Merge pull request #19 from Hasnep/add-ratchet-for-github-actions

.github/workflows/bundle.yaml

@@ -14,13 +14,13 @@ jobs:
       contents: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Roc
-        uses: hasnep/setup-roc@main
+        uses: hasnep/setup-roc@80f4b4a1b94a7a89b3152e9b4e635367e7c0a940 # ratchet:hasnep/setup-roc@main
         with:
           roc-version: nightly
       - name: Bundle and release the library
-        uses: hasnep/[email protected]
+        uses: hasnep/bundle-roc-library@4364d15b4ae83c99e0bc0caab8a254a5d0a9369f # ratchet:hasnep/bundle-roc-library@v0.1.0
         with:
           library: src/main.roc
           token: ${{ github.token }}

.github/workflows/check-pr-labels.yaml

@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for PR category labels
-        uses: yogevbd/[email protected]
+        uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024 # ratchet:yogevbd/enforce-label-action@2.2.2
         with:
           REQUIRED_LABELS_ANY: feature,fix,chore
           REQUIRED_LABELS_ANY_DESCRIPTION: Please tag your PR with one of `feature`, `fix`, or `chore`.
       - name: Check for PR version labels
-        uses: yogevbd/[email protected]
+        uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024 # ratchet:yogevbd/enforce-label-action@2.2.2
         with:
           REQUIRED_LABELS_ANY: major,minor,patch
           REQUIRED_LABELS_ANY_DESCRIPTION: Please tag your PR with one of `major`, `minor`, `patch`.

.github/workflows/generate-docs.yaml

@@ -15,9 +15,9 @@ jobs:
       id-token: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Roc
-        uses: hasnep/setup-roc@main
+        uses: hasnep/setup-roc@80f4b4a1b94a7a89b3152e9b4e635367e7c0a940 # ratchet:hasnep/setup-roc@main
         with:
           roc-version: nightly
       - name: Generate docs
@@ -26,8 +26,8 @@ jobs:
         run: |
           find generated-docs/ -type f -name '*.html' -exec sed -i "s/\(href\|src\)=\"\//\1=\"\/${{ github.event.repository.name }}\//g" {} +
       - name: Upload docs artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # ratchet:actions/upload-pages-artifact@v3
         with:
           path: generated-docs
       - name: Deploy docs
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # ratchet:actions/deploy-pages@v4

.github/workflows/run-pre-commit.yaml

@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v16
+        uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # ratchet:DeterminateSystems/nix-installer-action@v16
       - name: Cache Nix environment
-        uses: DeterminateSystems/magic-nix-cache-action@v8
+        uses: DeterminateSystems/magic-nix-cache-action@87b14cf437d03d37989d87f0fa5ce4f5dc1a330b # ratchet:DeterminateSystems/magic-nix-cache-action@v8
       - name: Use Nix dev shell for subsequent steps
-        uses: rrbutani/use-nix-shell-action@v1
+        uses: rrbutani/use-nix-shell-action@59a52b2b9bbfe3cc0e7deb8f9059abe37a439edf # ratchet:rrbutani/use-nix-shell-action@v1
         with:
           extraNixOptions: --accept-flake-config
       - name: Run Pre-commit

.github/workflows/test.yaml

@@ -20,9 +20,9 @@ jobs:
       contents: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Roc
-        uses: hasnep/setup-roc@main
+        uses: hasnep/setup-roc@80f4b4a1b94a7a89b3152e9b4e635367e7c0a940 # ratchet:hasnep/setup-roc@main
         with:
           roc-version: nightly
       - name: Test the library

.github/workflows/update-draft-release.yaml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Update the draft release
         id: update-draft-release
-        uses: release-drafter/release-drafter@v6
+        uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # ratchet:release-drafter/release-drafter@v6
         with:
           config-name: release-drafter.yaml
           disable-autolabeler: true

.pre-commit-config.yaml

@@ -77,6 +77,12 @@ repos:
         entry: actionlint
         types: [yaml]
         files: \.github/workflows/.*\.ya?ml$
+      - name: Check GitHub Actions are pinned
+        id: github-workflows-check-pinned
+        language: system
+        entry: ratchet check
+        types: [yaml]
+        files: \.github/workflows/.*\.ya?ml$
 
   # Nix
   - repo: local

Justfile

@@ -16,3 +16,6 @@ examples:
 
 docs:
     roc docs src/main.roc
+
+ratchet:
+    ratchet upgrade .github/workflows/*.yaml

flake.nix

@@ -40,6 +40,7 @@
               pkgs.nodePackages.prettier
               pkgs.pre-commit
               pkgs.python312Packages.pre-commit-hooks
+              pkgs.ratchet
             ];
             shellHook = "pre-commit install --overwrite";
           };