From eea398da4e45e2ea68d9c033b1f5925176842f7c Mon Sep 17 00:00:00 2001 From: Daniel Farrell Date: Mon, 23 Aug 2021 18:30:13 -0400 Subject: [PATCH] Use SHAs for GHA versions Per GitHub's security guidelines, GHAs should be pinned using full length commit SHAs instead of tags. The SHAs are of the commits currently resolved by the versions. Even "trusted" GHAs from GitHub developers are pinned because it's possible their repo rights could be compromised and a malicious GHA published. These core repos are not frequently substantially updated. Submariner-internal GHAs are left pinned at devel because we want automatic updates from Shipyard's shared tooling. Signed-off-by: Daniel Farrell --- .github/workflows/e2e-full.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/flake_finder.yml | 2 +- .github/workflows/linting.yml | 26 +++++++++++++------------- .github/workflows/periodic.yml | 6 +++--- .github/workflows/release.yml | 2 +- 6 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/e2e-full.yml b/.github/workflows/e2e-full.yml index e9f74e9..0eb3037 100644 --- a/.github/workflows/e2e-full.yml +++ b/.github/workflows/e2e-full.yml @@ -24,7 +24,7 @@ jobs: - k8s_version: '1.20' steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run E2E deployment and tests uses: submariner-io/shipyard/gh-actions/e2e@devel diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 0d6be3a..192f4b5 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run E2E deployment and tests uses: submariner-io/shipyard/gh-actions/e2e@devel diff --git a/.github/workflows/flake_finder.yml b/.github/workflows/flake_finder.yml index 550fc6c..c3b38f8 100644 --- a/.github/workflows/flake_finder.yml +++ b/.github/workflows/flake_finder.yml @@ -19,7 +19,7 @@ jobs: lighthouse: ['', 'lighthouse'] steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run E2E deployment and tests uses: submariner-io/shipyard/gh-actions/e2e@devel diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index d4a9b27..b73ca92 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -11,12 +11,12 @@ jobs: steps: - name: Get PR commits id: 'get-pr-commits' - uses: tim-actions/get-pr-commits@v1.1.0 + uses: tim-actions/get-pr-commits@55b867b9b28954e6f5c1a0fe2f729dc926c306d0 with: token: ${{ secrets.GITHUB_TOKEN }} - name: 'Verify no "Apply suggestions from code review" commits' - uses: tim-actions/commit-message-checker-with-regex@v0.3.1 + uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd with: commits: ${{ steps.get-pr-commits.outputs.commits }} pattern: '^(?!.*(apply suggestions from code review))' @@ -28,20 +28,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Set up Helm - uses: azure/setup-helm@v1 + uses: azure/setup-helm@18bc76811624f360dbd7f18c2d4ecb32c7b87bab with: version: v3.6.0 - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@dc73133d4da04e56a135ae2246682783cc7c7cb6 with: python-version: '3.x' - name: Set up helm/chart-testing - uses: helm/chart-testing-action@v2.1.0 + uses: helm/chart-testing-action@5f16c27cf7a4fa9c776ff73734df3909b2b65127 - name: Run helm/chart-testing (lint) run: ct lint --config ct.yaml @@ -51,7 +51,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f with: fetch-depth: 0 - name: Run gitlint @@ -62,7 +62,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run helm-docs and verify docs are up-to-date run: make helm-docs @@ -72,10 +72,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run markdown-link-check - uses: gaurav-nelson/github-action-markdown-link-check@v1 + uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976 with: config-file: ".markdownlinkcheck.json" check-modified-files-only: "yes" @@ -86,7 +86,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run markdownlint run: make markdownlint @@ -95,9 +95,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run yamllint - uses: ibiqlik/action-yamllint@v1 + uses: ibiqlik/action-yamllint@665205c3255fcf157ef8dc9a40d527fe025a4bc8 with: file_or_dir: submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml config_file: .yamllint.yml diff --git a/.github/workflows/periodic.yml b/.github/workflows/periodic.yml index 092cf99..339baff 100644 --- a/.github/workflows/periodic.yml +++ b/.github/workflows/periodic.yml @@ -12,16 +12,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f - name: Run markdown-link-check - uses: gaurav-nelson/github-action-markdown-link-check@v1 + uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976 with: config-file: ".markdownlinkcheck.json" - name: Raise an Issue to report broken links if: ${{ failure() }} - uses: peter-evans/create-issue-from-file@v2.3.2 + uses: peter-evans/create-issue-from-file@a04ce672e3acedb1f8e416b46716ddfd09905326 with: title: Broken link detected by CI content-filepath: .github/ISSUE_TEMPLATE/broken-link.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7518a2e..c5c8b33 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f with: fetch-depth: 0