From 7b783de170b1cc0eaed538798e9aebb4a6324043 Mon Sep 17 00:00:00 2001 From: Vladimir Date: Tue, 19 May 2026 11:15:08 +0200 Subject: [PATCH] ci: pin all actions including the official ones (#10392) --- .github/actions/setup-and-cache/action.yml | 2 +- .github/actions/setup-playwright/action.yml | 2 +- .github/workflows/ci.yml | 24 ++++++++++----------- .github/workflows/cr.yml | 4 ++-- .github/workflows/ecosystem-ci-trigger.yml | 8 +++---- .github/workflows/issue-close-require.yml | 2 +- .github/workflows/publish.yml | 4 ++-- .github/workflows/zizmor.yml | 2 +- .github/zizmor.yml | 5 ----- 9 files changed, 24 insertions(+), 29 deletions(-) diff --git a/.github/actions/setup-and-cache/action.yml b/.github/actions/setup-and-cache/action.yml index 92c7b58d0..408474e33 100644 --- a/.github/actions/setup-and-cache/action.yml +++ b/.github/actions/setup-and-cache/action.yml @@ -14,7 +14,7 @@ runs: uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 - name: Set node version to ${{ inputs.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ inputs.node-version }} cache: pnpm diff --git a/.github/actions/setup-playwright/action.yml b/.github/actions/setup-playwright/action.yml index 22e166521..19e8ebf4d 100644 --- a/.github/actions/setup-playwright/action.yml +++ b/.github/actions/setup-playwright/action.yml @@ -25,7 +25,7 @@ runs: run: echo "Failed to resolve package versions. See log above." && exit 1 - name: Cache Playwright v${{ steps.resolve-package-versions.outputs.PLAYWRIGHT_VERSION }} - uses: actions/cache@v5 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 id: playwright-cache with: path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6e5e126ba..20c07d769 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest name: 'Lint: node-latest, ubuntu-latest' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -67,7 +67,7 @@ jobs: should_skip: ${{ steps.changed-files.outputs.only_changed == 'true' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -101,7 +101,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -130,14 +130,14 @@ jobs: - name: Unit Test UI run: pnpm -C packages/ui test:ui - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ !cancelled() }} with: name: playwright-report-${{ matrix.os }}-node-${{ matrix.node_version }} path: test/ui/test-results/ retention-days: 30 - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ !cancelled() }} with: name: vitest-results-${{ matrix.os }}-node-${{ matrix.node_version }} @@ -165,7 +165,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -203,7 +203,7 @@ jobs: timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -238,7 +238,7 @@ jobs: timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -273,7 +273,7 @@ jobs: if: ${{ !cancelled() }} run: pnpm run test:browser:playwright - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ !cancelled() }} with: name: playwright-report-vite7 @@ -289,7 +289,7 @@ jobs: name: Merge Reports timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -301,7 +301,7 @@ jobs: - name: Build run: pnpm run build - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: pattern: vitest-results-* merge-multiple: true @@ -318,7 +318,7 @@ jobs: cp -rf test/e2e/html html-all/e2e echo "short_sha=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 id: upload-report with: name: vitest-ci-report-${{ steps.merge-html.outputs.short_sha }} diff --git a/.github/workflows/cr.yml b/.github/workflows/cr.yml index 42f4ac7e3..e8d838c83 100644 --- a/.github/workflows/cr.yml +++ b/.github/workflows/cr.yml @@ -19,7 +19,7 @@ jobs: name: 'Release: pkg.pr.new' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -28,7 +28,7 @@ jobs: uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 - name: Set node version to 24 - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: https://registry.npmjs.org/ diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml index 9da4e578e..d64e2f7fb 100644 --- a/.github/workflows/ecosystem-ci-trigger.yml +++ b/.github/workflows/ecosystem-ci-trigger.yml @@ -21,7 +21,7 @@ jobs: actions: read # to check workflow status contents: read # to clone the repo steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | const user = context.payload.sender.login @@ -57,7 +57,7 @@ jobs: }) throw new Error('not allowed') } - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 id: get-pr-data with: script: | @@ -73,7 +73,7 @@ jobs: repo: pr.head.repo.full_name } - id: generate-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }} private-key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }} @@ -81,7 +81,7 @@ jobs: vitest vitest-ecosystem-ci permission-actions: write - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 id: trigger env: COMMENT: ${{ github.event.comment.body }} diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml index 14db69c79..d958231b5 100644 --- a/.github/workflows/issue-close-require.yml +++ b/.github/workflows/issue-close-require.yml @@ -37,7 +37,7 @@ jobs: pull-requests: write # to close pull requests steps: - name: maybe automated PRs - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | const cutoff = new Date(Date.now() - 3 * 24 * 60 * 60 * 1000) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 243c7a985..20f536fec 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -21,7 +21,7 @@ jobs: id-token: write # trusted publishing requirement environment: Release steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -30,7 +30,7 @@ jobs: uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 - name: Set node version to 24 - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: https://registry.npmjs.org/ diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 436ccb28c..069a97844 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -22,7 +22,7 @@ jobs: permissions: security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 339387ce9..18c41e153 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -1,9 +1,4 @@ rules: - unpinned-uses: - config: - policies: - actions/*: ref-pin - github/*: ref-pin concurrency-limits: ignore: # publish workflow doesn't run concurrently and requires a manual approval -- 2.51.2