From 8587fcdd7fafb8a518064b2de39caae7f3fc648f Mon Sep 17 00:00:00 2001 From: JL Mitra Date: Wed, 1 Apr 2026 15:12:20 -0700 Subject: [PATCH] SECENG-7706 [security] Pin versions of GitHub Actions to full commit hash This PR pins versions of GitHub Actions to full commit hash via automated scripts. In general, this PR doesn't change the behavior of the workflows, so you can merge this safely. This pull request was created by [multi-gitter](https://github.com/lindell/multi-gitter). Please merge this pull request by 2026-04-10. For any questions, please ask in the Slack channel #help-security. --- .github/workflows/build.yml | 6 +++--- .github/workflows/jira-issue-create.yml | 4 ++-- .github/workflows/lint.yml | 4 ++-- .github/workflows/perf-test.yml | 4 ++-- .github/workflows/release.yaml | 16 ++++++++-------- .github/workflows/test.yml | 6 +++--- 6 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ae3e64d..84eb826 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,16 +11,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Set up Java 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: distribution: 'zulu' java-version: '17' - name: Cache Gradle Dependencies - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 with: path: | ~/.gradle/caches diff --git a/.github/workflows/jira-issue-create.yml b/.github/workflows/jira-issue-create.yml index 103e302..db3e6df 100644 --- a/.github/workflows/jira-issue-create.yml +++ b/.github/workflows/jira-issue-create.yml @@ -12,7 +12,7 @@ jobs: name: SDK Bot Jira Issue Creation steps: - name: Login - uses: atlassian/gajira-login@master + uses: atlassian/gajira-login@ca13f8850ea309cf44a6e4e0c49d9aa48ac3ca4c # v3 env: JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }} JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }} @@ -20,7 +20,7 @@ jobs: - name: Create issue id: create - uses: atlassian/gajira-create@master + uses: atlassian/gajira-create@1ff0b6bd115a780592b47bfbb63fc4629132e6ec # v3 with: project: ${{ secrets.JIRA_PROJECT }} issuetype: Task diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 6d75335..24d6f71 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Set up Java 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: distribution: 'zulu' java-version: '11' diff --git a/.github/workflows/perf-test.yml b/.github/workflows/perf-test.yml index bc10675..1aee585 100644 --- a/.github/workflows/perf-test.yml +++ b/.github/workflows/perf-test.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 @@ -31,7 +31,7 @@ jobs: - name: Generate GitHub App token id: generate-token - uses: peter-murray/workflow-application-token-action@v2 + uses: peter-murray/workflow-application-token-action@8e1ba3bf1619726336414f1014e37f17fbadf1db # v2 with: application_id: ${{ secrets.EVALUATION_PROXY_INTEGRATION_APP_ID }} application_private_key: ${{ secrets.EVALUATION_PROXY_INTEGRATION_KEY }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 0963e47..942ddd9 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -17,10 +17,10 @@ jobs: # SETUP & VALIDATION - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Set up Java 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: distribution: 'zulu' java-version: '17' @@ -28,7 +28,7 @@ jobs: - name: Validate Release Version if: ${{ startsWith(github.event.inputs.version, 'v') }} - uses: actions/github-script@v3 + uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3 with: script: | core.setFailed('Version ${{ github.event.inputs.version }} must not start with \'v\'. Use a non-prefixed semantic version, e.g. 1.2.3') @@ -48,14 +48,14 @@ jobs: # SET VERSIONS - name: Set Version (Gradle) - uses: jacobtomlinson/gha-find-replace@v2 + uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2 with: find: 'version = ".*"' replace: 'version = "${{ github.event.inputs.version }}"' include: 'core/build.gradle.kts' regex: true - name: Set Version (Const) - uses: jacobtomlinson/gha-find-replace@v2 + uses: jacobtomlinson/gha-find-replace@f485fdc3f67a6d87ae6e3d11e41f648c26d7aee3 # v2 with: find: 'const val EVALUATION_PROXY_VERSION = ".*"' replace: 'const val EVALUATION_PROXY_VERSION = "${{ github.event.inputs.version }}"' @@ -77,7 +77,7 @@ jobs: # RELEASE DOCKER IMAGE - name: Login to DockerHub - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -88,13 +88,13 @@ jobs: - name: Docker Metadata id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4 with: tags: type=semver,pattern={{version}},value=v${{ github.event.inputs.version }} images: ${{ secrets.DOCKERHUB_USERNAME }}/evaluation-proxy - name: Docker Build and Push - uses: docker/build-push-action@v3 + uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3 with: context: . push: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 70b3ce1..4fde128 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,16 +11,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Set up Java 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: distribution: 'zulu' java-version: '17' - name: Cache Gradle Dependencies - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 with: path: | ~/.gradle/caches