Skip to content

Commit c80b302

Browse files
gameromangameroman
authored
chore(security): update github actions and pin to commit sha (#677)
1 parent 09ab14b commit c80b302

10 files changed

Lines changed: 104 additions & 104 deletions

File tree

‎.github/workflows/code-quality.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ jobs:
1212
runs-on: depot-ubuntu-24.04-arm-16
1313
steps:
1414
- name: clone code
15-
uses: actions/checkout@v4
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616
with:
1717
submodules: recursive
1818
- name: install Rust
19-
uses: actions-rs/toolchain@v1
19+
uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
2020
with:
2121
# Sync with rust-toolchain.toml
2222
toolchain: 1.82

‎.github/workflows/docs.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ jobs:
2727
runs-on: depot-ubuntu-24.04-arm
2828
steps:
2929
- name: Checkout
30-
uses: actions/checkout@v4
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131

3232
- name: Install Node.js
33-
uses: actions/setup-node@v4
33+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3434
with:
3535
node-version: 22
3636
cache: 'yarn'
@@ -42,7 +42,7 @@ jobs:
4242

4343
- name: Setup Pages
4444
id: setup_pages
45-
uses: actions/configure-pages@v5
45+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
4646

4747
- name: Build with Next.js
4848
run: yarn build
@@ -51,7 +51,7 @@ jobs:
5151
PAGES_BASE_PATH: ${{ steps.setup_pages.outputs.base_path }}
5252

5353
- name: Upload artifact
54-
uses: actions/upload-pages-artifact@v3
54+
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
5555
with:
5656
path: ./docs/out
5757

@@ -64,4 +64,4 @@ jobs:
6464
steps:
6565
- name: Deploy to GitHub Pages
6666
id: deployment
67-
uses: actions/deploy-pages@v4
67+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/main.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ jobs:
2121
BUILD_PLATFORM: amd64
2222
steps:
2323
- name: clone code
24-
uses: actions/checkout@v4
24+
uses: actionscheckout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525
with:
2626
submodules: recursive
2727
- name: install Rust
28-
uses: actions-rs/toolchain@v1
28+
uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
2929
with:
3030
# Sync with rust-toolchain.toml
3131
toolchain: 1.82
@@ -38,7 +38,7 @@ jobs:
3838
sudo mv terraform /usr/local/bin/
3939
4040
- name: setup node.js environment
41-
uses: actions/setup-node@v3
41+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4242
- name: Install prettier
4343
run: |
4444
npm install -g prettier
@@ -70,11 +70,11 @@ jobs:
7070
id-token: "write"
7171
steps:
7272
- name: clone code
73-
uses: actions/checkout@v4
73+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7474
with:
7575
submodules: recursive
7676
- name: install Rust
77-
uses: actions-rs/toolchain@v1
77+
uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
7878
with:
7979
# Sync with rust-toolchain.toml
8080
toolchain: 1.82
@@ -95,11 +95,11 @@ jobs:
9595
runs-on: depot-ubuntu-24.04-arm-16
9696
steps:
9797
- name: clone code
98-
uses: actions/checkout@v4
98+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9999
with:
100100
submodules: recursive
101101
- name: install Rust
102-
uses: actions-rs/toolchain@v1
102+
uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6
103103
with:
104104
# Sync with rust-toolchain.toml
105105
toolchain: 1.82
@@ -108,15 +108,15 @@ jobs:
108108
run: |
109109
cargo build --release
110110
- name: Checkout js repo
111-
uses: actions/checkout@v4
111+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
112112
with:
113113
repository: getgrit/stdlib
114114
path: stdlib
115115
- name: install-ruff
116116
run: |
117117
pip install ruff
118118
- name: Setup Go environment
119-
uses: actions/setup-go@v5.0.0
119+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
120120
with:
121121
go-version: "^1.22.0"
122122
- name: test stdlib

‎.github/workflows/napi.yaml‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,11 @@ jobs:
106106
name: Build - ${{ matrix.settings.target }}
107107
runs-on: ${{ matrix.settings.host }}
108108
steps:
109-
- uses: actions/checkout@v4
109+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
110110
with:
111111
submodules: recursive
112112
- name: Setup node
113-
uses: actions/setup-node@v4
113+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
114114
if: ${{ !matrix.settings.docker }}
115115
with:
116116
node-version: 20
@@ -122,7 +122,7 @@ jobs:
122122
rustup show
123123
rustup target add ${{ matrix.settings.target }}
124124
- name: Cache cargo
125-
uses: actions/cache@v4
125+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
126126
with:
127127
path: |
128128
~/.cargo/registry/index/
@@ -139,7 +139,7 @@ jobs:
139139
run: npm install --ignore-scripts
140140
working-directory: ${{ env.WORKING_DIR }}
141141
- name: Build in docker
142-
uses: addnab/docker-run-action@v3
142+
uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
143143
if: ${{ matrix.settings.docker }}
144144
with:
145145
image: ${{ matrix.settings.docker }}
@@ -153,7 +153,7 @@ jobs:
153153
if: ${{ !matrix.settings.docker }}
154154
shell: bash
155155
- name: Upload artifact
156-
uses: actions/upload-artifact@v4
156+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
157157
with:
158158
name: bindings-${{ matrix.settings.target }}
159159
path: js/gritql/${{ env.APP_NAME }}.*.node
@@ -163,12 +163,12 @@ jobs:
163163
runs-on: depot-ubuntu-24.04-16
164164
name: Build - FreeBSD x64
165165
steps:
166-
- uses: actions/checkout@v4
166+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
167167
with:
168168
submodules: recursive
169169
- name: Build
170170
id: build
171-
uses: cross-platform-actions/action@v0.25.0
171+
uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
172172
env:
173173
DEBUG: napi:*
174174
RUSTUP_IO_THREADS: 1
@@ -195,7 +195,7 @@ jobs:
195195
cd ../..
196196
rm -rf target
197197
- name: Upload artifact
198-
uses: actions/upload-artifact@v4
198+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
199199
with:
200200
name: bindings-freebsd
201201
path: js/gritql/${{ env.APP_NAME }}.*.node
@@ -221,20 +221,20 @@ jobs:
221221
- "20"
222222
runs-on: ${{ matrix.settings.host }}
223223
steps:
224-
- uses: actions/checkout@v4
224+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
225225
with:
226226
submodules: recursive
227227
- name: Setup node
228-
uses: actions/setup-node@v4
228+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
229229
with:
230230
node-version: ${{ matrix.node }}
231231
- name: Setup bun
232-
uses: oven-sh/setup-bun@v2
232+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
233233
- name: Install dependencies
234234
run: npm install --ignore-scripts
235235
working-directory: ${{ env.WORKING_DIR }}
236236
- name: Download artifacts
237-
uses: actions/download-artifact@v4
237+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
238238
with:
239239
name: ${{ matrix.settings.artifact }}
240240
path: ${{ env.WORKING_DIR }}/__generated__
@@ -258,20 +258,20 @@ jobs:
258258
- "20"
259259
runs-on: depot-ubuntu-24.04
260260
steps:
261-
- uses: actions/checkout@v4
261+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
262262
with:
263263
submodules: recursive
264264
- name: Setup node
265-
uses: actions/setup-node@v4
265+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
266266
with:
267267
node-version: ${{ matrix.node }}
268268
- name: Setup bun
269-
uses: oven-sh/setup-bun@v2
269+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
270270
- name: Install dependencies
271271
run: npm install --ignore-scripts
272272
working-directory: ${{ env.WORKING_DIR }}
273273
- name: Download artifacts
274-
uses: actions/download-artifact@v4
274+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
275275
with:
276276
name: bindings-x86_64-unknown-linux-gnu
277277
path: ${{ env.WORKING_DIR }}/__generated__
@@ -295,14 +295,14 @@ jobs:
295295
- "20"
296296
runs-on: depot-ubuntu-24.04
297297
steps:
298-
- uses: actions/checkout@v4
298+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
299299
with:
300300
submodules: recursive
301301
- name: Install dependencies
302302
run: npm install --ignore-scripts
303303
working-directory: ${{ env.WORKING_DIR }}
304304
- name: Download artifacts
305-
uses: actions/download-artifact@v4
305+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
306306
with:
307307
name: bindings-x86_64-unknown-linux-musl
308308
path: ${{ env.WORKING_DIR }}/__generated__
@@ -311,7 +311,7 @@ jobs:
311311
shell: bash
312312
working-directory: ${{ env.WORKING_DIR }}
313313
- name: Test bindings
314-
uses: addnab/docker-run-action@v3
314+
uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
315315
with:
316316
image: oven/bun:alpine
317317
options: "-v ${{ github.workspace }}:/build -w /build/js/gritql"
@@ -331,11 +331,11 @@ jobs:
331331
- "20"
332332
runs-on: depot-ubuntu-24.04-arm
333333
steps:
334-
- uses: actions/checkout@v4
334+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
335335
with:
336336
submodules: recursive
337337
- name: Download artifacts
338-
uses: actions/download-artifact@v4
338+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
339339
with:
340340
name: bindings-aarch64-unknown-linux-gnu
341341
path: ${{ env.WORKING_DIR }}/__generated__
@@ -347,7 +347,7 @@ jobs:
347347
run: npm install --ignore-scripts
348348
working-directory: ${{ env.WORKING_DIR }}
349349
- name: Setup and run tests
350-
uses: addnab/docker-run-action@v3
350+
uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
351351
with:
352352
image: node:${{ matrix.node }}-bookworm
353353
options: "-v ${{ github.workspace }}:/build -w /build/js/gritql"
@@ -363,11 +363,11 @@ jobs:
363363
- build
364364
runs-on: depot-ubuntu-24.04-arm
365365
steps:
366-
- uses: actions/checkout@v4
366+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
367367
with:
368368
submodules: recursive
369369
- name: Download artifacts
370-
uses: actions/download-artifact@v4
370+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
371371
with:
372372
name: bindings-aarch64-unknown-linux-musl
373373
path: ${{ env.WORKING_DIR }}/__generated__
@@ -379,7 +379,7 @@ jobs:
379379
run: npm install --ignore-scripts
380380
working-directory: ${{ env.WORKING_DIR }}
381381
- name: Setup and run tests
382-
uses: addnab/docker-run-action@v3
382+
uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
383383
with:
384384
image: oven/bun:alpine
385385
options: "-v ${{ github.workspace }}:/build -w /build/js/gritql"
@@ -393,31 +393,31 @@ jobs:
393393
- build
394394
runs-on: depot-macos-14
395395
steps:
396-
- uses: actions/checkout@v4
396+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
397397
with:
398398
submodules: recursive
399399
- name: Setup node
400-
uses: actions/setup-node@v4
400+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
401401
with:
402402
node-version: 20
403403
- name: Install dependencies
404404
run: npm install --ignore-scripts
405405
working-directory: ${{ env.WORKING_DIR }}
406406
- name: Download macOS x64 artifact
407-
uses: actions/download-artifact@v4
407+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
408408
with:
409409
name: bindings-x86_64-apple-darwin
410410
path: ${{ env.WORKING_DIR }}/artifacts
411411
- name: Download macOS arm64 artifact
412-
uses: actions/download-artifact@v4
412+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
413413
with:
414414
name: bindings-aarch64-apple-darwin
415415
path: ${{ env.WORKING_DIR }}/artifacts
416416
- name: Combine binaries
417417
run: npm run universal
418418
working-directory: ${{ env.WORKING_DIR }}
419419
- name: Upload artifact
420-
uses: actions/upload-artifact@v4
420+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
421421
with:
422422
name: bindings-universal-apple-darwin
423423
path: js/gritql/${{ env.APP_NAME }}.*.node
@@ -436,11 +436,11 @@ jobs:
436436
- test-linux-aarch64-musl-binding
437437
- universal-macOS
438438
steps:
439-
- uses: actions/checkout@v4
439+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
440440
with:
441441
submodules: recursive
442442
- name: Setup node
443-
uses: actions/setup-node@v4
443+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
444444
with:
445445
node-version: 20
446446
registry-url: 'https://registry.npmjs.org'
@@ -450,7 +450,7 @@ jobs:
450450
run: npm install --ignore-scripts
451451
working-directory: ${{ env.WORKING_DIR }}
452452
- name: Download all artifacts
453-
uses: actions/download-artifact@v4
453+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
454454
with:
455455
path: ${{ env.WORKING_DIR }}/artifacts
456456
- name: Move artifacts

‎.github/workflows/pr-lint.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
name: validate PR title
1616
runs-on: depot-ubuntu-24.04-arm-small
1717
steps:
18-
- uses: amannn/action-semantic-pull-request@v5
18+
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
1919
env:
2020
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2121
with:

‎.github/workflows/python-tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ jobs:
1818
python-version: ["3.9", "3.13"]
1919

2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222

2323
- name: Set up Python ${{ matrix.python-version }}
24-
uses: actions/setup-python@v5
24+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2525
with:
2626
python-version: ${{ matrix.python-version }}
2727

0 commit comments

Comments
 (0)