From bf46277e5003df81e7e0ae4ee1bc367b8d1b5712 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 08:56:08 +0000 Subject: [PATCH] Pin dependencies --- .github/workflows/build-macos.yaml | 14 ++--- .github/workflows/cross-platform-check.yml | 6 +- .github/workflows/e2e.yaml | 24 ++++---- .github/workflows/lint.yaml | 10 ++-- .github/workflows/make-binary.yaml | 4 +- .github/workflows/nightly-build-1x.yaml | 24 ++++---- .github/workflows/nightly-build-2x.yaml | 28 ++++----- .github/workflows/posture.yaml | 36 ++++++------ .github/workflows/release-macos.yaml | 20 +++---- .github/workflows/release.yaml | 68 +++++++++++----------- .github/workflows/sbom.yml | 8 +-- .github/workflows/test-web.yml | 8 +-- .github/workflows/test.yml | 6 +- .github/workflows/update-chocolatey.yml | 2 +- .github/workflows/update-pnpm-hash.yaml | 4 +- .github/workflows/update-repositories.yml | 4 +- 16 files changed, 133 insertions(+), 133 deletions(-) diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml index 85e40a237..7e661ddac 100644 --- a/.github/workflows/build-macos.yaml +++ b/.github/workflows/build-macos.yaml @@ -29,7 +29,7 @@ jobs: APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive @@ -43,11 +43,11 @@ jobs: fi - name: Install NodeJS - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false version: 11 @@ -59,7 +59,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} @@ -72,12 +72,12 @@ jobs: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: targets: aarch64-apple-darwin,x86_64-apple-darwin - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install tauri-cli run: cargo install tauri-cli --locked @@ -97,7 +97,7 @@ jobs: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain - name: Build app - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/cross-platform-check.yml b/.github/workflows/cross-platform-check.yml index a23456e6f..79b6dc228 100644 --- a/.github/workflows/cross-platform-check.yml +++ b/.github/workflows/cross-platform-check.yml @@ -45,15 +45,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install protoc if: matrix.os != 'Windows' diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index f49b0076c..ca7464e42 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -18,7 +18,7 @@ jobs: runs-on: [self-hosted, Linux, X64] timeout-minutes: 90 container: - image: ubuntu:24.04 + image: ubuntu:24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac options: --privileged env: DEBIAN_FRONTEND: noninteractive @@ -40,25 +40,25 @@ jobs: librsvg2-dev libssl-dev libudev-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf procps \ protobuf-compiler webkit2gtk-driver xvfb wireguard-tools xclip xdg-utils - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7 with: node-version-file: new-ui/.nvmrc - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - version: 11.11 + version: 11.28 - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Install sccache - uses: mozilla-actions/sccache-action@v0.0.11 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install tauri-driver run: cargo install tauri-driver --locked @@ -117,7 +117,7 @@ jobs: - name: Upload logs if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: e2e-logs path: e2e-logs @@ -128,17 +128,17 @@ jobs: runs-on: - codebuild-defguard-client-runner-${{ github.run_id }}-${{ github.run_attempt }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7 with: node-version-file: new-ui/.nvmrc - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - version: 11.11 + version: 11.28 - name: Install e2e dependencies run: pnpm install --no-frozen-lockfile diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 1216e467a..da36a1fba 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -26,17 +26,17 @@ jobs: - codebuild-defguard-client-runner-${{ github.run_id }}-${{ github.run_attempt }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: - version: 11.11 + version: 11.28 run_install: false - name: Get pnpm store directory @@ -47,7 +47,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> $GITHUB_ENV - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} diff --git a/.github/workflows/make-binary.yaml b/.github/workflows/make-binary.yaml index 4b05bb711..2695eb85e 100644 --- a/.github/workflows/make-binary.yaml +++ b/.github/workflows/make-binary.yaml @@ -30,14 +30,14 @@ jobs: - name: Rename client binary run: mv src-tauri/target/release/${{ inputs.flavor }} ${{ inputs.flavor }}-${{ inputs.system }}-${{ inputs.binary_arch }}-${{ github.ref_name }} - name: Tar client binary - uses: a7ul/tar-action@v1.2.0 + uses: a7ul/tar-action@ed9cbd44fc9276db29ea2fb1f8adf3d7e0691589 # v1.2.0 with: command: c files: | ${{ inputs.flavor }}-${{ inputs.system }}-${{ inputs.binary_arch }}-${{ github.ref_name }} outPath: ${{ inputs.flavor }}-${{ inputs.system }}-${{ inputs.binary_arch }}-${{ github.ref_name }}.tar.gz - name: Upload client archive - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/nightly-build-1x.yaml b/.github/workflows/nightly-build-1x.yaml index 0f9f776da..0567e9bf8 100644 --- a/.github/workflows/nightly-build-1x.yaml +++ b/.github/workflows/nightly-build-1x.yaml @@ -50,18 +50,18 @@ jobs: deb_arch: amd64 binary_arch: x86_64 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: ref: ${{ inputs.branch }} submodules: recursive - name: Install NodeJS - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: 26 - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: cache: true version: 11 @@ -78,10 +78,10 @@ jobs: run: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install Linux dependencies run: | @@ -100,7 +100,7 @@ jobs: echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - name: Build packages - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -135,7 +135,7 @@ jobs: - macOS - native steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: ref: ${{ inputs.branch }} submodules: recursive @@ -150,12 +150,12 @@ jobs: echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - name: Install NodeJS - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: 26 - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: cache: true version: 11 @@ -166,12 +166,12 @@ jobs: run: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: targets: aarch64-apple-darwin,x86_64-apple-darwin - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Set build number run: | @@ -182,7 +182,7 @@ jobs: run: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain - name: Build app - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/nightly-build-2x.yaml b/.github/workflows/nightly-build-2x.yaml index c552dda18..ebba52310 100644 --- a/.github/workflows/nightly-build-2x.yaml +++ b/.github/workflows/nightly-build-2x.yaml @@ -46,18 +46,18 @@ jobs: deb_arch: amd64 binary_arch: x86_64 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ inputs.branch }} submodules: recursive - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: - version: 11.11 + version: 11.28 run_install: false - name: Get pnpm store directory @@ -68,7 +68,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} @@ -81,7 +81,7 @@ jobs: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Install tauri-cli run: cargo install tauri-cli --locked @@ -109,7 +109,7 @@ jobs: pnpm build - name: Build packages - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -140,7 +140,7 @@ jobs: APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ inputs.branch }} submodules: recursive @@ -155,11 +155,11 @@ jobs: echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false version: 11 @@ -171,7 +171,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} @@ -184,12 +184,12 @@ jobs: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: targets: aarch64-apple-darwin,x86_64-apple-darwin - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install tauri-cli run: cargo install tauri-cli --locked @@ -209,7 +209,7 @@ jobs: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain - name: Build app - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/posture.yaml b/.github/workflows/posture.yaml index e50250120..773ea6e94 100644 --- a/.github/workflows/posture.yaml +++ b/.github/workflows/posture.yaml @@ -24,12 +24,12 @@ jobs: runs-on: - codebuild-defguard-posture-linux-runner-${{ github.run_id }}-${{ github.run_attempt }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Install dependencies env: @@ -39,7 +39,7 @@ jobs: apt-get install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libudev-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm cryptsetup-bin util-linux - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Run tests working-directory: src-tauri/ @@ -53,12 +53,12 @@ jobs: - Linux - virtual steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Install dependencies env: @@ -68,7 +68,7 @@ jobs: apt-get install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libudev-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm cryptsetup-bin util-linux - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Run tests working-directory: src-tauri/ @@ -84,15 +84,15 @@ jobs: - noad steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Run tests working-directory: src-tauri/ @@ -109,15 +109,15 @@ jobs: - ad steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Run tests working-directory: src-tauri/ @@ -132,15 +132,15 @@ jobs: - macOS - native steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Run tests working-directory: src-tauri/ @@ -154,15 +154,15 @@ jobs: - macOS - virtual steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Setup sccache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Run tests working-directory: src-tauri/ diff --git a/.github/workflows/release-macos.yaml b/.github/workflows/release-macos.yaml index 735964595..165e1e81a 100644 --- a/.github/workflows/release-macos.yaml +++ b/.github/workflows/release-macos.yaml @@ -27,7 +27,7 @@ jobs: - macOS - native steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive @@ -40,14 +40,14 @@ jobs: echo "DEFGUARD_CLIENT_BUILD_VERSION=${GITHUB_REF_NAME#v}" >> ${GITHUB_ENV} fi - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - version: 11.11 + version: 11.28 - name: Get pnpm store directory run: | @@ -56,7 +56,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} @@ -69,12 +69,12 @@ jobs: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: targets: aarch64-apple-darwin,x86_64-apple-darwin - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install tauri-cli run: cargo install tauri-cli --locked @@ -100,7 +100,7 @@ jobs: security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${KEYCHAIN_PASSWORD}" build.keychain > /dev/null - name: Build app - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} @@ -114,7 +114,7 @@ jobs: - name: Upload DMG if: inputs.upload_url != '' - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -125,7 +125,7 @@ jobs: - name: Upload DMG artifact if: inputs.upload_url == '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: defguard-client-macos-dmg-${{ github.run_number }} path: src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 936c195f1..807190f95 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,7 +15,7 @@ jobs: steps: - name: Create GitHub release id: release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: draft: true generate_release_notes: true @@ -46,7 +46,7 @@ jobs: deb_arch: amd64 binary_arch: x86_64 container: - image: ubuntu:22.04 + image: ubuntu:22.04@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956 env: DEBIAN_FRONTEND: noninteractive HOME: /root @@ -60,18 +60,18 @@ jobs: libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev \ libudev-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm git config --global --add safe.directory '*' - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: - version: 11.11 + version: 11.28 run_install: false - name: Get pnpm store directory @@ -81,7 +81,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} @@ -101,7 +101,7 @@ jobs: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Install tauri-cli run: cargo install tauri-cli --locked @@ -112,7 +112,7 @@ jobs: pnpm build - name: Build packages - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -120,7 +120,7 @@ jobs: args: --ignore-version-mismatches --bundles deb - name: Upload DEB - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -133,13 +133,13 @@ jobs: run: mv src-tauri/target/release/dg dg-linux-${{ env.VERSION }}_${{ matrix.deb_arch }} - name: Build dg deb - uses: defGuard/fpm-action@main + uses: defGuard/fpm-action@ebb2575fbb892876fbdd326bb6d12524fbd7398c # main with: fpm_args: "dg-linux-${{ env.VERSION }}_${{ matrix.deb_arch }}=/usr/sbin/dg dg.service=/usr/lib/systemd/system/dg.service src-tauri/cli/.env=/etc/defguard/dg.conf" fpm_opts: "--architecture ${{ matrix.binary_arch }} --debug --output-type deb --version ${{ env.VERSION }} --package dg-linux-${{ env.VERSION }}_${{ matrix.deb_arch }}_ubuntu-22-04-lts.deb" - name: Upload DEB - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -173,7 +173,7 @@ jobs: deb_arch: amd64 binary_arch: x86_64 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Write release version @@ -188,13 +188,13 @@ jobs: sudo apt-get update sudo apt-get install -y build-essential libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev \ librsvg2-dev patchelf libssl-dev libudev-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: - version: 11.11 + version: 11.28 run_install: false - name: Get pnpm store directory @@ -205,7 +205,7 @@ jobs: echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - name: Restore pnpm store cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ env.STORE_PATH }} key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} @@ -218,10 +218,10 @@ jobs: pnpm install --no-frozen-lockfile - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install tauri-cli run: cargo install tauri-cli --locked @@ -232,7 +232,7 @@ jobs: pnpm build - name: Build packages - uses: tauri-apps/tauri-action@v1 + uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -250,7 +250,7 @@ jobs: echo "deb_sha256_${{ matrix.deb_arch }}=$DEB_SHA256" >> ${GITHUB_OUTPUT} - name: Upload RPM - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -259,7 +259,7 @@ jobs: asset_content_type: application/octet-stream - name: Upload DEB - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -274,7 +274,7 @@ jobs: defguard-client-linux-${{ matrix.binary_arch }}-${{ github.ref_name }} - name: Upload client archive - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -289,7 +289,7 @@ jobs: defguard-service-linux-${{ matrix.binary_arch }}-${{ github.ref_name }} - name: Upload daemon archive - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -304,7 +304,7 @@ jobs: dg-linux-${{ matrix.binary_arch }}-${{ github.ref_name }} - name: Upload dg archive - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -313,13 +313,13 @@ jobs: asset_content_type: application/octet-stream - name: Build dg deb - uses: defGuard/fpm-action@main + uses: defGuard/fpm-action@ebb2575fbb892876fbdd326bb6d12524fbd7398c # main with: fpm_args: "dg-linux-${{ matrix.binary_arch }}-${{ github.ref_name }}=/usr/sbin/dg dg.service=/usr/lib/systemd/system/dg.service src-tauri/cli/.env=/etc/defguard/dg.conf" fpm_opts: "--architecture ${{ matrix.binary_arch }} --debug --output-type deb --version ${{ env.VERSION }} --package dg-linux-${{ matrix.binary_arch }}-${{ github.ref_name }}.deb" - name: Upload DEB - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -328,13 +328,13 @@ jobs: asset_content_type: application/octet-stream - name: Build dg rpm - uses: defGuard/fpm-action@main + uses: defGuard/fpm-action@ebb2575fbb892876fbdd326bb6d12524fbd7398c # main with: fpm_args: "dg-linux-${{ matrix.binary_arch }}-${{ github.ref_name }}=/usr/sbin/dg dg.service=/usr/lib/systemd/system/dg.service src-tauri/cli/.env=/etc/defguard/dg.conf" fpm_opts: "--architecture ${{ matrix.binary_arch }} --debug --output-type rpm --version ${{ env.VERSION }} --package dg-linux-${{ matrix.binary_arch }}-${{ github.ref_name }}.rpm" - name: Upload RPM - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -354,7 +354,7 @@ jobs: - Linux - X64 container: - image: almalinux:9 + image: almalinux:9@sha256:9819dc675b67b595c2b59e42be7763fca1a8bb217fa5944e04daa22e9a64db16 env: HOME: /root RUSTUP_HOME: /root/.rustup @@ -365,7 +365,7 @@ jobs: run: | dnf -y install git gcc gcc-c++ make openssl-devel perl pkgconfig unzip git config --global --add safe.directory '*' - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Write release version @@ -381,18 +381,18 @@ jobs: unzip -o protoc-$PB_VERSION-linux-x86_64.zip bin/protoc 'include/google/*' -d /usr/local echo "PROTOC=/usr/local/bin/protoc" >> ${GITHUB_ENV} - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - name: Build dg (AlmaLinux 9) run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-dg --bin dg - name: Rename dg binary run: mv src-tauri/target/release/dg dg-linux-x86_64-${{ github.ref_name }} - name: Build dg rpm - uses: defGuard/fpm-action@main + uses: defGuard/fpm-action@ebb2575fbb892876fbdd326bb6d12524fbd7398c # main with: fpm_args: "dg-linux-x86_64-${{ github.ref_name }}=/usr/sbin/dg dg.service=/usr/lib/systemd/system/dg.service src-tauri/cli/.env=/etc/defguard/dg.conf" fpm_opts: "--architecture x86_64 --debug --output-type rpm --version ${{ env.VERSION }} --no-auto-depends --depends openssl-libs --depends wireguard-tools --package dg-linux-x86_64-${{ github.ref_name }}-el9.rpm" - name: Upload RPM - uses: actions/upload-release-asset@v1.0.2 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index ab36a4314..5fce2bdc5 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -27,7 +27,7 @@ jobs: echo "VERSION=$VERSION" >> $GITHUB_OUTPUT - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ steps.vars.outputs.TAG_NAME }} submodules: recursive @@ -39,7 +39,7 @@ jobs: git checkout FETCH_HEAD -- .trivyignore.yaml || echo "Keeping tagged .trivyignore.yaml" - name: Create SBOM with Trivy - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 env: TRIVY_SHOW_SUPPRESSED: 1 TRIVY_IGNOREFILE: "./.trivyignore.yaml" @@ -52,7 +52,7 @@ jobs: scanners: "vuln" - name: Create security advisory file with Trivy - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 env: TRIVY_SHOW_SUPPRESSED: 1 TRIVY_IGNOREFILE: "./.trivyignore.yaml" @@ -65,7 +65,7 @@ jobs: scanners: "vuln" - name: Upload SBOMs and advisories - uses: shogo82148/actions-upload-release-asset@v1 + uses: shogo82148/actions-upload-release-asset@9ee13965a8a51926f330b424693f25fcff8f2ef6 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/test-web.yml b/.github/workflows/test-web.yml index 6e2ee5944..a416b0f59 100644 --- a/.github/workflows/test-web.yml +++ b/.github/workflows/test-web.yml @@ -30,17 +30,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version-file: new-ui/.nvmrc - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: - version: 11.11 + version: 11.28 run_install: false - name: Install Node dependencies for new UI diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index aaa828e90..a2afaf51c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -42,12 +42,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive - name: Scan code with Trivy - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 env: TRIVY_SHOW_SUPPRESSED: 1 TRIVY_IGNOREFILE: "./.trivyignore.yaml" @@ -60,7 +60,7 @@ jobs: scanners: "vuln" - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: Install required packages run: | diff --git a/.github/workflows/update-chocolatey.yml b/.github/workflows/update-chocolatey.yml index efeb7f711..dad1a0635 100644 --- a/.github/workflows/update-chocolatey.yml +++ b/.github/workflows/update-chocolatey.yml @@ -10,7 +10,7 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set release version shell: pwsh diff --git a/.github/workflows/update-pnpm-hash.yaml b/.github/workflows/update-pnpm-hash.yaml index c7b935ef1..beaddc751 100644 --- a/.github/workflows/update-pnpm-hash.yaml +++ b/.github/workflows/update-pnpm-hash.yaml @@ -21,7 +21,7 @@ jobs: - codebuild-defguard-client-runner-${{ github.run_id }}-${{ github.run_attempt }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ github.event.pull_request.head.sha }} submodules: recursive @@ -97,7 +97,7 @@ jobs: - name: Commit updated hashes if: steps.hash.outputs.newUiPnpmDeps_changed == 'true' - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: script: | const fs = require('fs'); diff --git a/.github/workflows/update-repositories.yml b/.github/workflows/update-repositories.yml index 9f610a2e6..05b100edb 100644 --- a/.github/workflows/update-repositories.yml +++ b/.github/workflows/update-repositories.yml @@ -14,7 +14,7 @@ jobs: amd64_sha: ${{ steps.get_sha.outputs.AMD64_SHA }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: submodules: recursive @@ -111,7 +111,7 @@ jobs: - self-hosted - Linux - X64 - container: archlinux:latest + container: archlinux:latest@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0 steps: - name: Install dependencies run: |