From dc74857fd4915b4c738937278375f596972c3359 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Jan 2023 13:55:55 +0100 Subject: [PATCH] Pin GH actions Dependabot is also capable of pinning to future tag releases and will maintain the comment that descibes the shasum. https://github.com/dependabot/dependabot-core/issues/4691 Signed-off-by: Marco Franssen --- .github/workflows/ci.yaml | 31 ++++++++++++-------------- .github/workflows/example-local.yaml | 10 ++++----- .github/workflows/example-publish.yaml | 9 ++++---- 3 files changed, 22 insertions(+), 28 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d50671f9..45e188bc 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -17,10 +17,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.2.0 - + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # ratchet:actions/checkout@v3.2.0 - name: Set up Go - uses: actions/setup-go@v3.5.0 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # ratchet:actions/setup-go@v3.5.0 with: go-version-file: go.mod check-latest: true @@ -49,7 +48,7 @@ jobs: run: make coverage-out - name: Upload Code Coverage - uses: codecov/codecov-action@v3.1.1 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # ratchet:codecov/codecov-action@v3.1.1 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.out @@ -70,25 +69,24 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.2.0 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # ratchet:actions/checkout@v3.2.0 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v3.5.0 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # ratchet:actions/setup-go@v3.5.0 with: go-version-file: ./go.mod check-latest: true cache: true - name: Install cosign - uses: sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 with: cosign-release: 'v1.13.1' - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.13.1 - + uses: anchore/sbom-action/download-syft@06e109483e6aa305a2b2395eabae554e51530e1d # ratchet:anchore/sbom-action/download-syft@v0.13.1 - name: Login to Container registries if: startsWith(github.ref, 'refs/tags/') run: | @@ -113,7 +111,7 @@ jobs: echo '${{ secrets.COSIGN_PRIVATE_KEY }}' > cosign.key - name: Release ${{ (!startsWith(github.ref, 'refs/tags/') && 'snapshot') || '' }} - uses: goreleaser/goreleaser-action@v4 + uses: goreleaser/goreleaser-action@8f67e590f2d095516493f017008adc464e63adb1 # ratchet:goreleaser/goreleaser-action@v4 with: version: latest args: release --rm-dist ${{ (!startsWith(github.ref, 'refs/tags/') && '--snapshot') || '' }} ${{ ((startsWith(github.ref, 'refs/tags/') && endsWith(github.ref, '-draft')) && '-f .goreleaser.draft.yml') || '' }} @@ -156,13 +154,12 @@ jobs: steps: - name: Install cosign - uses: sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 with: cosign-release: 'v1.13.1' - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.13.1 - + uses: anchore/sbom-action/download-syft@06e109483e6aa305a2b2395eabae554e51530e1d # ratchet:anchore/sbom-action/download-syft@v0.13.1 - name: Login to Container registries run: | echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u philipssoftware --password-stdin @@ -197,7 +194,7 @@ jobs: steps: - name: Generate provenance for Release - uses: philips-labs/slsa-provenance-action@v0.8.0 + uses: philips-labs/slsa-provenance-action@752766b8a3b1ebd09d599e163eeec8fa39e677aa # ratchet:philips-labs/slsa-provenance-action@v0.8.0 with: command: generate subcommand: github-release @@ -206,7 +203,7 @@ jobs: GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - name: Install cosign - uses: sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 with: cosign-release: 'v1.13.1' @@ -242,12 +239,12 @@ jobs: steps: - name: Install cosign - uses: sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 with: cosign-release: 'v1.13.1' - name: Generate provenance for ${{ matrix.repo }} - uses: philips-labs/slsa-provenance-action@v0.8.0 + uses: philips-labs/slsa-provenance-action@752766b8a3b1ebd09d599e163eeec8fa39e677aa # ratchet:philips-labs/slsa-provenance-action@v0.8.0 with: command: generate subcommand: container diff --git a/.github/workflows/example-local.yaml b/.github/workflows/example-local.yaml index 1006078d..18c9f8f1 100644 --- a/.github/workflows/example-local.yaml +++ b/.github/workflows/example-local.yaml @@ -33,7 +33,7 @@ jobs: echo ", ${{github.event.inputs.car_input}}" >> cars.txt - name: Upload artifact - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # ratchet:actions/upload-artifact@v3.1.1 with: path: '*.txt' @@ -44,11 +44,9 @@ jobs: steps: # checkout only required to run local action (defined in this repo) - name: Checkout - uses: actions/checkout@v3.2.0 - + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # ratchet:actions/checkout@v3.2.0 - name: Download build artifact - uses: actions/download-artifact@v3.0.1 - + uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # ratchet:actions/download-artifact@v3.0.1 - name: Generate some extra materials (this usually happens as part of the build process) run: | echo '[{"uri": "pkg:deb/debian/stunnel4@5.50-3?arch=amd64", "digest": {"sha256": "e1731ae217fcbc64d4c00d707dcead45c828c5f762bcf8cc56d87de511e096fa"}}]' > extra-materials.json @@ -61,6 +59,6 @@ jobs: extra_materials: extra-materials.json - name: Upload provenance - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # ratchet:actions/upload-artifact@v3.1.1 with: path: provenance.json diff --git a/.github/workflows/example-publish.yaml b/.github/workflows/example-publish.yaml index 10c3f9af..896704e1 100644 --- a/.github/workflows/example-publish.yaml +++ b/.github/workflows/example-publish.yaml @@ -13,7 +13,7 @@ jobs: run: echo "onion, tomato, jalapeno, cilantro, lime, salt" > salsa.txt - name: Upload artifact - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # ratchet:actions/upload-artifact@v3.1.1 with: path: salsa.txt @@ -23,16 +23,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Download build artifact - uses: actions/download-artifact@v3.0.1 - + uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # ratchet:actions/download-artifact@v3.0.1 - name: Generate provenance - uses: philips-labs/slsa-provenance-action@v0.8.0 + uses: philips-labs/slsa-provenance-action@752766b8a3b1ebd09d599e163eeec8fa39e677aa # ratchet:philips-labs/slsa-provenance-action@v0.8.0 with: command: generate subcommand: files arguments: --artifact-path artifact/ --output-path provenance.json - name: Upload provenance - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # ratchet:actions/upload-artifact@v3.1.1 with: path: provenance.json