Skip to content

Commit 42554e9

Browse files
matifalimatifali
committed
Update actions in GitHub workflows to specific commits
Use specific commit SHAs for GitHub actions across various workflows to enhance reliability and reproducibility. This change ensures that actions run against a known version, reducing the risk of unexpected issues due to updates in the third-party action repositories.
1 parent a0787b7 commit 42554e9

19 files changed

+104
-103
lines changed

‎.github/actions/setup-go/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ runs:
99
using: "composite"
1010
steps:
1111
- name: Setup Go
12-
uses: actions/setup-go@v5
12+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
1313
with:
1414
go-version: ${{ inputs.version }}
1515

‎.github/actions/setup-node/action.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ runs:
1111
using: "composite"
1212
steps:
1313
- name: Install pnpm
14-
uses: pnpm/action-setup@v3
14+
uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
1515
with:
1616
version: 9.6
1717
- name: Setup Node
18-
uses: actions/setup-node@v4.0.3
18+
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
1919
with:
2020
node-version: 20.16.0
2121
# See https://github.com/actions/setup-node#caching-global-packages-data

‎.github/actions/setup-sqlc/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ runs:
55
using: "composite"
66
steps:
77
- name: Setup sqlc
8-
uses: sqlc-dev/setup-sqlc@v4
8+
uses: sqlc-dev/setup-sqlc@c0209b9199cd1cce6a14fc27cabcec491b651761 # v4.0.0
99
with:
1010
sqlc-version: "1.25.0"

‎.github/actions/setup-tf/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ runs:
55
using: "composite"
66
steps:
77
- name: Install Terraform
8-
uses: hashicorp/setup-terraform@v3
8+
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
99
with:
1010
terraform_version: 1.9.2
1111
terraform_wrapper: false

‎.github/actions/upload-datadog/action.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
name: Upload tests to datadog
2-
if: always()
2+
description: |
3+
Uploads the test results to datadog.
34
inputs:
45
api-key:
56
description: "Datadog API key"

‎.github/workflows/ci.yaml

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,12 @@ jobs:
4343
tailnet-integration: ${{ steps.filter.outputs.tailnet-integration }}
4444
steps:
4545
- name: Checkout
46-
uses: actions/checkout@v4
46+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
4747
with:
4848
fetch-depth: 1
4949
# For pull requests it's not necessary to checkout the code
5050
- name: check changed files
51-
uses: dorny/paths-filter@v3
51+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
5252
id: filter
5353
with:
5454
filters: |
@@ -125,7 +125,7 @@ jobs:
125125
# runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
126126
# steps:
127127
# - name: Checkout
128-
# uses: actions/checkout@v4
128+
# uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
129129
# with:
130130
# fetch-depth: 1
131131
# # See: https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
@@ -138,7 +138,7 @@ jobs:
138138
# run: ./scripts/update-flake.sh
139139

140140
# # auto update flake for dependabot
141-
# - uses: stefanzweifel/git-auto-commit-action@v5
141+
# - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
142142
# if: github.actor == 'dependabot[bot]'
143143
# with:
144144
# # Allows dependabot to still rebase!
@@ -158,7 +158,7 @@ jobs:
158158
runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
159159
steps:
160160
- name: Checkout
161-
uses: actions/checkout@v4
161+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
162162
with:
163163
fetch-depth: 1
164164

@@ -176,7 +176,7 @@ jobs:
176176
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
177177
178178
- name: golangci-lint cache
179-
uses: actions/cache@v4
179+
uses: actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 # v4.1.0
180180
with:
181181
path: |
182182
${{ env.LINT_CACHE_DIR }}
@@ -186,7 +186,7 @@ jobs:
186186
187187
# Check for any typos
188188
- name: Check for typos
189-
uses: crate-ci/typos@v1.26.0
189+
uses: crate-ci/typos@6802cc60d4e7f78b9d5454f6cf3935c042d5e1e3 # v1.26.0
190190
with:
191191
config: .github/workflows/typos.toml
192192

@@ -199,7 +199,7 @@ jobs:
199199
200200
# Needed for helm chart linting
201201
- name: Install helm
202-
uses: azure/setup-helm@v4
202+
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
203203
with:
204204
version: v3.9.2
205205

@@ -220,7 +220,7 @@ jobs:
220220
if: needs.changes.outputs.docs-only == 'false' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
221221
steps:
222222
- name: Checkout
223-
uses: actions/checkout@v4
223+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
224224
with:
225225
fetch-depth: 1
226226

@@ -269,7 +269,7 @@ jobs:
269269
timeout-minutes: 7
270270
steps:
271271
- name: Checkout
272-
uses: actions/checkout@v4
272+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
273273
with:
274274
fetch-depth: 1
275275

@@ -305,7 +305,7 @@ jobs:
305305
- windows-2022
306306
steps:
307307
- name: Checkout
308-
uses: actions/checkout@v4
308+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
309309
with:
310310
fetch-depth: 1
311311

@@ -359,7 +359,7 @@ jobs:
359359
timeout-minutes: 25
360360
steps:
361361
- name: Checkout
362-
uses: actions/checkout@v4
362+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
363363
with:
364364
fetch-depth: 1
365365

@@ -399,7 +399,7 @@ jobs:
399399
timeout-minutes: 25
400400
steps:
401401
- name: Checkout
402-
uses: actions/checkout@v4
402+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
403403
with:
404404
fetch-depth: 1
405405

@@ -431,7 +431,7 @@ jobs:
431431
timeout-minutes: 25
432432
steps:
433433
- name: Checkout
434-
uses: actions/checkout@v4
434+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
435435
with:
436436
fetch-depth: 1
437437

@@ -467,7 +467,7 @@ jobs:
467467
timeout-minutes: 20
468468
steps:
469469
- name: Checkout
470-
uses: actions/checkout@v4
470+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
471471
with:
472472
fetch-depth: 1
473473

@@ -488,7 +488,7 @@ jobs:
488488
timeout-minutes: 20
489489
steps:
490490
- name: Checkout
491-
uses: actions/checkout@v4
491+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
492492
with:
493493
fetch-depth: 1
494494

@@ -514,7 +514,7 @@ jobs:
514514
name: ${{ matrix.variant.name }}
515515
steps:
516516
- name: Checkout
517-
uses: actions/checkout@v4
517+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
518518
with:
519519
fetch-depth: 1
520520

@@ -555,15 +555,15 @@ jobs:
555555

556556
- name: Upload Playwright Failed Tests
557557
if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
558-
uses: actions/upload-artifact@v4
558+
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
559559
with:
560560
name: failed-test-videos${{ matrix.variant.enterprise && '-enterprise' || '-agpl' }}
561561
path: ./site/test-results/**/*.webm
562562
retention-days: 7
563563

564564
- name: Upload pprof dumps
565565
if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
566-
uses: actions/upload-artifact@v4
566+
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
567567
with:
568568
name: debug-pprof-dumps${{ matrix.variant.enterprise && '-enterprise' || '-agpl' }}
569569
path: ./site/test-results/**/debug-pprof-*.txt
@@ -576,7 +576,7 @@ jobs:
576576
if: needs.changes.outputs.ts == 'true' || needs.changes.outputs.ci == 'true'
577577
steps:
578578
- name: Checkout
579-
uses: actions/checkout@v4
579+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
580580
with:
581581
# Required by Chromatic for build-over-build history, otherwise we
582582
# only get 1 commit on shallow checkout.
@@ -590,7 +590,7 @@ jobs:
590590
# the check to pass. This is desired in PRs, but not in mainline.
591591
- name: Publish to Chromatic (non-mainline)
592592
if: github.ref != 'refs/heads/main' && github.repository_owner == 'coder'
593-
uses: chromaui/action@v10
593+
uses: chromaui/action@30b6228aa809059d46219e0f556752e8672a7e26 # v11.11.0
594594
env:
595595
NODE_OPTIONS: "--max_old_space_size=4096"
596596
STORYBOOK: true
@@ -621,7 +621,7 @@ jobs:
621621
# infinitely "in progress" in mainline unless we re-review each build.
622622
- name: Publish to Chromatic (mainline)
623623
if: github.ref == 'refs/heads/main' && github.repository_owner == 'coder'
624-
uses: chromaui/action@v10
624+
uses: chromaui/action@30b6228aa809059d46219e0f556752e8672a7e26 # v11.11.0
625625
env:
626626
NODE_OPTIONS: "--max_old_space_size=4096"
627627
STORYBOOK: true
@@ -648,7 +648,7 @@ jobs:
648648

649649
steps:
650650
- name: Checkout
651-
uses: actions/checkout@v4
651+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
652652
with:
653653
# 0 is required here for version.sh to work.
654654
fetch-depth: 0
@@ -749,12 +749,12 @@ jobs:
749749
IMAGE: ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}
750750
steps:
751751
- name: Checkout
752-
uses: actions/checkout@v4
752+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
753753
with:
754754
fetch-depth: 0
755755

756756
- name: GHCR Login
757-
uses: docker/login-action@v3
757+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
758758
with:
759759
registry: ghcr.io
760760
username: ${{ github.actor }}
@@ -829,7 +829,7 @@ jobs:
829829
830830
- name: Prune old images
831831
if: github.ref == 'refs/heads/main'
832-
uses: vlaurin/action-ghcr-prune@v0.6.0
832+
uses: vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641 # v0.6.0
833833
with:
834834
token: ${{ secrets.GITHUB_TOKEN }}
835835
organization: coder
@@ -844,7 +844,7 @@ jobs:
844844

845845
- name: Upload build artifacts
846846
if: github.ref == 'refs/heads/main'
847-
uses: actions/upload-artifact@v4
847+
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
848848
with:
849849
name: coder
850850
path: |
@@ -868,27 +868,27 @@ jobs:
868868
id-token: write
869869
steps:
870870
- name: Checkout
871-
uses: actions/checkout@v4
871+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
872872
with:
873873
fetch-depth: 0
874874

875875
- name: Authenticate to Google Cloud
876-
uses: google-github-actions/auth@v2
876+
uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
877877
with:
878878
workload_identity_provider: projects/573722524737/locations/global/workloadIdentityPools/github/providers/github
879879
service_account: coder-ci@coder-dogfood.iam.gserviceaccount.com
880880

881881
- name: Set up Google Cloud SDK
882-
uses: google-github-actions/setup-gcloud@v2
882+
uses: google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7 # v2.1.1
883883

884884
- name: Set up Flux CLI
885-
uses: fluxcd/flux2/action@main
885+
uses: fluxcd/flux2/action@9b3958825a314eb79495c6993ef397ddbf87f32f # v2.2.1
886886
with:
887-
# Keep this up to date with the version of flux installed in dogfood cluster
887+
# Keep this and the github action up to date with the version of flux installed in dogfood cluster
888888
version: "2.2.1"
889889

890890
- name: Get Cluster Credentials
891-
uses: "google-github-actions/get-gke-credentials@v2"
891+
uses: google-github-actions/get-gke-credentials@6051de21ad50fbb1767bc93c11357a49082ad116 # v2.2.1
892892
with:
893893
cluster_name: dogfood-v2
894894
location: us-central1-a
@@ -925,12 +925,12 @@ jobs:
925925
if: github.ref == 'refs/heads/main' && !github.event.pull_request.head.repo.fork
926926
steps:
927927
- name: Checkout
928-
uses: actions/checkout@v4
928+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
929929
with:
930930
fetch-depth: 0
931931

932932
- name: Setup flyctl
933-
uses: superfly/flyctl-actions/setup-flyctl@master
933+
uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5
934934

935935
- name: Deploy workspace proxies
936936
run: |
@@ -955,7 +955,7 @@ jobs:
955955
if: needs.changes.outputs.db == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
956956
steps:
957957
- name: Checkout
958-
uses: actions/checkout@v4
958+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
959959
with:
960960
fetch-depth: 1
961961
# We need golang to run the migration main.go

‎.github/workflows/contrib.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ jobs:
2828
pull-requests: write
2929
steps:
3030
- name: auto-approve dependabot
31-
uses: hmarr/auto-approve-action@v4
31+
uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
3232
if: github.actor == 'dependabot[bot]'
3333

3434
cla:
3535
runs-on: ubuntu-latest
3636
steps:
3737
- name: cla
3838
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
39-
uses: contributor-assistant/github-action@v2.6.1
39+
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
4040
env:
4141
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4242
# the below token should have repo scope and must be manually added by you in the repository's secret
@@ -57,7 +57,7 @@ jobs:
5757
if: ${{ github.event_name == 'pull_request_target' && !github.event.pull_request.draft }}
5858
steps:
5959
- name: release-labels
60-
uses: actions/github-script@v7
60+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
6161
with:
6262
# This script ensures PR title and labels are in sync:
6363
#

‎.github/workflows/docker-base.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ jobs:
3737
if: github.repository_owner == 'coder'
3838
steps:
3939
- name: Checkout
40-
uses: actions/checkout@v4
40+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
4141

4242
- name: Docker login
43-
uses: docker/login-action@v3
43+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
4444
with:
4545
registry: ghcr.io
4646
username: ${{ github.actor }}
@@ -50,11 +50,11 @@ jobs:
5050
run: mkdir base-build-context
5151

5252
- name: Install depot.dev CLI
53-
uses: depot/setup-action@v1
53+
uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
5454

5555
# This uses OIDC authentication, so no auth variables are required.
5656
- name: Build base Docker image via depot.dev
57-
uses: depot/build-push-action@v1
57+
uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
5858
with:
5959
project: wl5hnrrkns
6060
context: base-build-context

0 commit comments

Comments
 (0)