Skip to content

Commit 75f5f2c

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] ci: Harden GitHub Actions (#172)
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
1 parent a9324ad commit 75f5f2c

File tree

6 files changed

+41
-41
lines changed

6 files changed

+41
-41
lines changed

‎.github/workflows/build-with-clang.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525

2626
steps:
2727
- name: Cancel Previous Runs
28-
uses: styfle/cancel-workflow-action@0.12.1
28+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
2929
with:
3030
access_token: ${{ github.token }}
3131

@@ -44,13 +44,13 @@ jobs:
4444
sudo apt-get install intel-oneapi-mkl-devel
4545
4646
- name: Setup Python
47-
uses: actions/setup-python@v5
47+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
4848
with:
4949
python-version: ${{ matrix.python }}
5050
architecture: x64
5151

5252
- name: Checkout repo
53-
uses: actions/checkout@v4
53+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454
with:
5555
fetch-depth: 0
5656

‎.github/workflows/build_pip.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ jobs:
3131
run: |
3232
sudo apt-get install jq
3333
34-
- uses: actions/checkout@v4
34+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3535
with:
3636
fetch-depth: 0
3737

38-
- uses: conda-incubator/setup-miniconda@v3
38+
- uses: conda-incubator/setup-miniconda@505e6394dae86d6a5c7fbb6e3fb8938e3e863830 # v3.1.1
3939
with:
4040
use-mamba: true
4141
miniforge-version: latest

‎.github/workflows/conda-package-cf.yml

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ jobs:
2323
python: ['3.9', '3.10', '3.11', '3.12']
2424
steps:
2525
- name: Cancel Previous Runs
26-
uses: styfle/cancel-workflow-action@0.12.1
26+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
2727
with:
2828
access_token: ${{ github.token }}
2929

30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3131
with:
3232
fetch-depth: 0
3333

@@ -36,7 +36,7 @@ jobs:
3636
echo "pkgs_dirs: [~/.conda/pkgs]" >> ~/.condarc
3737
3838
- name: Cache conda packages
39-
uses: actions/cache@v4
39+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
4040
env:
4141
CACHE_NUMBER: 0 # Increase to reset cache
4242
with:
@@ -66,7 +66,7 @@ jobs:
6666
conda-recipe-cf
6767
6868
- name: Upload artifact
69-
uses: actions/upload-artifact@v4
69+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7070
with:
7171
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
7272
path: /usr/share/miniconda/conda-bld/linux-64/${{ env.PACKAGE_NAME }}-*.conda
@@ -87,7 +87,7 @@ jobs:
8787

8888
steps:
8989
- name: Download artifact
90-
uses: actions/download-artifact@v4
90+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
9191
with:
9292
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python_ver }}
9393

@@ -118,7 +118,7 @@ jobs:
118118
echo "pkgs_dirs: [~/.conda/pkgs]" >> ~/.condarc
119119
120120
- name: Cache conda packages
121-
uses: actions/cache@v4
121+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
122122
env:
123123
CACHE_NUMBER: 0 # Increase to reset cache
124124
with:
@@ -150,15 +150,15 @@ jobs:
150150
python: ['3.9', '3.10', '3.11', '3.12']
151151
steps:
152152
- name: Cancel Previous Runs
153-
uses: styfle/cancel-workflow-action@0.12.1
153+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
154154
with:
155155
access_token: ${{ github.token }}
156156

157-
- uses: actions/checkout@v4
157+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
158158
with:
159159
fetch-depth: 0
160160

161-
- uses: conda-incubator/setup-miniconda@v3
161+
- uses: conda-incubator/setup-miniconda@505e6394dae86d6a5c7fbb6e3fb8938e3e863830 # v3.1.1
162162
with:
163163
miniforge-version: latest
164164
activate-environment: build
@@ -170,7 +170,7 @@ jobs:
170170
run: conda install -n base conda-build
171171

172172
- name: Cache conda packages
173-
uses: actions/cache@v4
173+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
174174
env:
175175
CACHE_NUMBER: 3 # Increase to reset cache
176176
with:
@@ -192,7 +192,7 @@ jobs:
192192
echo "CONDA_BLD=$CONDA/conda-bld/win-64/" | tr "\\\\" '/' >> $GITHUB_ENV
193193
194194
- name: Upload artifact
195-
uses: actions/upload-artifact@v4
195+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
196196
with:
197197
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
198198
path: ${{ env.CONDA_BLD }}${{ env.PACKAGE_NAME }}-*.conda
@@ -217,11 +217,11 @@ jobs:
217217

218218
steps:
219219
- name: Download artifact
220-
uses: actions/download-artifact@v4
220+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
221221
with:
222222
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python_ver }}
223223

224-
- uses: conda-incubator/setup-miniconda@v3
224+
- uses: conda-incubator/setup-miniconda@505e6394dae86d6a5c7fbb6e3fb8938e3e863830 # v3.1.1
225225
with:
226226
miniforge-version: latest
227227
activate-environment: ${{ env.TEST_ENV_NAME }}
@@ -273,7 +273,7 @@ jobs:
273273
run: Get-Content -Path .\lockfile
274274

275275
- name: Cache conda packages
276-
uses: actions/cache@v4
276+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
277277
env:
278278
CACHE_NUMBER: 0 # Increase to reset cache
279279
with:

‎.github/workflows/conda-package.yml

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ jobs:
2323
python: ['3.9', '3.10', '3.11', '3.12']
2424
steps:
2525
- name: Cancel Previous Runs
26-
uses: styfle/cancel-workflow-action@0.12.1
26+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
2727
with:
2828
access_token: ${{ github.token }}
2929

30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3131
with:
3232
fetch-depth: 0
3333

@@ -36,7 +36,7 @@ jobs:
3636
echo "pkgs_dirs: [~/.conda/pkgs]" >> ~/.condarc
3737
3838
- name: Cache conda packages
39-
uses: actions/cache@v4
39+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
4040
env:
4141
CACHE_NUMBER: 0 # Increase to reset cache
4242
with:
@@ -66,7 +66,7 @@ jobs:
6666
conda-recipe
6767
6868
- name: Upload artifact
69-
uses: actions/upload-artifact@v4
69+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7070
with:
7171
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
7272
path: /usr/share/miniconda/conda-bld/linux-64/${{ env.PACKAGE_NAME }}-*.conda
@@ -86,7 +86,7 @@ jobs:
8686

8787
steps:
8888
- name: Download artifact
89-
uses: actions/download-artifact@v4
89+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
9090
with:
9191
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
9292

@@ -117,7 +117,7 @@ jobs:
117117
echo "pkgs_dirs: [~/.conda/pkgs]" >> ~/.condarc
118118
119119
- name: Cache conda packages
120-
uses: actions/cache@v4
120+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
121121
env:
122122
CACHE_NUMBER: 0 # Increase to reset cache
123123
with:
@@ -149,15 +149,15 @@ jobs:
149149
python: ['3.9', '3.10', '3.11', '3.12']
150150
steps:
151151
- name: Cancel Previous Runs
152-
uses: styfle/cancel-workflow-action@0.12.1
152+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
153153
with:
154154
access_token: ${{ github.token }}
155155

156-
- uses: actions/checkout@v4.2.0
156+
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
157157
with:
158158
fetch-depth: 0
159159

160-
- uses: conda-incubator/setup-miniconda@v3
160+
- uses: conda-incubator/setup-miniconda@505e6394dae86d6a5c7fbb6e3fb8938e3e863830 # v3.1.1
161161
with:
162162
miniforge-version: latest
163163
activate-environment: build
@@ -171,7 +171,7 @@ jobs:
171171
conda install -n base conda-build
172172
173173
- name: Cache conda packages
174-
uses: actions/cache@v4
174+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
175175
env:
176176
CACHE_NUMBER: 3 # Increase to reset cache
177177
with:
@@ -193,7 +193,7 @@ jobs:
193193
echo "CONDA_BLD=$CONDA/conda-bld/win-64/" | tr "\\\\" '/' >> $GITHUB_ENV
194194
195195
- name: Upload artifact
196-
uses: actions/upload-artifact@v4
196+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
197197
with:
198198
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
199199
path: ${{ env.CONDA_BLD }}${{ env.PACKAGE_NAME }}-*.conda
@@ -217,11 +217,11 @@ jobs:
217217

218218
steps:
219219
- name: Download artifact
220-
uses: actions/download-artifact@v4
220+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
221221
with:
222222
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
223223

224-
- uses: conda-incubator/setup-miniconda@v3
224+
- uses: conda-incubator/setup-miniconda@505e6394dae86d6a5c7fbb6e3fb8938e3e863830 # v3.1.1
225225
with:
226226
miniforge-version: latest
227227
activate-environment: ${{ env.TEST_ENV_NAME }}
@@ -273,7 +273,7 @@ jobs:
273273
run: Get-Content -Path .\lockfile
274274

275275
- name: Cache conda packages
276-
uses: actions/cache@v4
276+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
277277
env:
278278
CACHE_NUMBER: 0 # Increase to reset cache
279279
with:

‎.github/workflows/openssf-scorecard.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,12 @@ jobs:
3434

3535
steps:
3636
- name: "Checkout code"
37-
uses: actions/checkout@v4.1.1
37+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3838
with:
3939
persist-credentials: false
4040

4141
- name: "Run analysis"
42-
uses: ossf/scorecard-action@v2.4.1
42+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
4343
with:
4444
results_file: results.sarif
4545
results_format: sarif
@@ -61,14 +61,14 @@ jobs:
6161
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6262
# format to the repository Actions tab.
6363
- name: "Upload artifact"
64-
uses: actions/upload-artifact@v4.3.0
64+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
6565
with:
6666
name: SARIF file
6767
path: results.sarif
6868
retention-days: 14
6969

7070
# Upload the results to GitHub's code scanning dashboard.
7171
- name: "Upload to code-scanning"
72-
uses: github/codeql-action/upload-sarif@v3.28.16
72+
uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
7373
with:
7474
sarif_file: results.sarif

‎.github/workflows/pre-commit.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@ jobs:
1313
timeout-minutes: 30
1414
steps:
1515
- name: Checkout repo
16-
uses: actions/checkout@v4.2.2
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1717

1818
- name: Set up python
19-
uses: actions/setup-python@v5
19+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
2020
with:
2121
python-version: '3.12'
2222

2323
- name: Set up pip packages
24-
uses: BSFishy/pip-action@v1
24+
uses: BSFishy/pip-action@8f2d471d809dc20b6ada98c91910b6ae6243f318 # v1
2525
with:
2626
packages: |
2727
codespell
@@ -35,4 +35,4 @@ jobs:
3535
clang-format --version
3636
3737
- name: Run pre-commit checks
38-
uses: pre-commit/action@v3.0.1
38+
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

0 commit comments

Comments
 (0)