From 2e38bc48b523d839eec0754db69f31563fc3f74d Mon Sep 17 00:00:00 2001 From: Gaurav Chaudhary Date: Mon, 5 Oct 2026 11:17:33 +0530 Subject: [PATCH] fix: pin GitHub Actions to commit hashes Signed-off-by: Gaurav Chaudhary --- .github/workflows/benchmark.yaml | 10 +++---- .github/workflows/bypass.yaml | 2 +- .github/workflows/check-ig-pin.yaml | 2 +- .github/workflows/component-tests.yaml | 12 ++++----- .github/workflows/go-basic-tests.yaml | 10 +++---- .../workflows/incluster-comp-pr-merged.yaml | 26 +++++++++---------- .github/workflows/pr-merged.yaml | 2 +- .github/workflows/scorecard.yml | 8 +++--- 8 files changed, 36 insertions(+), 36 deletions(-) diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml index 0c7995b784..9ec1b0947f 100644 --- a/.github/workflows/benchmark.yaml +++ b/.github/workflows/benchmark.yaml @@ -33,12 +33,12 @@ jobs: runs-on: ubuntu-large steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: "1.27" @@ -94,7 +94,7 @@ jobs: echo "After image will be loaded by dedup-bench.sh" - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.12' @@ -125,7 +125,7 @@ jobs: "${{ github.workspace }}/benchmark-output/after" - name: Comment on PR - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4 if: github.event_name == 'pull_request' && always() continue-on-error: true with: @@ -134,7 +134,7 @@ jobs: comment-tag: benchmark-results - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 if: always() with: name: benchmark-results diff --git a/.github/workflows/bypass.yaml b/.github/workflows/bypass.yaml index a518374d5d..27e4771657 100644 --- a/.github/workflows/bypass.yaml +++ b/.github/workflows/bypass.yaml @@ -11,7 +11,7 @@ jobs: steps: - name: Get build number id: get-build - uses: mlilback/build-number@v1 + uses: mlilback/build-number@81a5eb0abae9b77d036138284ba1094d49acbc32 # v1 with: base: 254 run-id: ${{ github.run_number }} diff --git a/.github/workflows/check-ig-pin.yaml b/.github/workflows/check-ig-pin.yaml index 2d92e80fb6..c7430332fe 100644 --- a/.github/workflows/check-ig-pin.yaml +++ b/.github/workflows/check-ig-pin.yaml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Check inspektor-gadget replace pin env: diff --git a/.github/workflows/component-tests.yaml b/.github/workflows/component-tests.yaml index 64a75c3cfd..e451447897 100644 --- a/.github/workflows/component-tests.yaml +++ b/.github/workflows/component-tests.yaml @@ -12,10 +12,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Login to Quay.io if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: quay.io/kubescape username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} @@ -57,7 +57,7 @@ jobs: - name: Upload image artifact for fork PR if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: node-agent-image path: node-agent-image.tar @@ -111,11 +111,11 @@ jobs: ] steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download fork PR image if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: node-agent-image @@ -166,7 +166,7 @@ jobs: - name: Set up Go env: CGO_ENABLED: 0 - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4 with: go-version: "1.27" - name: Set unlimited memlock limit diff --git a/.github/workflows/go-basic-tests.yaml b/.github/workflows/go-basic-tests.yaml index 0962daa4ce..d5e697e35d 100644 --- a/.github/workflows/go-basic-tests.yaml +++ b/.github/workflows/go-basic-tests.yaml @@ -79,11 +79,11 @@ jobs: # matrix: # os: ${{ fromJSON(needs.Setup-Environment.outputs.matrix) }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: submodules: recursive - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 name: Setup Go with: go-version: '${{ inputs.GO_VERSION }}' @@ -104,17 +104,17 @@ jobs: - name: Initialize CodeQL continue-on-error: true - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 with: languages: go - name: Autobuild continue-on-error: true - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 - name: Perform CodeQL Analysis continue-on-error: true - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 # - name: Test go build # run: go build -v ${{ inputs.BUILD_PATH }} diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml index abec166606..9744435a78 100644 --- a/.github/workflows/incluster-comp-pr-merged.yaml +++ b/.github/workflows/incluster-comp-pr-merged.yaml @@ -79,13 +79,13 @@ jobs: # if: github.ref == 'master' # run: exit -1 - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 name: Checkout with: fetch-depth: 0 # submodules: recursive - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 name: Installing go with: go-version: "${{ inputs.GO_VERSION }}" @@ -97,10 +97,10 @@ jobs: run: make gadgets - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Set prerelease image tag id: image-prerelease-tag @@ -111,7 +111,7 @@ jobs: run: go test -exec sudo -v ./... - name: Login to Quay - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: quay.io username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} @@ -119,7 +119,7 @@ jobs: - name: Build and push id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: build/Dockerfile @@ -138,7 +138,7 @@ jobs: push-to-registry: true - name: Install cosign - uses: sigstore/cosign-installer@main + uses: sigstore/cosign-installer@af595e623eec1ede52d6322f53b635d5def0a95a # main with: cosign-release: "v2.2.2" @@ -186,7 +186,7 @@ jobs: - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v1 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1 with: app-id: ${{ secrets.E2E_DISPATCH_APP_ID }} private-key: ${{ secrets.E2E_DISPATCH_APP_PRIVATE_KEY }} @@ -339,7 +339,7 @@ jobs: - name: Upload failed step logs if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: failed-e2e-logs-attempt-${{ github.run_attempt }} path: failed_*.txt @@ -364,10 +364,10 @@ jobs: contents: write steps: - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Login to Quay - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: quay.io username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} @@ -388,7 +388,7 @@ jobs: - name: Create Release id: create_release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: token: ${{ secrets.GITHUB_TOKEN }} tag: ${{ inputs.IMAGE_TAG }} @@ -399,7 +399,7 @@ jobs: - name: Trigger helm chart workflow if: ${{ inputs.TRIGGER_HELM_CICD == true }} - uses: benc-uk/workflow-dispatch@v1 + uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1 with: workflow: 00-cicd.yaml repo: kubescape/helm-charts diff --git a/.github/workflows/pr-merged.yaml b/.github/workflows/pr-merged.yaml index 66ed073d7a..70b7291e08 100644 --- a/.github/workflows/pr-merged.yaml +++ b/.github/workflows/pr-merged.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Get build number id: get-build - uses: mlilback/build-number@v1 + uses: mlilback/build-number@81a5eb0abae9b77d036138284ba1094d49acbc32 # v1 with: base: -550 run-id: ${{ github.run_number }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8f3b148bd6..765afc467d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,12 +32,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@v2.4.0 + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif @@ -59,7 +59,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: SARIF file path: results.sarif @@ -67,6 +67,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3 with: sarif_file: results.sarif