From 3cce4fb34767e2d3792f06a3214fa134df811878 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Valentin=20Breu=C3=9F?= Date: Thu, 5 Nov 2026 16:42:16 +0100 Subject: [PATCH] ci: pin all GitHub Actions to commit SHAs so a moved tag cannot inject code into workflows that hold secrets or write permissions Renovate's pinGitHubActionDigests preset keeps the pins up to date. --- .github/workflows/build.yml | 34 +++++++++++++++++----------------- .github/workflows/ci.yml | 20 ++++++++++---------- renovate.json5 | 2 +- 3 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 701348797..a74d8a1dd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -13,11 +13,11 @@ jobs: os: [ ubuntu-latest, windows-latest, macos-latest ] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -34,7 +34,7 @@ jobs: run: ./build.sh CodeCoverage - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ runner.os }}-artifacts path: | @@ -47,11 +47,11 @@ jobs: env: DOTNET_NOLOGO: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -64,7 +64,7 @@ jobs: run: ./build.sh ApiChecks - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: API-tests path: | @@ -79,11 +79,11 @@ jobs: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} DOTNET_NOLOGO: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -105,11 +105,11 @@ jobs: if: always() steps: - name: Download Artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts - name: Publish Test Results - uses: EnricoMi/publish-unit-test-result-action@v2 + uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d # v2.25.0 with: comment_mode: always files: "artifacts/**/**/*.trx" @@ -121,11 +121,11 @@ jobs: env: DOTNET_NOLOGO: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -138,7 +138,7 @@ jobs: run: ./build.sh Pack - name: Upload packages if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: path: Artifacts/Packages name: Packages @@ -154,12 +154,12 @@ jobs: id-token: write steps: - name: Download packages - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: Packages path: Artifacts/Packages - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 - name: NuGet login id: login uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0 @@ -186,7 +186,7 @@ jobs: - name: Create GitHub release if: steps.check-pre-release.outputs.release == 'true' continue-on-error: true - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3.0.4 with: name: ${{ steps.tag.outputs.release_version }} tag_name: ${{ steps.tag.outputs.release_version }} @@ -212,7 +212,7 @@ jobs: - name: Comment relevant issues and pull requests if: steps.check-pre-release.outputs.release == 'true' continue-on-error: true - uses: apexskier/github-release-commenter@v1.4.1 + uses: apexskier/github-release-commenter@e7813a9625eabd79a875b4bc4046cfcae377ab34 # v1.4.1 with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} comment-template: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7d7a0d378..9608c5c06 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,11 +13,11 @@ jobs: os: [ ubuntu-latest, windows-latest, macos-latest ] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -34,7 +34,7 @@ jobs: run: ./build.sh CodeCoverage - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ runner.os }}-artifacts path: | @@ -47,11 +47,11 @@ jobs: env: DOTNET_NOLOGO: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -64,7 +64,7 @@ jobs: run: ./build.sh ApiChecks - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: API-tests path: | @@ -80,11 +80,11 @@ jobs: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} DOTNET_NOLOGO: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup .NET SDKs - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0 with: dotnet-version: | 6.0.x @@ -106,11 +106,11 @@ jobs: if: always() steps: - name: Download Artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts - name: Publish Test Results - uses: EnricoMi/publish-unit-test-result-action@v2 + uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d # v2.25.0 with: comment_mode: always files: "artifacts/**/**/*.trx" diff --git a/renovate.json5 b/renovate.json5 index 486427d2c..5dc4e2905 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -1,5 +1,5 @@ { - extends: ["config:base"], + extends: ["config:base", "helpers:pinGitHubActionDigests"], ignorePaths: [ // Clear the default list to enable Renovate for all files ],