From 6c76cd7728e1aa9090ed5e7eac67dc8045a3804d Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 19 Aug 2026 14:34:23 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++ .github/workflows/ci.yml | 4 +-- .github/workflows/e2e-autotest.yml | 26 ++++++++++---------- .github/workflows/issueLens-run.yml | 6 ++--- .github/workflows/issueSnapshot.yml | 6 ++--- .github/workflows/no-response.yml | 2 +- .github/workflows/triage-agent.yml | 4 +-- .github/workflows/triage-all-open-issues.yml | 4 +-- 8 files changed, 35 insertions(+), 26 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8cc8a033..a4a0cf03 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,12 @@ updates: # in case the feed's ingestion lag drifts. cooldown: default-days: 10 + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a18121d..a2099799 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,10 +15,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' cache: 'npm' diff --git a/.github/workflows/e2e-autotest.yml b/.github/workflows/e2e-autotest.yml index 6b44470b..ac17d4ef 100644 --- a/.github/workflows/e2e-autotest.yml +++ b/.github/workflows/e2e-autotest.yml @@ -36,10 +36,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' cache: npm @@ -54,7 +54,7 @@ jobs: run: npx @vscode/vsce@latest package -o vscode-java-pack-pr.vsix - name: Upload branch VSIX - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: pack-vsix path: vscode-java-pack-pr.vsix @@ -67,7 +67,7 @@ jobs: matrix: ${{ steps.scan.outputs.matrix }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Resolve test plan matrix id: scan @@ -99,7 +99,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Clone vscode-java (test projects) run: git clone --depth 1 https://github.com/redhat-developer/vscode-java.git ../vscode-java @@ -108,13 +108,13 @@ jobs: run: git clone --depth 1 https://github.com/eclipse-jdtls/eclipse.jdt.ls.git ../eclipse.jdt.ls - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 - name: Setup Java 25 (for java25 test plans) if: contains(matrix.plan, 'java25') - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: temurin java-version: 25-ea @@ -141,7 +141,7 @@ jobs: } - name: Setup Java 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: temurin java-version: 21 @@ -162,7 +162,7 @@ jobs: - name: Download vscode-java-pack VSIX (from branch) if: ${{ github.event_name != 'schedule' }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: pack-vsix path: vsix @@ -345,7 +345,7 @@ jobs: - name: Upload results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: results-${{ matrix.plan }}-${{ matrix.os }} path: test-results/ @@ -359,7 +359,7 @@ jobs: steps: - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 @@ -367,7 +367,7 @@ jobs: run: npm install -g @vscjava/vscode-autotest - name: Download all results - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: pattern: results-* path: all-results @@ -404,7 +404,7 @@ jobs: - name: Upload aggregate results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: e2e-aggregate-summary path: test-results/summary.md diff --git a/.github/workflows/issueLens-run.yml b/.github/workflows/issueLens-run.yml index 22bb4395..9e3179b0 100644 --- a/.github/workflows/issueLens-run.yml +++ b/.github/workflows/issueLens-run.yml @@ -25,17 +25,17 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Setup Node.js 22 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' - name: Setup Python 3.12 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.12' diff --git a/.github/workflows/issueSnapshot.yml b/.github/workflows/issueSnapshot.yml index ae14c533..5e0bbaf2 100644 --- a/.github/workflows/issueSnapshot.yml +++ b/.github/workflows/issueSnapshot.yml @@ -14,16 +14,16 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} REPO: ${{ github.event.repository.name }} - name: Save artifacts - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1 with: path: ./*.json retention-days: 1 - name: Log in to Azure - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: creds: ${{ secrets.AZURE_CREDS }} - name: Upload to Azure - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | az storage blob upload-batch --account-name ${{ vars.AZURE_STORAGE_ACCOUNT_NAME }} --auth-mode login -d ${{ vars.AZURE_STORAGE_CONTAINER_NAME }} -s . diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 724c9292..cde4c4f5 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -18,7 +18,7 @@ jobs: noResponse: runs-on: ubuntu-latest steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} # Only process issues with "needs more info" label diff --git a/.github/workflows/triage-agent.yml b/.github/workflows/triage-agent.yml index 57d97837..a159876c 100644 --- a/.github/workflows/triage-agent.yml +++ b/.github/workflows/triage-agent.yml @@ -21,11 +21,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Get issue data id: get_issue - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const eventName = context.eventName; diff --git a/.github/workflows/triage-all-open-issues.yml b/.github/workflows/triage-all-open-issues.yml index 092f4ef7..05dae014 100644 --- a/.github/workflows/triage-all-open-issues.yml +++ b/.github/workflows/triage-all-open-issues.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Get all open issues id: get_issues - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | // Use Search API to filter issues at API level @@ -85,7 +85,7 @@ jobs: - name: Trigger triage workflow for issue if: inputs.dry_run != true - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const issueNumber = '${{ matrix.issue_number }}';