Skip to content

ci: reference exact action releases locked in actions.lock #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rgarcia merged 1 commit into from
Nov 14, 2026
Merged

ci: reference exact action releases locked in actions.lock #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 45 additions & 88 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,56 +4,56 @@
version: 'v0.0.3'
workflows:
'.github/workflows/breakglass-merge.yml':
- 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
- 'actions/create-github-app-token@v1.12.0'
'.github/workflows/breakglass-tests.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/checkout@v4.2.2'
'.github/workflows/container-remediation-self-test.yml': []
'.github/workflows/container-remediation-tests.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/checkout@v4.2.2'
'.github/workflows/container-remediation.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
- 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
- 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
- 'actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff'
- 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
- 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
- 'actions/checkout@v4.2.2'
- 'actions/checkout@v4.3.1'
- 'actions/create-github-app-token@v1.12.0'
- 'actions/download-artifact@v4.3.0'
- 'actions/setup-go@v5.6.0'
- 'actions/setup-node@v4.4.0'
- 'actions/upload-artifact@v4.6.2'
- 'aquasecurity/trivy-action@38b337fff0a2f984d5be173c99e3f633438167ec'
- 'aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd'
- 'aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a'
- 'aws-actions/amazon-ecr-login@v2.1.7'
- 'aws-actions/configure-aws-credentials@v4.3.1'
'.github/workflows/container-scan.yml':
- 'actions/checkout@v4.4.0'
- 'actions/upload-artifact@v4.6.2'
- 'aquasecurity/trivy-action@master'
- 'aquasecurity/trivy-action@38b337fff0a2f984d5be173c99e3f633438167ec'
- 'aws-actions/amazon-ecr-login@v2.1.7'
- 'aws-actions/configure-aws-credentials@v4.3.1'
'.github/workflows/pr-risk-tests.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/checkout@v4.2.2'
'.github/workflows/pr-risk.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
- 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
- 'actions/checkout@v4.2.2'
- 'actions/create-github-app-token@v1.12.0'
- 'actions/setup-node@v4.4.0'
'.github/workflows/semgrep-self-test.yml': []
'.github/workflows/semgrep-tests.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/checkout@v4.2.2'
'.github/workflows/semgrep.yml':
- 'actions/checkout@v4'
- 'actions/download-artifact@v4'
- 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
- 'actions/upload-artifact@v4'
- 'actions/checkout@v4.4.0'
- 'actions/download-artifact@v4.3.0'
- 'actions/setup-node@v4.4.0'
- 'actions/upload-artifact@v4.6.2'
- 'kernel/security-workflows@main'
'.github/workflows/vuln-remediation-self-test.yml':
- 'actions/checkout@v4.4.0'
'.github/workflows/vuln-remediation.yml':
- 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
- 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262'
- 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
- 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
- 'actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff'
- 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
- 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065'
- 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
- 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
- 'actions/checkout@v4.2.2'
- 'actions/checkout@v4.4.0'
- 'actions/create-github-app-token@v1.12.0'
- 'actions/download-artifact@v4.3.0'
- 'actions/setup-go@v5.6.0'
- 'actions/setup-node@v4.4.0'
- 'actions/setup-python@v5.6.0'
- 'actions/upload-artifact@v4.6.2'
- 'oven-sh/setup-bun@v2.2.0'
dependencies:
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
ref: 'v6.1.0'
Expand All @@ -65,76 +65,51 @@ dependencies:
commit: 'sha1-9255dc7a253b0ccc959486e2bca901246202afeb'
owner_id: 44036562
repo_id: 215566462
'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683':
ref: 'v4.2.2'
commit: 'sha1-11bd71901bbe5b1630ceea73d27597364c9af683'
'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8':
ref: 'v6.0.1'
commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@11d5960a326750d5838078e36cf38b85af677262':
ref: 'v4.4.0'
commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
'actions/checkout@v4.2.2':
ref: 'v4.2.2'
commit: 'sha1-11bd71901bbe5b1630ceea73d27597364c9af683'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5':
'actions/checkout@v4.3.1':
ref: 'v4.3.1'
commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8':
ref: 'v6.0.1'
commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v4':
ref: 'v4'
commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v4.4.0':
ref: 'v4.4.0'
commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
owner_id: 44036562
repo_id: 197814629
'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547':
'actions/create-github-app-token@v1.12.0':
ref: 'v1.12.0'
commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
owner_id: 44036562
repo_id: 642580244
'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
'actions/download-artifact@v4.3.0':
ref: 'v4.3.0'
commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
owner_id: 44036562
repo_id: 192626254
'actions/download-artifact@v4':
ref: 'v4'
commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
owner_id: 44036562
repo_id: 192626254
'actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff':
'actions/setup-go@v5.6.0':
ref: 'v5.6.0'
commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff'
owner_id: 44036562
repo_id: 192624594
'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020':
'actions/setup-node@v4.4.0':
ref: 'v4.4.0'
commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
owner_id: 44036562
repo_id: 189476904
'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065':
'actions/setup-python@v5.6.0':
ref: 'v5.6.0'
commit: 'sha1-a26af69be951a213d495a4c3e4e4022e16d87065'
owner_id: 44036562
repo_id: 192625525
'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
ref: 'v4.6.2'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@v4':
ref: 'v4'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@v4.6.2':
ref: 'v4.6.2'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
Expand All @@ -156,40 +131,22 @@ dependencies:
uses:
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- 'aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567'
'aquasecurity/trivy-action@master':
ref: 'master'
commit: 'sha1-38b337fff0a2f984d5be173c99e3f633438167ec'
owner_id: 12783832
repo_id: 268833180
uses:
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- 'aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567'
'aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd':
ref: 'v2.1.7'
commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd'
owner_id: 57468012
repo_id: 220389860
'aws-actions/amazon-ecr-login@v2.1.7':
ref: 'v2.1.7'
commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd'
owner_id: 57468012
repo_id: 220389860
'aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a':
ref: 'v4.3.1'
commit: 'sha1-7474bc4690e29a8392af63c5b98e7449536d5c3a'
owner_id: 57468012
repo_id: 220391287
'aws-actions/configure-aws-credentials@v4.3.1':
ref: 'v4.3.1'
commit: 'sha1-7474bc4690e29a8392af63c5b98e7449536d5c3a'
owner_id: 57468012
repo_id: 220391287
'kernel/security-workflows@main':
ref: 'main'
commit: 'sha1-56bdfc09970ce29b2ad4df3daa17adb9a7ed4ce0'
commit: 'sha1-af490855f90e83f89dcaf4ea18da962ec294350e'
owner_id: 194616459
repo_id: 1207196574
'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
'oven-sh/setup-bun@v2.2.0':
ref: 'v2.2.0'
commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
owner_id: 108928776
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/breakglass-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,10 @@ jobs:
steps:
- name: Generate app token
id: app-token
# Pinned to a commit: this step is handed the app's private key, so a mutable tag
# would let whoever controls it run their own code with that key. d72941d is v1.12.0,
# the commit `v1` already resolved to, so pinning changed no behaviour.
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547
# Locked to a commit in actions.lock: this step is handed the app's private key, so a
# moved tag must not change what runs. v1.12.0 is d72941d, the commit this step was
# pinned to before the lockfile.
uses: actions/create-github-app-token@v1.12.0
with:
app-id: ${{ secrets.BREAKGLASS_APP_ID }}
private-key: ${{ secrets.BREAKGLASS_APP_PRIVATE_KEY }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/breakglass-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/checkout@v4.2.2
- run: |
python3 -m venv /tmp/breakglass-tests
/tmp/breakglass-tests/bin/pip install PyYAML==6.0.3
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/container-remediation-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,17 @@ on:
- .github/workflows/container-remediation-tests.yml
- .github/workflows/container-scan/**
- scripts/test_container_remediation.py
- scripts/action_pins.py
- .github/workflows/actions.lock
push:
branches: [main]
paths:
- .github/workflows/container-remediation.yml
- .github/workflows/container-remediation-tests.yml
- .github/workflows/container-scan/**
- scripts/test_container_remediation.py
- scripts/action_pins.py
- .github/workflows/actions.lock

permissions:
contents: read
Expand All @@ -22,7 +26,7 @@ jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/checkout@v4.2.2
- run: |
python3 -m venv /tmp/container-remediation-tests
/tmp/container-remediation-tests/bin/pip install PyYAML==6.0.3
Expand Down
Loading
Loading