Enforce pinact on actions in plugins (#1142)

- Use pinact in the plugins repo
- updates actions and workflows

Author: EliSchleifer

.github/actions/action_tests/action.yaml

@@ -32,7 +32,7 @@ runs:
     # The uv action tests' preCheck shells out to `uv lock` directly (not
     # through trunk), so we need uv available on PATH.
     - name: Setup uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2      uses: astral-sh/setup-uv@v5
       with:
         version: 0.7.8
 
@@ -83,7 +83,7 @@ runs:
     - name: Upload prod results
       # TODO(Tyler): Add upload on Windows once the action supports it.
       if: "!cancelled() && runner.os != 'Windows' && inputs.trunk-prod-token != ''"
-      uses: trunk-io/analytics-uploader@main
+      uses: trunk-io/analytics-uploader@413ecdb8036c3698131a278a921c8481ffeec502 # v2.1.1      uses: trunk-io/analytics-uploader@v2.1.1
       with:
         junit-paths: junit.xml
         org-slug: trunk

.github/actions/linter_tests/action.yaml

@@ -117,7 +117,7 @@ runs:
     - name: Upload prod results
       # TODO(Tyler): Add upload on Windows once the action supports it.
       if: "!cancelled() && runner.os != 'Windows' && inputs.trunk-prod-token != ''"
-      uses: trunk-io/analytics-uploader@main
+      uses: trunk-io/analytics-uploader@413ecdb8036c3698131a278a921c8481ffeec502 # v2.1.1      uses: trunk-io/analytics-uploader@v2.1.1
       with:
         junit-paths: junit.xml
         org-slug: trunk

.github/actions/tool_tests/action.yaml

@@ -79,7 +79,7 @@ runs:
     - name: Upload prod results
       # TODO(Tyler): Add upload on Windows once the action supports it.
       if: "!cancelled() && runner.os != 'Windows' && inputs.trunk-prod-token != ''"
-      uses: trunk-io/analytics-uploader@main
+      uses: trunk-io/analytics-uploader@413ecdb8036c3698131a278a921c8481ffeec502 # v2.1.1      uses: trunk-io/analytics-uploader@v2.1.1
       with:
         junit-paths: junit.xml
         org-slug: trunk

.github/workflows/codeql.yml

@@ -34,15 +34,15 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.35.2
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2        uses: github/codeql-action/init@v4.36.2
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: javascript
 
       # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
       # If this step fails, then you should remove it and run the build manually (see below).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.35.2
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2        uses: github/codeql-action/autobuild@v4.36.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -56,4 +56,4 @@ jobs:
       #     make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.35.2
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2        uses: github/codeql-action/analyze@v4.36.2

.github/workflows/pr.yaml

@@ -232,7 +232,7 @@ jobs:
           lfs: true
 
       - name: Trunk Check
-        uses: trunk-io/trunk-action@75699af9e26881e564e9d832ef7dc3af25ec031b
+        uses: trunk-io/trunk-action@75699af9e26881e564e9d832ef7dc3af25ec031b # v1.2.4        uses: trunk-io/trunk-action@75699af9e26881e564e9d832ef7dc3af25ec031b
         env:
           TRUNK_GITHUB_CHECK_RUN_TITLE: Trunk Check
 

.github/workflows/scorecard.yml

@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -65,6 +65,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.35.2
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2        uses: github/codeql-action/upload-sarif@v4.36.2
         with:
           sarif_file: results.sarif

.github/workflows/upgrade_trunk.yaml

@@ -19,14 +19,14 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Create App Token for TrunkBuild App (Internal)
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0        uses: tibdex/github-app-token@v2
         id: generate-token
         with:
           app_id: ${{ secrets.TRUNK_OPEN_PR_APP_ID }}
           private_key: ${{ secrets.TRUNK_OPEN_PR_APP_PRIVATE_KEY }}
 
       - name: Trunk Upgrade
-        uses: trunk-io/trunk-action/upgrade@75699af9e26881e564e9d832ef7dc3af25ec031b
+        uses: trunk-io/trunk-action/upgrade@75699af9e26881e564e9d832ef7dc3af25ec031b # v1.2.4        uses: trunk-io/trunk-action/upgrade@75699af9e26881e564e9d832ef7dc3af25ec031b
         with:
           arguments: -n --bleeding-edge
           github-token: ${{ steps.generate-token.outputs.token }}

.github/workflows/upload_results.reusable.yaml

@@ -225,14 +225,14 @@ jobs:
           git ls-files --others --exclude-standard | grep ".shot" | xargs sed -i '2i // trunk-upgrade-validation:RELEASE'
 
       - name: Create App Token for TrunkBuild App (Internal)
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0        uses: tibdex/github-app-token@v2
         id: generate-token
         with:
           app_id: ${{ secrets.TRUNK_OPEN_PR_APP_ID }}
           private_key: ${{ secrets.TRUNK_OPEN_PR_APP_PRIVATE_KEY }}
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11        uses: peter-evans/create-pull-request@v7
         with:
           title: Auto-add missing snapshots
           body:

.pinact.yaml

@@ -0,0 +1,13 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+# pinact - https://github.com/suzuki-shunsuke/pinact
+version: 3
+min_age:
+  value: 30
+  always: true
+
+rules:
+  - min_age: 0
+    conditions:
+      - expr: |
+          ActionRepoFullName == "trunk-io/analytics-uploader" ||
+          ActionRepoFullName == "github/codeql-action"

.trunk/trunk.yaml

@@ -43,6 +43,7 @@ lint:
           success_codes: [0]
   enabled:
     # enabled linters inherited from github.com/trunk-io/configs plugin
+    - pinact@4.0.0
     - ls-lint@2.3.1
     - pmd@7.18.0
     - definition-checker