaml @@ -29,11 +29,11 @@ jobs: runs-on: ubuntu-22.04 steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: go-version: "1.22" diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml index 4d9a7c7ba..ea9f97952 100644 --- a/.github/workflows/shellcheck.yaml +++ b/.github/workflows/shellcheck.yaml @@ -24,9 +24,9 @@ jobs: name: Shellcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: Run ShellCheck - uses: ludeeus/action-shellcheck@master + uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master with: severity: warning check_together: 'yes' diff --git a/.github/workflows/snyk.yaml b/.github/workflows/snyk.yaml index 75295fce4..6141d49dc 100644 --- a/.github/workflows/snyk.yaml +++ b/.github/workflows/snyk.yaml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - name: run Snyk to check for code vulnerabilities - uses: snyk/actions/golang@master + uses: snyk/actions/golang@ae9442546152ba9bb0a1c85e2672112c97e7a06d # master env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} GOFLAGS: "-buildvcs=false" diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 400786e84..8b9c88454 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-22.04 if: github.repository == 'rook/rook' steps: - - uses: actions/stale@v9 + - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} days-before-issue-stale: 60 diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 7036f42fa..73c0f259f 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -37,16 +37,16 @@ jobs: if: "!contains(github.event.pull_request.labels.*.name, 'skip-ci')" steps: - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 with: fetch-depth: 0 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: go-version: "1.22" - name: Setup jq - uses: dcarbone/install-jq-action@v2.1.0 + uses: dcarbone/install-jq-action@8867ddb4788346d7c22b72ea2e2ffe4d514c7bcb # v2.1.0 with: version: "${{ inputs.version }}"