From 1f18ba458226d75aa3675446e1a59437a1a24645 Mon Sep 17 00:00:00 2001 From: Hiroshi Ogawa Date: Tue, 26 May 2026 14:54:00 +0900 Subject: [PATCH] ci: pin action version hash in v4 branch (#10453) --- .github/actions/setup-and-cache/action.yml | 2 +- .github/actions/setup-playwright/action.yml | 2 +- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/cr.yml | 4 ++-- .github/workflows/ecosystem-ci-trigger.yml | 6 +++--- .github/workflows/issue-close-require.yml | 2 +- .github/workflows/publish.yml | 4 ++-- 7 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/actions/setup-and-cache/action.yml b/.github/actions/setup-and-cache/action.yml index 92c7b58d0..408474e33 100644 --- a/.github/actions/setup-and-cache/action.yml +++ b/.github/actions/setup-and-cache/action.yml @@ -14,7 +14,7 @@ runs: uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 - name: Set node version to ${{ inputs.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ inputs.node-version }} cache: pnpm diff --git a/.github/actions/setup-playwright/action.yml b/.github/actions/setup-playwright/action.yml index c796bb122..55544f48a 100644 --- a/.github/actions/setup-playwright/action.yml +++ b/.github/actions/setup-playwright/action.yml @@ -29,7 +29,7 @@ runs: run: echo "Failed to resolve package versions. See log above." && exit 1 - name: Cache Playwright v${{ steps.resolve-package-versions.outputs.PLAYWRIGHT_VERSION }} - uses: actions/cache@v5 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 id: playwright-cache with: path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 010cff2d6..d859e0c0a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest name: 'Lint: node-latest, ubuntu-latest' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ./.github/actions/setup-and-cache @@ -66,7 +66,7 @@ jobs: should_skip: ${{ steps.changed-files.outputs.only_changed == 'true' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Get changed files id: changed-files @@ -98,7 +98,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ./.github/actions/setup-and-cache with: @@ -123,7 +123,7 @@ jobs: - name: Unit Test UI run: pnpm -C packages/ui test:ui - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ !cancelled() }} with: name: playwright-report-${{ matrix.os }}-node-${{ matrix.node_version }} @@ -147,7 +147,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ./.github/actions/setup-and-cache with: @@ -183,7 +183,7 @@ jobs: timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ./.github/actions/setup-and-cache with: @@ -216,7 +216,7 @@ jobs: timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ./.github/actions/setup-and-cache with: @@ -245,7 +245,7 @@ jobs: if: ${{ !cancelled() }} run: pnpm run test:browser:playwright - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ !cancelled() }} with: name: playwright-report-rolldown diff --git a/.github/workflows/cr.yml b/.github/workflows/cr.yml index 07075c88b..dad879ffd 100644 --- a/.github/workflows/cr.yml +++ b/.github/workflows/cr.yml @@ -19,7 +19,7 @@ jobs: name: 'Release: pkg.pr.new' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -27,7 +27,7 @@ jobs: uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 - name: Set node version to 20 - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 20 registry-url: https://registry.npmjs.org/ diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml index 712cc473d..86cece8ad 100644 --- a/.github/workflows/ecosystem-ci-trigger.yml +++ b/.github/workflows/ecosystem-ci-trigger.yml @@ -14,7 +14,7 @@ jobs: actions: read # to check workflow status contents: read # to clone the repo steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | const user = context.payload.sender.login @@ -50,7 +50,7 @@ jobs: }) throw new Error('not allowed') } - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 id: get-pr-data with: script: | @@ -71,7 +71,7 @@ jobs: app_id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }} installation_retrieval_payload: '${{ github.repository_owner }}/vitest-ecosystem-ci' private_key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }} - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 id: trigger env: COMMENT: ${{ github.event.comment.body }} diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml index 48357e33e..a20f0dc40 100644 --- a/.github/workflows/issue-close-require.yml +++ b/.github/workflows/issue-close-require.yml @@ -33,7 +33,7 @@ jobs: pull-requests: write # to close pull requests steps: - name: maybe automated PRs - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | const cutoff = new Date(Date.now() - 3 * 24 * 60 * 60 * 1000) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index bee9a3d25..03029c8d5 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest environment: Release steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -27,7 +27,7 @@ jobs: uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 - name: Set node version to 20 - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 20 registry-url: https://registry.npmjs.org/ -- 2.51.2