gavindiaz/wickra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

D1: pin all GitHub Actions to commit SHAs

Browse Source 
Every action in ci.yml and release.yml was pinned to a movable tag
(actions/checkout@v4, dtolnay/rust-toolchain@stable, ...). A compromised
upstream tag would run with access to the crates.io / PyPI / npm
publish tokens.

Pin every `uses:` to the full 40-character commit SHA the referenced
ref currently resolves to, with the human-readable version kept as a
trailing comment so Dependabot can still bump them:

  actions/checkout            v4.3.1
  actions/setup-python        v5.6.0
  actions/setup-node          v4.4.0
  actions/upload-artifact     v4.6.2
  actions/download-artifact   v4.3.0
  dtolnay/rust-toolchain      stable branch @ 2026-03-27
  Swatinem/rust-cache         v2
  jetli/wasm-pack-action      v0.4.0
  PyO3/maturin-action         v1.51.0
  softprops/action-gh-release v2.6.2

SHAs were resolved against the GitHub API. The github-actions Dependabot
ecosystem that keeps these pins current is added with E3.
This commit is contained in:
kingchenc
2026-05-22 12:35:02 +02:00
parent 0d451ac584
commit 9b11d73273
2 changed files with 50 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+20 -20
View File
@@ -19,15 +19,15 @@ jobs:
matrix: matrix:
os: [ubuntu-latest, macos-latest, windows-latest] os: [ubuntu-latest, macos-latest, windows-latest]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install Rust toolchain - name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
with: with:
components: rustfmt, clippy components: rustfmt, clippy
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Format check - name: Format check
run: cargo fmt --all -- --check run: cargo fmt --all -- --check
@@ -61,16 +61,16 @@ jobs:
os: [ubuntu-latest, macos-latest, windows-latest] os: [ubuntu-latest, macos-latest, windows-latest]
python-version: ["3.9", "3.11", "3.12"] python-version: ["3.9", "3.11", "3.12"]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install Rust toolchain - name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Set up Python - name: Set up Python
uses: actions/setup-python@v5 uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with: with:
python-version: ${{ matrix.python-version }} python-version: ${{ matrix.python-version }}
@@ -96,18 +96,18 @@ jobs:
name: WASM build name: WASM build
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install Rust toolchain (with wasm target) - name: Install Rust toolchain (with wasm target)
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
with: with:
targets: wasm32-unknown-unknown targets: wasm32-unknown-unknown
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Install wasm-pack - name: Install wasm-pack
uses: jetli/wasm-pack-action@v0.4.0 uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa # v0.4.0
- name: Build WASM package - name: Build WASM package
run: wasm-pack build bindings/wasm --target web --release --features panic-hook run: wasm-pack build bindings/wasm --target web --release --features panic-hook
@@ -130,16 +130,16 @@ jobs:
os: [ubuntu-latest, macos-latest, windows-latest] os: [ubuntu-latest, macos-latest, windows-latest]
node-version: ["18", "20"] node-version: ["18", "20"]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install Rust toolchain - name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Set up Node - name: Set up Node
uses: actions/setup-node@v4 uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: ${{ matrix.node-version }} node-version: ${{ matrix.node-version }}
@@ -164,14 +164,14 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
needs: [python] needs: [python]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
- uses: Swatinem/rust-cache@v2 - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Set up Python - name: Set up Python
uses: actions/setup-python@v5 uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with: with:
python-version: "3.11" python-version: "3.11"
@@ -196,7 +196,7 @@ jobs:
| tee benchmark.txt | tee benchmark.txt
- name: Upload report - name: Upload report
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: cross-library-bench name: cross-library-bench
path: bindings/python/benchmark.txt path: bindings/python/benchmark.txt
.github/workflows/release.yml
+30 -30
View File
@@ -23,9 +23,9 @@ jobs:
# Settings -> Environments. # Settings -> Environments.
environment: release environment: release
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
- uses: Swatinem/rust-cache@v2 - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
# Idempotent publishing: if the version is already on crates.io we # Idempotent publishing: if the version is already on crates.io we
# treat that as success so re-runs of the workflow don't fail. # treat that as success so re-runs of the workflow don't fail.
@@ -74,7 +74,7 @@ jobs:
cargo package -p wickra cargo package -p wickra
- name: Upload .crate files - name: Upload .crate files
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: crate-files name: crate-files
path: target/package/*.crate path: target/package/*.crate
@@ -95,17 +95,17 @@ jobs:
- { os: windows-latest, target: x64, manylinux: auto } - { os: windows-latest, target: x64, manylinux: auto }
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/setup-python@v5 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with: with:
python-version: "3.11" python-version: "3.11"
- uses: PyO3/maturin-action@v1 - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with: with:
working-directory: bindings/python working-directory: bindings/python
target: ${{ matrix.target }} target: ${{ matrix.target }}
args: --release --strip --out dist args: --release --strip --out dist
manylinux: ${{ matrix.manylinux }} manylinux: ${{ matrix.manylinux }}
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: wheels-${{ matrix.os }}-${{ matrix.target }} name: wheels-${{ matrix.os }}-${{ matrix.target }}
path: bindings/python/dist/* path: bindings/python/dist/*
@@ -114,13 +114,13 @@ jobs:
name: Build Python sdist name: Build Python sdist
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: PyO3/maturin-action@v1 - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with: with:
working-directory: bindings/python working-directory: bindings/python
command: sdist command: sdist
args: --out dist args: --out dist
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: wheels-sdist name: wheels-sdist
path: bindings/python/dist/* path: bindings/python/dist/*
@@ -131,14 +131,14 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
environment: release environment: release
steps: steps:
- uses: actions/download-artifact@v4 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with: with:
path: dist path: dist
pattern: wheels-* pattern: wheels-*
merge-multiple: true merge-multiple: true
- name: Upload to PyPI - name: Upload to PyPI
uses: PyO3/maturin-action@v1 uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with: with:
command: upload command: upload
args: --skip-existing dist/* args: --skip-existing dist/*
@@ -162,17 +162,17 @@ jobs:
- { host: windows-11-arm, target: aarch64-pc-windows-msvc } - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
runs-on: ${{ matrix.host }} runs-on: ${{ matrix.host }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/setup-node@v4 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: "20" node-version: "20"
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
with: with:
targets: ${{ matrix.target }} targets: ${{ matrix.target }}
- uses: Swatinem/rust-cache@v2 - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Install Node deps - name: Install Node deps
working-directory: bindings/node working-directory: bindings/node
@@ -183,7 +183,7 @@ jobs:
run: npx napi build --platform --release --target ${{ matrix.target }} run: npx napi build --platform --release --target ${{ matrix.target }}
- name: Upload artifact - name: Upload artifact
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: bindings-${{ matrix.target }} name: bindings-${{ matrix.target }}
path: bindings/node/wickra.*.node path: bindings/node/wickra.*.node
@@ -195,9 +195,9 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
environment: release environment: release
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/setup-node@v4 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: "20" node-version: "20"
registry-url: "https://registry.npmjs.org" registry-url: "https://registry.npmjs.org"
@@ -207,7 +207,7 @@ jobs:
run: npm install run: npm install
- name: Download all platform binaries - name: Download all platform binaries
uses: actions/download-artifact@v4 uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with: with:
path: bindings/node/artifacts path: bindings/node/artifacts
pattern: bindings-* pattern: bindings-*
@@ -305,7 +305,7 @@ jobs:
done done
- name: Upload Node tarballs - name: Upload Node tarballs
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: node-tarballs name: node-tarballs
path: | path: |
@@ -320,18 +320,18 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
environment: release environment: release
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/setup-node@v4 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: "20" node-version: "20"
registry-url: "https://registry.npmjs.org" registry-url: "https://registry.npmjs.org"
- uses: dtolnay/rust-toolchain@stable - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
with: with:
targets: wasm32-unknown-unknown targets: wasm32-unknown-unknown
- uses: jetli/wasm-pack-action@v0.4.0 - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa # v0.4.0
- name: Build WASM package (bundler target) - name: Build WASM package (bundler target)
run: wasm-pack build bindings/wasm --target bundler --release --features panic-hook run: wasm-pack build bindings/wasm --target bundler --release --features panic-hook
@@ -355,7 +355,7 @@ jobs:
run: npm pack run: npm pack
- name: Upload WASM tarball - name: Upload WASM tarball
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with: with:
name: wasm-tarball name: wasm-tarball
path: bindings/wasm/pkg/wickra-wasm-*.tgz path: bindings/wasm/pkg/wickra-wasm-*.tgz
@@ -379,7 +379,7 @@ jobs:
permissions: permissions:
contents: write contents: write
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -400,7 +400,7 @@ jobs:
echo "::notice::attaching assets to release $tag" echo "::notice::attaching assets to release $tag"
- name: Download all build artifacts - name: Download all build artifacts
uses: actions/download-artifact@v4 uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with: with:
path: artifacts path: artifacts
@@ -421,7 +421,7 @@ jobs:
echo "asset-count=$(ls release-assets/ | wc -l)" echo "asset-count=$(ls release-assets/ | wc -l)"
- name: Create / update GitHub Release with assets - name: Create / update GitHub Release with assets
uses: softprops/action-gh-release@v2 uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
with: with:
tag_name: ${{ steps.tag.outputs.tag }} tag_name: ${{ steps.tag.outputs.tag }}
name: Wickra ${{ steps.tag.outputs.tag }} name: Wickra ${{ steps.tag.outputs.tag }}