Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit57a65c1

Browse files
authored
chore: use commit sha for GitHub actions (#15019)
Use specific commit SHAs for GitHub actions across various workflows toenhance reliability and reproducibility. This change ensures thatactions run against a known version, reducing the risk of unexpectedissues due to updates in the third-party action repositories.This contributes to improving the score in#14879
1 parent208ed1e commit57a65c1

19 files changed

+106
-105
lines changed

‎.github/actions/setup-go/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ runs:
99
using:"composite"
1010
steps:
1111
-name:Setup Go
12-
uses:actions/setup-go@v5
12+
uses:actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32# v5.0.2
1313
with:
1414
go-version:${{ inputs.version }}
1515

‎.github/actions/setup-node/action.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,16 @@ runs:
1111
using:"composite"
1212
steps:
1313
-name:Install pnpm
14-
uses:pnpm/action-setup@v3
15-
with:
16-
version:9.6
14+
uses:pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2# v4.0.0
15+
1716
-name:Setup Node
18-
uses:actions/setup-node@v4.0.3
17+
uses:actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6#v4.0.4
1918
with:
2019
node-version:20.16.0
2120
# See https://github.com/actions/setup-node#caching-global-packages-data
2221
cache:"pnpm"
2322
cache-dependency-path:${{ inputs.directory }}/pnpm-lock.yaml
23+
2424
-name:Install root node_modules
2525
shell:bash
2626
run:./scripts/pnpm_install.sh

‎.github/actions/setup-sqlc/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ runs:
55
using:"composite"
66
steps:
77
-name:Setup sqlc
8-
uses:sqlc-dev/setup-sqlc@v4
8+
uses:sqlc-dev/setup-sqlc@c0209b9199cd1cce6a14fc27cabcec491b651761# v4.0.0
99
with:
1010
sqlc-version:"1.25.0"

‎.github/actions/setup-tf/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ runs:
55
using:"composite"
66
steps:
77
-name:Install Terraform
8-
uses:hashicorp/setup-terraform@v3
8+
uses:hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd# v3.1.2
99
with:
1010
terraform_version:1.9.2
1111
terraform_wrapper:false

‎.github/actions/upload-datadog/action.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
name:Upload tests to datadog
2-
if:always()
2+
description:|
3+
Uploads the test results to datadog.
34
inputs:
45
api-key:
56
description:"Datadog API key"

‎.github/workflows/ci.yaml

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,12 @@ jobs:
4343
tailnet-integration:${{ steps.filter.outputs.tailnet-integration }}
4444
steps:
4545
-name:Checkout
46-
uses:actions/checkout@v4
46+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
4747
with:
4848
fetch-depth:1
4949
# For pull requests it's not necessary to checkout the code
5050
-name:check changed files
51-
uses:dorny/paths-filter@v3
51+
uses:dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36# v3.0.2
5252
id:filter
5353
with:
5454
filters:|
@@ -125,7 +125,7 @@ jobs:
125125
# runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
126126
# steps:
127127
# - name: Checkout
128-
# uses: actions/checkout@v4
128+
# uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
129129
# with:
130130
# fetch-depth: 1
131131
# # See: https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
@@ -138,7 +138,7 @@ jobs:
138138
# run: ./scripts/update-flake.sh
139139

140140
# # auto update flake for dependabot
141-
# - uses: stefanzweifel/git-auto-commit-action@v5
141+
# - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
142142
# if: github.actor == 'dependabot[bot]'
143143
# with:
144144
# # Allows dependabot to still rebase!
@@ -158,7 +158,7 @@ jobs:
158158
runs-on:${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
159159
steps:
160160
-name:Checkout
161-
uses:actions/checkout@v4
161+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
162162
with:
163163
fetch-depth:1
164164

@@ -176,7 +176,7 @@ jobs:
176176
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
177177
178178
-name:golangci-lint cache
179-
uses:actions/cache@v4
179+
uses:actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2# v4.1.0
180180
with:
181181
path:|
182182
${{ env.LINT_CACHE_DIR }}
@@ -186,7 +186,7 @@ jobs:
186186
187187
# Check for any typos
188188
-name:Check for typos
189-
uses:crate-ci/typos@v1.26.0
189+
uses:crate-ci/typos@6802cc60d4e7f78b9d5454f6cf3935c042d5e1e3#v1.26.0
190190
with:
191191
config:.github/workflows/typos.toml
192192

@@ -199,7 +199,7 @@ jobs:
199199
200200
# Needed for helm chart linting
201201
-name:Install helm
202-
uses:azure/setup-helm@v4
202+
uses:azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814# v4.2.0
203203
with:
204204
version:v3.9.2
205205

@@ -220,7 +220,7 @@ jobs:
220220
if:needs.changes.outputs.docs-only == 'false' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
221221
steps:
222222
-name:Checkout
223-
uses:actions/checkout@v4
223+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
224224
with:
225225
fetch-depth:1
226226

@@ -269,7 +269,7 @@ jobs:
269269
timeout-minutes:7
270270
steps:
271271
-name:Checkout
272-
uses:actions/checkout@v4
272+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
273273
with:
274274
fetch-depth:1
275275

@@ -305,7 +305,7 @@ jobs:
305305
-windows-2022
306306
steps:
307307
-name:Checkout
308-
uses:actions/checkout@v4
308+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
309309
with:
310310
fetch-depth:1
311311

@@ -359,7 +359,7 @@ jobs:
359359
timeout-minutes:25
360360
steps:
361361
-name:Checkout
362-
uses:actions/checkout@v4
362+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
363363
with:
364364
fetch-depth:1
365365

@@ -399,7 +399,7 @@ jobs:
399399
timeout-minutes:25
400400
steps:
401401
-name:Checkout
402-
uses:actions/checkout@v4
402+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
403403
with:
404404
fetch-depth:1
405405

@@ -431,7 +431,7 @@ jobs:
431431
timeout-minutes:25
432432
steps:
433433
-name:Checkout
434-
uses:actions/checkout@v4
434+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
435435
with:
436436
fetch-depth:1
437437

@@ -467,7 +467,7 @@ jobs:
467467
timeout-minutes:20
468468
steps:
469469
-name:Checkout
470-
uses:actions/checkout@v4
470+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
471471
with:
472472
fetch-depth:1
473473

@@ -488,7 +488,7 @@ jobs:
488488
timeout-minutes:20
489489
steps:
490490
-name:Checkout
491-
uses:actions/checkout@v4
491+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
492492
with:
493493
fetch-depth:1
494494

@@ -515,7 +515,7 @@ jobs:
515515
name:${{ matrix.variant.name }}
516516
steps:
517517
-name:Checkout
518-
uses:actions/checkout@v4
518+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
519519
with:
520520
fetch-depth:1
521521

@@ -556,15 +556,15 @@ jobs:
556556

557557
-name:Upload Playwright Failed Tests
558558
if:always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
559-
uses:actions/upload-artifact@v4
559+
uses:actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9# v4.4.1
560560
with:
561561
name:failed-test-videos${{ matrix.variant.enterprise && '-enterprise' || '-agpl' }}
562562
path:./site/test-results/**/*.webm
563563
retention-days:7
564564

565565
-name:Upload pprof dumps
566566
if:always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
567-
uses:actions/upload-artifact@v4
567+
uses:actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9# v4.4.1
568568
with:
569569
name:debug-pprof-dumps${{ matrix.variant.enterprise && '-enterprise' || '-agpl' }}
570570
path:./site/test-results/**/debug-pprof-*.txt
@@ -577,7 +577,7 @@ jobs:
577577
if:needs.changes.outputs.ts == 'true' || needs.changes.outputs.ci == 'true'
578578
steps:
579579
-name:Checkout
580-
uses:actions/checkout@v4
580+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
581581
with:
582582
# Required by Chromatic for build-over-build history, otherwise we
583583
# only get 1 commit on shallow checkout.
@@ -591,7 +591,7 @@ jobs:
591591
# the check to pass. This is desired in PRs, but not in mainline.
592592
-name:Publish to Chromatic (non-mainline)
593593
if:github.ref != 'refs/heads/main' && github.repository_owner == 'coder'
594-
uses:chromaui/action@v10
594+
uses:chromaui/action@30b6228aa809059d46219e0f556752e8672a7e26# v11.11.0
595595
env:
596596
NODE_OPTIONS:"--max_old_space_size=4096"
597597
STORYBOOK:true
@@ -622,7 +622,7 @@ jobs:
622622
# infinitely "in progress" in mainline unless we re-review each build.
623623
-name:Publish to Chromatic (mainline)
624624
if:github.ref == 'refs/heads/main' && github.repository_owner == 'coder'
625-
uses:chromaui/action@v10
625+
uses:chromaui/action@30b6228aa809059d46219e0f556752e8672a7e26# v11.11.0
626626
env:
627627
NODE_OPTIONS:"--max_old_space_size=4096"
628628
STORYBOOK:true
@@ -649,7 +649,7 @@ jobs:
649649

650650
steps:
651651
-name:Checkout
652-
uses:actions/checkout@v4
652+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
653653
with:
654654
# 0 is required here for version.sh to work.
655655
fetch-depth:0
@@ -750,12 +750,12 @@ jobs:
750750
IMAGE:ghcr.io/coder/coder-preview:${{ steps.build-docker.outputs.tag }}
751751
steps:
752752
-name:Checkout
753-
uses:actions/checkout@v4
753+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
754754
with:
755755
fetch-depth:0
756756

757757
-name:GHCR Login
758-
uses:docker/login-action@v3
758+
uses:docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567# v3.3.0
759759
with:
760760
registry:ghcr.io
761761
username:${{ github.actor }}
@@ -830,7 +830,7 @@ jobs:
830830
831831
-name:Prune old images
832832
if:github.ref == 'refs/heads/main'
833-
uses:vlaurin/action-ghcr-prune@v0.6.0
833+
uses:vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641#v0.6.0
834834
with:
835835
token:${{ secrets.GITHUB_TOKEN }}
836836
organization:coder
@@ -845,7 +845,7 @@ jobs:
845845

846846
-name:Upload build artifacts
847847
if:github.ref == 'refs/heads/main'
848-
uses:actions/upload-artifact@v4
848+
uses:actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9# v4.4.1
849849
with:
850850
name:coder
851851
path:|
@@ -869,27 +869,27 @@ jobs:
869869
id-token:write
870870
steps:
871871
-name:Checkout
872-
uses:actions/checkout@v4
872+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
873873
with:
874874
fetch-depth:0
875875

876876
-name:Authenticate to Google Cloud
877-
uses:google-github-actions/auth@v2
877+
uses:google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70# v2.1.6
878878
with:
879879
workload_identity_provider:projects/573722524737/locations/global/workloadIdentityPools/github/providers/github
880880
service_account:coder-ci@coder-dogfood.iam.gserviceaccount.com
881881

882882
-name:Set up Google Cloud SDK
883-
uses:google-github-actions/setup-gcloud@v2
883+
uses:google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7# v2.1.1
884884

885885
-name:Set up Flux CLI
886-
uses:fluxcd/flux2/action@main
886+
uses:fluxcd/flux2/action@9b3958825a314eb79495c6993ef397ddbf87f32f# v2.2.1
887887
with:
888-
# Keep this up to date with the version of flux installed in dogfood cluster
888+
# Keep thisand the github actionup to date with the version of flux installed in dogfood cluster
889889
version:"2.2.1"
890890

891891
-name:Get Cluster Credentials
892-
uses:"google-github-actions/get-gke-credentials@v2"
892+
uses:google-github-actions/get-gke-credentials@6051de21ad50fbb1767bc93c11357a49082ad116# v2.2.1
893893
with:
894894
cluster_name:dogfood-v2
895895
location:us-central1-a
@@ -926,12 +926,12 @@ jobs:
926926
if:github.ref == 'refs/heads/main' && !github.event.pull_request.head.repo.fork
927927
steps:
928928
-name:Checkout
929-
uses:actions/checkout@v4
929+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
930930
with:
931931
fetch-depth:0
932932

933933
-name:Setup flyctl
934-
uses:superfly/flyctl-actions/setup-flyctl@master
934+
uses:superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be# v1.5
935935

936936
-name:Deploy workspace proxies
937937
run:|
@@ -956,7 +956,7 @@ jobs:
956956
if:needs.changes.outputs.db == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
957957
steps:
958958
-name:Checkout
959-
uses:actions/checkout@v4
959+
uses:actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871# v4.2.1
960960
with:
961961
fetch-depth:1
962962
# We need golang to run the migration main.go

‎.github/workflows/contrib.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ jobs:
2828
pull-requests:write
2929
steps:
3030
-name:auto-approve dependabot
31-
uses:hmarr/auto-approve-action@v4
31+
uses:hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363# v4.0.0
3232
if:github.actor == 'dependabot[bot]'
3333

3434
cla:
3535
runs-on:ubuntu-latest
3636
steps:
3737
-name:cla
3838
if:(github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
39-
uses:contributor-assistant/github-action@v2.6.1
39+
uses:contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08#v2.6.1
4040
env:
4141
GITHUB_TOKEN:${{ secrets.GITHUB_TOKEN }}
4242
# the below token should have repo scope and must be manually added by you in the repository's secret
@@ -57,7 +57,7 @@ jobs:
5757
if:${{ github.event_name == 'pull_request_target' && !github.event.pull_request.draft }}
5858
steps:
5959
-name:release-labels
60-
uses:actions/github-script@v7
60+
uses:actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea# v7.0.1
6161
with:
6262
# This script ensures PR title and labels are in sync:
6363
#

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp