From 434d4c4570ba3e1991ec82d56cc8890318964f8b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:07:34 +0200 Subject: [PATCH] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/build_archives.yaml | 4 ++-- .github/workflows/lint_and_test.yaml | 4 ++-- .github/workflows/test_dockerfile_builds.yaml | 2 +- .github/workflows/test_llm_ai_node_templates.yaml | 4 ++-- .github/workflows/test_llm_ai_python_templates.yaml | 6 +++--- .github/workflows/test_node_templates.yaml | 4 ++-- .github/workflows/test_python_templates.yaml | 8 ++++---- .github/workflows/update-new-issue.yaml | 2 +- .github/workflows/update-templates.yml | 4 ++-- 9 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build_archives.yaml b/.github/workflows/build_archives.yaml index 12b30a7be..cbf019c92 100644 --- a/.github/workflows/build_archives.yaml +++ b/.github/workflows/build_archives.yaml @@ -12,12 +12,12 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc diff --git a/.github/workflows/lint_and_test.yaml b/.github/workflows/lint_and_test.yaml index 5093fcb63..940ef11e3 100644 --- a/.github/workflows/lint_and_test.yaml +++ b/.github/workflows/lint_and_test.yaml @@ -35,10 +35,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc diff --git a/.github/workflows/test_dockerfile_builds.yaml b/.github/workflows/test_dockerfile_builds.yaml index 26474e98c..972fdfe71 100644 --- a/.github/workflows/test_dockerfile_builds.yaml +++ b/.github/workflows/test_dockerfile_builds.yaml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Free disk space # Only the fast rm -rf part of the old "maximize disk space" step — the diff --git a/.github/workflows/test_llm_ai_node_templates.yaml b/.github/workflows/test_llm_ai_node_templates.yaml index 509f410b7..f6f98f5c3 100644 --- a/.github/workflows/test_llm_ai_node_templates.yaml +++ b/.github/workflows/test_llm_ai_node_templates.yaml @@ -21,10 +21,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/test_llm_ai_python_templates.yaml b/.github/workflows/test_llm_ai_python_templates.yaml index fb2d98a13..fddfe5d66 100644 --- a/.github/workflows/test_llm_ai_python_templates.yaml +++ b/.github/workflows/test_llm_ai_python_templates.yaml @@ -16,10 +16,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc @@ -27,7 +27,7 @@ jobs: uses: apify/workflows/pnpm-install@v0.46.0 - name: Setup Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} cache: pip diff --git a/.github/workflows/test_node_templates.yaml b/.github/workflows/test_node_templates.yaml index e7cd9c62a..71c1a9db9 100644 --- a/.github/workflows/test_node_templates.yaml +++ b/.github/workflows/test_node_templates.yaml @@ -29,10 +29,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/test_python_templates.yaml b/.github/workflows/test_python_templates.yaml index 3fa341ef6..9b874f1b7 100644 --- a/.github/workflows/test_python_templates.yaml +++ b/.github/workflows/test_python_templates.yaml @@ -18,10 +18,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc @@ -32,7 +32,7 @@ jobs: run: pnpm exec playwright install chromium --with-deps - name: Setup Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} cache: pip @@ -40,7 +40,7 @@ jobs: # For uv-based templates (e.g. python-uv); uv provides its own Python from .python-version. - name: Setup uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 - name: Install Chrome and Chromedriver # Use pnpm dlx instead of npx — npx is the npm CLI and trips diff --git a/.github/workflows/update-new-issue.yaml b/.github/workflows/update-new-issue.yaml index 08d007a9d..60959be7e 100644 --- a/.github/workflows/update-new-issue.yaml +++ b/.github/workflows/update-new-issue.yaml @@ -14,7 +14,7 @@ jobs: steps: # Add the "t-builders" label to all new issues - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | github.rest.issues.addLabels({ diff --git a/.github/workflows/update-templates.yml b/.github/workflows/update-templates.yml index cdb134e8b..0465d9e57 100644 --- a/.github/workflows/update-templates.yml +++ b/.github/workflows/update-templates.yml @@ -41,13 +41,13 @@ jobs: echo "BASE_IMAGE_FORMATTED=$(echo '${{ env.BASE_IMAGE_RAW }}' | sed 's/,/, /g')" >> $GITHUB_OUTPUT - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24