ci: lock workflow dependencies with GitHub's actions.lock

.github/workflows/actions.lock

@@ -0,0 +1,196 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/breakglass-merge.yml':
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+    '.github/workflows/breakglass-tests.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+    '.github/workflows/container-remediation-self-test.yml': []
+    '.github/workflows/container-remediation-tests.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+    '.github/workflows/container-remediation.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        - 'actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+        - 'aquasecurity/trivy-action@38b337fff0a2f984d5be173c99e3f633438167ec'
+        - 'aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd'
+        - 'aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a'
+    '.github/workflows/container-scan.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'aquasecurity/trivy-action@master'
+        - 'aws-actions/amazon-ecr-login@v2.1.7'
+        - 'aws-actions/configure-aws-credentials@v4.3.1'
+    '.github/workflows/pr-risk-tests.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+    '.github/workflows/pr-risk.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+    '.github/workflows/semgrep-self-test.yml': []
+    '.github/workflows/semgrep-tests.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+    '.github/workflows/semgrep.yml':
+        - 'actions/checkout@v4'
+        - 'actions/download-artifact@v4'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'actions/upload-artifact@v4'
+        - 'kernel/security-workflows@main'
+    '.github/workflows/vuln-remediation-self-test.yml':
+        - 'actions/checkout@v4.4.0'
+    '.github/workflows/vuln-remediation.yml':
+        - 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
+        - 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        - 'actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+dependencies:
+    'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb':
+        ref: 'v5.0.1'
+        commit: 'sha1-9255dc7a253b0ccc959486e2bca901246202afeb'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683':
+        ref: 'v4.2.2'
+        commit: 'sha1-11bd71901bbe5b1630ceea73d27597364c9af683'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@11d5960a326750d5838078e36cf38b85af677262':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8':
+        ref: 'v6.0.1'
+        commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4':
+        ref: 'v4'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547':
+        ref: 'v1.12.0'
+        commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/download-artifact@v4':
+        ref: 'v4'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff':
+        ref: 'v5.6.0'
+        commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065':
+        ref: 'v5.6.0'
+        commit: 'sha1-a26af69be951a213d495a4c3e4e4022e16d87065'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4':
+        ref: 'v4'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567':
+        ref: 'v0.3.1'
+        commit: 'sha1-81e514348e19b6112ce2a7e3ecbafe19c1e1f567'
+        owner_id: 12783832
+        repo_id: 869952525
+        uses:
+            - 'actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb'
+            - 'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8'
+    'aquasecurity/trivy-action@38b337fff0a2f984d5be173c99e3f633438167ec':
+        ref: 'master'
+        commit: 'sha1-38b337fff0a2f984d5be173c99e3f633438167ec'
+        owner_id: 12783832
+        repo_id: 268833180
+        uses:
+            - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+            - 'aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567'
+    'aquasecurity/trivy-action@master':
+        ref: 'master'
+        commit: 'sha1-38b337fff0a2f984d5be173c99e3f633438167ec'
+        owner_id: 12783832
+        repo_id: 268833180
+        uses:
+            - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+            - 'aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567'
+    'aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd':
+        ref: 'v2.1.7'
+        commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd'
+        owner_id: 57468012
+        repo_id: 220389860
+    'aws-actions/amazon-ecr-login@v2.1.7':
+        ref: 'v2.1.7'
+        commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd'
+        owner_id: 57468012
+        repo_id: 220389860
+    'aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a':
+        ref: 'v4.3.1'
+        commit: 'sha1-7474bc4690e29a8392af63c5b98e7449536d5c3a'
+        owner_id: 57468012
+        repo_id: 220391287
+    'aws-actions/configure-aws-credentials@v4.3.1':
+        ref: 'v4.3.1'
+        commit: 'sha1-7474bc4690e29a8392af63c5b98e7449536d5c3a'
+        owner_id: 57468012
+        repo_id: 220391287
+    'kernel/security-workflows@main':
+        ref: 'main'
+        commit: 'sha1-56bdfc09970ce29b2ad4df3daa17adb9a7ed4ce0'
+        owner_id: 194616459
+        repo_id: 1207196574
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635

.github/workflows/container-scan.yml

@@ -47,18 +47,18 @@ jobs:
       id-token: write
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
 
       - name: Configure AWS credentials
         if: inputs.ecr-role-to-assume != ''
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v4.3.1
         with:
           role-to-assume: ${{ inputs.ecr-role-to-assume }}
           aws-region: ${{ inputs.aws-region }}
 
       - name: Log in to ECR
         if: inputs.ecr-role-to-assume != ''
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@v2.1.7
 
       - name: Scan container image (table)
         uses: aquasecurity/trivy-action@master
@@ -104,7 +104,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload scan artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: container-scan-report
           path: trivy-results.json

.github/workflows/vuln-remediation-self-test.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
 
       - name: Run unit and fixture tests
         run: python3 -m unittest scripts.test_vuln_remediation