gavindiaz/wickra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: pin remaining GitHub Actions to commit SHAs (P21.1c) (#100)

Browse Source
This commit is contained in:
kingchenc
2026-06-01 01:07:34 +02:00
committed by GitHub
parent debe4523d5
commit 0fa70c9882
4 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/codeql.yml
+3 -3
View File
@@ -33,15 +33,15 @@ jobs:
build-mode: none build-mode: none
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v4 uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Initialize CodeQL - name: Initialize CodeQL
uses: github/codeql-action/init@v3 uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
with: with:
languages: ${{ matrix.language }} languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }} build-mode: ${{ matrix.build-mode }}
- name: Perform CodeQL analysis - name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v3 uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
with: with:
category: "/language:${{ matrix.language }}" category: "/language:${{ matrix.language }}"
.github/workflows/scorecard.yml
+4 -4
View File
@@ -24,12 +24,12 @@ jobs:
id-token: write # OIDC token to publish results to the OpenSSF API id-token: write # OIDC token to publish results to the OpenSSF API
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with: with:
persist-credentials: false persist-credentials: false
- name: Run Scorecard analysis - name: Run Scorecard analysis
uses: ossf/scorecard-action@v2.4.3 uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with: with:
results_file: results.sarif results_file: results.sarif
results_format: sarif results_format: sarif
@@ -37,13 +37,13 @@ jobs:
publish_results: true publish_results: true
- name: Upload SARIF artifact - name: Upload SARIF artifact
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: SARIF file name: SARIF file
path: results.sarif path: results.sarif
retention-days: 5 retention-days: 5
- name: Upload SARIF to code-scanning - name: Upload SARIF to code-scanning
uses: github/codeql-action/upload-sarif@v3 uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
with: with:
sarif_file: results.sarif sarif_file: results.sarif
.github/workflows/sync-about.yml
+1 -1
View File
@@ -101,7 +101,7 @@ jobs:
# any fix-up commit we make goes onto the PR branch itself. On # any fix-up commit we make goes onto the PR branch itself. On
# push events we check out the default ref. fetch-depth: 0 lets # push events we check out the default ref. fetch-depth: 0 lets
# us push back without "shallow update not allowed". # us push back without "shallow update not allowed".
- uses: actions/checkout@v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
fetch-depth: 0 fetch-depth: 0
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }} ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }}
.github/workflows/sync-metadata.yml
+2 -2
View File
@@ -14,8 +14,8 @@ jobs:
name: metadata audit name: metadata audit
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@v5 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with: with:
python-version: "3.12" python-version: "3.12"
- name: Audit repo-metadata.toml drift - name: Audit repo-metadata.toml drift