Skip to content

Commit 6cd8082

Browse files
maennchenmaennchen
authored
Pin GitHub Actions (#14332)
1 parent 0f3a8f0 commit 6cd8082

File tree

6 files changed

+29
-29
lines changed

6 files changed

+29
-29
lines changed

‎.github/workflows/ci-markdown.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ jobs:
2525

2626
steps:
2727
- name: Check out the repository
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2929
with:
3030
fetch-depth: 10
3131

3232
- name: Run markdownlint
33-
uses: DavidAnson/markdownlint-cli2-action@v19.1.0
33+
uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19.1.0
3434
with:
3535
globs: |
3636
lib/elixir/pages/**/*.md

‎.github/workflows/ci.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ jobs:
3838
development: true
3939
runs-on: ubuntu-24.04
4040
steps:
41-
- uses: actions/checkout@v4
41+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4242
with:
4343
fetch-depth: 50
44-
- uses: erlef/setup-beam@v1
44+
- uses: erlef/setup-beam@5304e04ea2b355f03681464e683d92e3b2f18451 # v1.18.2
4545
with:
4646
otp-version: ${{ matrix.otp_version }}
4747
- name: Set ERL_COMPILER_OPTIONS
@@ -88,10 +88,10 @@ jobs:
8888
steps:
8989
- name: Configure Git
9090
run: git config --global core.autocrlf input
91-
- uses: actions/checkout@v4
91+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9292
with:
9393
fetch-depth: 50
94-
- uses: erlef/setup-beam@v1
94+
- uses: erlef/setup-beam@5304e04ea2b355f03681464e683d92e3b2f18451 # v1.18.2
9595
with:
9696
otp-version: ${{ matrix.otp_version }}
9797
- name: Compile Elixir
@@ -113,7 +113,7 @@ jobs:
113113
name: Check POSIX-compliant
114114
runs-on: ubuntu-24.04
115115
steps:
116-
- uses: actions/checkout@v4
116+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117117
with:
118118
fetch-depth: 50
119119
- name: Install Shellcheck
@@ -139,7 +139,7 @@ jobs:
139139

140140
- name: Checkout project
141141
id: checkout
142-
uses: actions/checkout@v4
142+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
143143

144144
- name: "Run OSS Review Toolkit"
145145
id: ort

‎.github/workflows/notify.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ jobs:
1616
runs-on: ubuntu-20.04
1717
name: Notify
1818
steps:
19-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020
with:
2121
fetch-depth: 50
22-
- uses: erlef/setup-beam@v1
22+
- uses: erlef/setup-beam@5304e04ea2b355f03681464e683d92e3b2f18451 # v1.18.2
2323
with:
2424
otp-version: '25.0'
2525
elixir-version: '1.14.0'

‎.github/workflows/ort/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ runs:
4141
steps:
4242
- name: Fetch Default ORT Config
4343
id: fetch-default-ort-config
44-
uses: actions/checkout@v4
44+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4545
with:
4646
repository: oss-review-toolkit/ort-config
4747
ref: "main"
@@ -71,7 +71,7 @@ runs:
7171
ELIXIR_REPO: "${{ github.server_url }}/${{ github.repository }}.git"
7272

7373
- name: "Cache ScanCode"
74-
uses: actions/cache@v4
74+
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
7575
with:
7676
path: "~/.cache/scancode-tk"
7777
key: ${{ runner.os }}-scancode

‎.github/workflows/release.yml

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
--draft \
3737
${{ github.ref_name }}
3838
39-
- uses: actions/checkout@v4
39+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4040
if: github.ref_type == 'branch'
4141
with:
4242
fetch-depth: 50
@@ -73,7 +73,7 @@ jobs:
7373
runs-on: ubuntu-22.04
7474

7575
steps:
76-
- uses: actions/checkout@v4
76+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7777
with:
7878
fetch-depth: 50
7979

@@ -91,19 +91,19 @@ jobs:
9191
shasum -a 256 Docs.zip > Docs.zip.sha256sum
9292
9393
- name: "Upload linux release artifacts"
94-
uses: actions/upload-artifact@v4
94+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
9595
with:
9696
name: build-linux-elixir-otp-${{ matrix.otp }}
9797
path: elixir-otp-${{ matrix.otp }}.zip
9898

9999
- name: "Upload windows release artifacts"
100-
uses: actions/upload-artifact@v4
100+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
101101
with:
102102
name: build-windows-elixir-otp-${{ matrix.otp }}
103103
path: elixir-otp-${{ matrix.otp }}.exe
104104

105105
- name: "Upload doc artifacts"
106-
uses: actions/upload-artifact@v4
106+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
107107
if: matrix.build_docs
108108
with:
109109
name: Docs
@@ -124,12 +124,12 @@ jobs:
124124

125125
steps:
126126
- name: "Download build"
127-
uses: actions/download-artifact@v4
127+
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
128128
with:
129129
name: build-${{ matrix.flavor }}-elixir-otp-${{ matrix.otp }}
130130

131131
- name: "Sign files with Trusted Signing"
132-
uses: azure/trusted-signing-action@v0.5.1
132+
uses: azure/trusted-signing-action@0d74250c661747df006298d0fb49944c10f16e03 # v0.5.1
133133
if: github.repository == 'elixir-lang/elixir' && matrix.flavor == 'windows'
134134
with:
135135
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -169,7 +169,7 @@ jobs:
169169
shasum -a 256 "$RELEASE_FILE" > "${RELEASE_FILE}.sha256sum"
170170
171171
- name: "Upload linux release artifacts"
172-
uses: actions/upload-artifact@v4
172+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
173173
with:
174174
name: sign-${{ matrix.flavor }}-elixir-otp-${{ matrix.otp }}
175175
path: ${{ env.RELEASE_FILE }}*
@@ -189,11 +189,11 @@ jobs:
189189

190190
- name: Checkout project
191191
id: checkout
192-
uses: actions/checkout@v4
192+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
193193

194194
- name: "Download Build Artifacts"
195195
id: download-build-artifacts
196-
uses: actions/download-artifact@v4
196+
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
197197
with:
198198
pattern: "{sign-*-elixir-otp-*,Docs}"
199199
merge-multiple: true
@@ -208,7 +208,7 @@ jobs:
208208

209209
- name: Attest Distribution Assets with SBoM
210210
id: attest-sbom
211-
uses: actions/attest-sbom@v2
211+
uses: actions/attest-sbom@115c3be05ff3974bcbd596578934b3f9ce39bf68 # v2.2.0
212212
with:
213213
subject-path: |
214214
/tmp/build-artifacts/{elixir-otp-*.*,Docs.zip}
@@ -236,7 +236,7 @@ jobs:
236236
ATTESTATION: "${{ steps.attest-sbom.outputs.bundle-path }}"
237237

238238
- name: "Assemble Release SBoM Artifacts"
239-
uses: actions/upload-artifact@v4
239+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
240240
with:
241241
name: "SBoM"
242242
path: |
@@ -246,7 +246,7 @@ jobs:
246246
${{ steps.ort.outputs.results-sbom-spdx-json-path }}
247247
248248
- name: "Assemble Distribution Attestations"
249-
uses: actions/upload-artifact@v4
249+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
250250
with:
251251
name: "Attestations"
252252
path: "attestations/*.sigstore"
@@ -256,7 +256,7 @@ jobs:
256256
runs-on: ubuntu-22.04
257257

258258
steps:
259-
- uses: actions/download-artifact@v4
259+
- uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
260260
with:
261261
pattern: "{sign-*-elixir-otp-*,Docs,SBoM,Attestations}"
262262
merge-multiple: true
@@ -301,7 +301,7 @@ jobs:
301301
FASTLY_KEY: ${{ secrets.HEX_FASTLY_KEY }}
302302
OTP_GENERIC_VERSION: "25"
303303
steps:
304-
- uses: actions/download-artifact@v4
304+
- uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
305305
with:
306306
pattern: "{sign-*-elixir-otp-*,Docs}"
307307
merge-multiple: true

‎.github/workflows/release_pre_built/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ inputs:
1313
runs:
1414
using: "composite"
1515
steps:
16-
- uses: erlef/setup-beam@v1
16+
- uses: erlef/setup-beam@5304e04ea2b355f03681464e683d92e3b2f18451 # v1.18.2
1717
with:
1818
otp-version: ${{ inputs.otp_version }}
1919
version-type: strict
@@ -45,7 +45,7 @@ runs:
4545
ref=v$(curl -s https://hex.pm/api/packages/ex_doc | jq --raw-output '.latest_stable_version')
4646
fi
4747
echo "EX_DOC_REF=$ref" >> $GITHUB_ENV
48-
- uses: actions/checkout@v4
48+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4949
if: ${{ inputs.build_docs }}
5050
with:
5151
repository: elixir-lang/ex_doc

0 commit comments

Comments
 (0)