From 20db4cbb27140051e938b330c7ca992959ba0a69 Mon Sep 17 00:00:00 2001 From: Nicolas Charpentier Date: Fri, 12 Jun 2026 17:44:12 -0400 Subject: [PATCH] chore: pin GitHub Actions to SHAs (#1625) --- .github/workflows/bot-help.yml | 2 +- .github/workflows/bot-summarize.yml | 4 +- .github/workflows/build-macos-arm64-dmg.yml | 8 ++-- .github/workflows/docs-source.yml | 8 ++-- .github/workflows/oc-integration.yml | 6 +-- .github/workflows/oc-review.yml | 6 +-- .github/workflows/opencode.yml | 6 +-- .github/workflows/pr-review.yml | 4 +- .github/workflows/release-desktop-smoke.yml | 16 ++++---- .github/workflows/release.yml | 42 ++++++++++----------- .github/workflows/reproduce-issue.yml | 6 +-- .github/workflows/stale.yml | 4 +- .github/workflows/triage.yml | 4 +- .github/workflows/vscode-extension.yml | 10 ++--- 14 files changed, 63 insertions(+), 63 deletions(-) diff --git a/.github/workflows/bot-help.yml b/.github/workflows/bot-help.yml index 04c49fb7..ac80d1ec 100644 --- a/.github/workflows/bot-help.yml +++ b/.github/workflows/bot-help.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} diff --git a/.github/workflows/bot-summarize.yml b/.github/workflows/bot-summarize.yml index 40e7c02d..8bdb37d3 100644 --- a/.github/workflows/bot-summarize.yml +++ b/.github/workflows/bot-summarize.yml @@ -18,13 +18,13 @@ jobs: pull-requests: read steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 1 - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} diff --git a/.github/workflows/build-macos-arm64-dmg.yml b/.github/workflows/build-macos-arm64-dmg.yml index 1513b5eb..c819b9c9 100644 --- a/.github/workflows/build-macos-arm64-dmg.yml +++ b/.github/workflows/build-macos-arm64-dmg.yml @@ -22,15 +22,15 @@ jobs: runs-on: ${{ inputs.macos_version }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ inputs.ref || github.ref }} - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "20" @@ -87,7 +87,7 @@ jobs: fi - name: Upload DMG artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dmg-electron-${{ inputs.macos_version }}-arm64 path: artifacts/*.dmg diff --git a/.github/workflows/docs-source.yml b/.github/workflows/docs-source.yml index 1f83a805..94547602 100644 --- a/.github/workflows/docs-source.yml +++ b/.github/workflows/docs-source.yml @@ -26,10 +26,10 @@ jobs: archive_name: ${{ steps.archive.outputs.archive_name }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Validate docs source run: bun run docs:validate @@ -43,7 +43,7 @@ jobs: echo "archive_name=${ARCHIVE_NAME}" >> "$GITHUB_OUTPUT" - name: Upload workflow artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: docs-source path: artifacts/${{ steps.archive.outputs.archive_name }} @@ -51,7 +51,7 @@ jobs: - name: Upload archive to release tag if: ${{ github.event_name == 'release' || github.event.inputs.release_tag != '' }} - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: ${{ github.event_name == 'release' && github.event.release.tag_name || github.event.inputs.release_tag }} files: artifacts/${{ steps.archive.outputs.archive_name }} diff --git a/.github/workflows/oc-integration.yml b/.github/workflows/oc-integration.yml index 8a71c9ed..b28ad927 100644 --- a/.github/workflows/oc-integration.yml +++ b/.github/workflows/oc-integration.yml @@ -24,18 +24,18 @@ jobs: steps: - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Run opencode - uses: anomalyco/opencode/github@latest + uses: anomalyco/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # github-v1.2.19 env: GH_TOKEN: ${{ steps.app-token.outputs.token }} GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/oc-review.yml b/.github/workflows/oc-review.yml index 40e7f16a..65e49094 100644 --- a/.github/workflows/oc-review.yml +++ b/.github/workflows/oc-review.yml @@ -10,13 +10,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml index a11db874..7f8c104b 100644 --- a/.github/workflows/opencode.yml +++ b/.github/workflows/opencode.yml @@ -24,18 +24,18 @@ jobs: steps: - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Run opencode - uses: anomalyco/opencode/github@latest + uses: anomalyco/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # github-v1.2.19 env: GH_TOKEN: ${{ steps.app-token.outputs.token }} GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index 14e45609..415e5da0 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -28,13 +28,13 @@ jobs: issues: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 1 - name: Generate review app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release-desktop-smoke.yml b/.github/workflows/release-desktop-smoke.yml index 7e36e87e..022292a6 100644 --- a/.github/workflows/release-desktop-smoke.yml +++ b/.github/workflows/release-desktop-smoke.yml @@ -54,16 +54,16 @@ jobs: platform: darwin-x86_64 steps: - name: Checkout selected ref - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: repository: ${{ inputs.repository || github.repository }} ref: ${{ inputs.ref || github.ref }} - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' @@ -151,7 +151,7 @@ jobs: done - name: Upload macOS installable artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: desktop-release-smoke-macos-${{ matrix.arch }} path: | @@ -175,16 +175,16 @@ jobs: platform: win32-x64 steps: - name: Checkout selected ref - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: repository: ${{ inputs.repository || github.repository }} ref: ${{ inputs.ref || github.ref }} - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' @@ -213,7 +213,7 @@ jobs: run: node ./scripts/package.mjs --win --${{ matrix.arch }} --publish=never - name: Upload Windows installable artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: desktop-release-smoke-windows-${{ matrix.arch }} path: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 735b2109..a0a120f5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: release_upload_url: ${{ steps.create_release.outputs.upload_url }} version: ${{ steps.get_version.outputs.version }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Get version id: get_version @@ -68,7 +68,7 @@ jobs: - name: Create GitHub Release id: create_release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: v${{ steps.get_version.outputs.version }} draft: true @@ -82,13 +82,13 @@ jobs: needs: create-release runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' registry-url: 'https://registry.npmjs.org' @@ -105,7 +105,7 @@ jobs: - name: Upload npm tarball to release if: ${{ github.event.inputs.dry_run != 'true' }} - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: v${{ needs.create-release.outputs.version }} files: packages/web/*.tgz @@ -133,13 +133,13 @@ jobs: arch: x64 platform: darwin-x86_64 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' @@ -232,7 +232,7 @@ jobs: done - name: Upload DMG / ZIP / blockmaps to release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: v${{ needs.create-release.outputs.version }} files: | @@ -243,7 +243,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload per-arch latest-mac.yml for merge - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: latest-yml-${{ matrix.target }} path: packages/electron/dist/latest-mac.yml @@ -260,13 +260,13 @@ jobs: target: x86_64-pc-windows-msvc platform: win32-x64 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' @@ -295,7 +295,7 @@ jobs: run: node ./scripts/package.mjs --win --${{ matrix.arch }} --publish=never - name: Upload installer to release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: v${{ needs.create-release.outputs.version }} files: | @@ -306,7 +306,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload update manifest as artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: latest-yml-${{ matrix.target }} path: packages/electron/dist/latest.yml @@ -316,15 +316,15 @@ jobs: needs: [create-release, build-desktop-electron-macos] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' - name: Download per-arch latest-mac.yml - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: pattern: latest-yml-*-apple-darwin path: artifacts @@ -337,7 +337,7 @@ jobs: run: node packages/electron/scripts/finalize-latest-yml.mjs - name: Upload combined manifests to release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: v${{ needs.create-release.outputs.version }} files: | @@ -353,7 +353,7 @@ jobs: DISCORD_UPDATE_ROLE_ID: ${{ secrets.DISCORD_UPDATE_ROLE_ID }} steps: - name: Publish release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: v${{ needs.create-release.outputs.version }} draft: false diff --git a/.github/workflows/reproduce-issue.yml b/.github/workflows/reproduce-issue.yml index cb8dbe6e..e8bad737 100644 --- a/.github/workflows/reproduce-issue.yml +++ b/.github/workflows/reproduce-issue.yml @@ -21,19 +21,19 @@ jobs: steps: - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 1 token: ${{ steps.app-token.outputs.token }} - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Install dependencies run: bun install --frozen-lockfile diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index a0082c05..10be193a 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -15,12 +15,12 @@ jobs: steps: - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} - - uses: actions/stale@v10 + - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 with: repo-token: ${{ steps.app-token.outputs.token }} days-before-stale: 60 diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index 8a4a6f60..93adb4ac 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -21,13 +21,13 @@ jobs: issues: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 1 - name: Generate bot app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.OC_REVIEW_APP_ID }} private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }} diff --git a/.github/workflows/vscode-extension.yml b/.github/workflows/vscode-extension.yml index 56798c32..566549c1 100644 --- a/.github/workflows/vscode-extension.yml +++ b/.github/workflows/vscode-extension.yml @@ -17,13 +17,13 @@ jobs: OVSX_PAT: ${{ secrets.OVSX_PAT }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Setup bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' @@ -45,14 +45,14 @@ jobs: run: bunx ovsx publish packages/vscode/*.vsix -p "$OVSX_PAT" - name: Upload VSIX artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: openchamber-vscode-vsix path: packages/vscode/*.vsix - name: Attach VSIX to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: files: packages/vscode/*.vsix generate_release_notes: false