From 2a2a059a8dcde1cffc7f83d38000ad39fd8c58f7 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sun, 23 Aug 2026 12:24:40 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/cicd.yml | 10 +++++----- .github/workflows/pr.yml | 6 +++--- .github/workflows/publish-charts-dev.yml | 6 +++--- .github/workflows/publish-charts.yml | 4 ++-- .github/workflows/publish-func-package-dev.yml | 6 +++--- .github/workflows/publish-func-package.yml | 4 ++-- 7 files changed, 29 insertions(+), 18 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index e9f213b4..e8a7d1cd 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -15,16 +15,16 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: fetch-depth: 0 - name: Get Most Recent Tag id: most-recent-tag - uses: "WyriHaximus/github-action-get-previous-tag@v1" + uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0 - name: Log in with Azure - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: client-id: ${{ secrets.SECURE_AZURE_CLIENT_ID }} tenant-id: ${{ secrets.SECURE_AZURE_TENANT_ID }} @@ -68,10 +68,10 @@ jobs: needs: - build_and_publish steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Log in with Azure - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: client-id: ${{ secrets.SECURE_AZURE_CLIENT_ID }} tenant-id: ${{ secrets.SECURE_AZURE_TENANT_ID }} diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 44215a15..b81a1c3c 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Run cibuild run: ./scripts/cibuild @@ -19,8 +19,8 @@ jobs: validate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-python@v6 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.13" # stac-api-validator requires >= 3.10 cache: "pip" diff --git a/.github/workflows/publish-charts-dev.yml b/.github/workflows/publish-charts-dev.yml index 01848e7f..6f24b7b1 100644 --- a/.github/workflows/publish-charts-dev.yml +++ b/.github/workflows/publish-charts-dev.yml @@ -16,19 +16,19 @@ jobs: contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: fetch-depth: 0 # Required due to the way Git works, without it this action won't be able to find any or the correct tags - name: "Get Previous tag" id: previoustag - uses: "WyriHaximus/github-action-get-previous-tag@v1.2.2" + uses: "WyriHaximus/github-action-get-previous-tag@dc52ee2c1eb91ebf1d540ea7bd2f6424fb00f573" # v1.2.2 with: fallback: 2022.2.0 - name: "Get next minor version" id: semvers - uses: "WyriHaximus/github-action-next-semvers@v1" + uses: "WyriHaximus/github-action-next-semvers@d079934efaf011a4cf8912d4637097fe35d32b93" # v1 with: version: ${{ steps.previoustag.outputs.tag }} diff --git a/.github/workflows/publish-charts.yml b/.github/workflows/publish-charts.yml index 796941e3..566d6cf8 100644 --- a/.github/workflows/publish-charts.yml +++ b/.github/workflows/publish-charts.yml @@ -16,11 +16,11 @@ jobs: contents: write steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Get tag id: previoustag - uses: "WyriHaximus/github-action-get-previous-tag@v1" + uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0 - name: Publish Helm charts uses: stefanprodan/helm-gh-pages@master diff --git a/.github/workflows/publish-func-package-dev.yml b/.github/workflows/publish-func-package-dev.yml index 91d12ab3..4b461279 100644 --- a/.github/workflows/publish-func-package-dev.yml +++ b/.github/workflows/publish-func-package-dev.yml @@ -16,19 +16,19 @@ jobs: contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: fetch-depth: 0 - name: "Get Previous tag" id: previoustag - uses: "WyriHaximus/github-action-get-previous-tag@v1.2.2" + uses: "WyriHaximus/github-action-get-previous-tag@dc52ee2c1eb91ebf1d540ea7bd2f6424fb00f573" # v1.2.2 with: fallback: 2022.2.0 - name: "Get next minor version" id: semvers - uses: "WyriHaximus/github-action-next-semvers@v1" + uses: "WyriHaximus/github-action-next-semvers@d079934efaf011a4cf8912d4637097fe35d32b93" # v1 with: version: ${{ steps.previoustag.outputs.tag }} diff --git a/.github/workflows/publish-func-package.yml b/.github/workflows/publish-func-package.yml index e3384e94..97234da9 100644 --- a/.github/workflows/publish-func-package.yml +++ b/.github/workflows/publish-func-package.yml @@ -16,13 +16,13 @@ jobs: contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: fetch-depth: 0 - name: "Get tag" id: previoustag - uses: "WyriHaximus/github-action-get-previous-tag@v1.2.2" + uses: "WyriHaximus/github-action-get-previous-tag@dc52ee2c1eb91ebf1d540ea7bd2f6424fb00f573" # v1.2.2 with: fallback: 2022.2.0