ci: pin hashes to Actions

Fixes #1017
quick-lint · Jun 27, 2023 · a6d54f5 · a6d54f5
1 parent 6090384
commit a6d54f5
Show file tree

Hide file tree

Showing 20 changed files with 93 additions and 93 deletions.
diff --git a/.github/workflows/arch-linux-package.yml b/.github/workflows/arch-linux-package.yml
@@ -26,7 +26,7 @@ jobs:
         run: git config --global --add safe.directory /__w/quick-lint-js/quick-lint-js
 
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           fetch-depth: 0  # Needed to determine package version.
 
@@ -58,14 +58,14 @@ jobs:
         run: ./dist/arch/lint.sh
 
       - name: upload build to workflow
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           if-no-files-found: error
           name: quick-lint-js-arch-${{ github.sha }}
           path: dist/arch/quick-lint-js-*.pkg.tar.zst
       - name: upload build to long-term storage
         if: ${{ github.event_name == 'push' && github.repository_owner == 'quick-lint' != null }}
-        uses: quick-lint/sftp-upload@v3
+        uses: quick-lint/sftp-upload@1fa54164d4bdd081207a6e54ec143d8dda3a7fb8 # v3
         with:
           host: ${{ secrets.artifacts_host }}
           local-file-globs: dist/arch/quick-lint-js-*.pkg.tar.zst
@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     container: archlinux:base
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: quick-lint-js-arch-${{ github.sha }}
 

diff --git a/.github/workflows/build-and-test-dev-env-nix.yml b/.github/workflows/build-and-test-dev-env-nix.yml
@@ -14,10 +14,10 @@ jobs:
     # TODO(strager): Use a stable Docker image.
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
       - name: install nix
-        uses: quick-lint/install-nix-action@v20
+        uses: quick-lint/install-nix-action@29bd9290ef037a3ecbdafe83cbd2185e9dd0fa0a # v20
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
 

diff --git a/.github/workflows/build-and-test-dev.yml b/.github/workflows/build-and-test-dev.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
       - name: 0. Install build dependencies
         run: ${{ matrix.toolchain.install_dependencies_script }}

diff --git a/.github/workflows/build-and-test-plugin-vscode.yml b/.github/workflows/build-and-test-plugin-vscode.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
       - name: update $PATH
         if: ${{ matrix.os.msys2_packages }}
@@ -76,7 +76,7 @@ jobs:
         run: cmake --install build --component vscode-node --prefix plugin/vscode --strip
 
       - name: upload build to workflow
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           if-no-files-found: error
           name: vscode-dist-${{ matrix.os.platform_arch }}
@@ -104,25 +104,25 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-linux-x64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-darwin-arm64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-darwin-x64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-win32-ia32
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-win32-x64
           path: ./plugin/vscode/dist/
@@ -160,41 +160,41 @@ jobs:
       QLJS_COLLECT_COPYRIGHT_NO_WARNINGS: 1
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-linux-x64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-linux-arm
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-linux-arm64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-darwin-arm64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-darwin-x64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-win32-ia32
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-win32-x64
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-win32-arm
           path: ./plugin/vscode/dist/
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: vscode-dist-win32-arm64
           path: ./plugin/vscode/dist/
@@ -205,14 +205,14 @@ jobs:
         run: cd plugin/vscode && ./node_modules/.bin/vsce package --baseImagesUrl https://raw.githubusercontent.com/quick-lint/quick-lint-js/master/plugin/vscode/
 
       - name: upload build to workflow
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           if-no-files-found: error
           name: plugin-vscode-${{ github.sha }}
           path: plugin/vscode/*.vsix
       - name: upload build to long-term storage
         if: ${{ github.event_name == 'push' && github.repository_owner == 'quick-lint' != null }}
-        uses: quick-lint/sftp-upload@v3
+        uses: quick-lint/sftp-upload@1fa54164d4bdd081207a6e54ec143d8dda3a7fb8 # v3
         with:
           host: ${{ secrets.artifacts_host }}
           local-file-globs: plugin/vscode/*.vsix

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
       - name: install dependencies (Homebrew)
         if: ${{ matrix.toolchain.homebrew_packages }}