From 598413707e1f49911811cbf7446e8a4af8d1dff2 Mon Sep 17 00:00:00 2001 From: Marko Bevc Date: Thu, 5 Nov 2026 23:11:46 +0000 Subject: [PATCH 1/5] ci: pin mutable action refs to commit SHAs snyk/actions/setup@master, kosli-dev/reusable-actions@main and anchore/sbom-action@v0 resolve to whatever the branch or floating tag points at when the job starts, and they run next to SNYK_TOKEN, Slack webhooks and the release job's contents/id-token/attestations write permissions. The release job's goreleaser-action and setup-node were also on floating major tags. Each ref is pinned to the commit it resolves to today, so behaviour is unchanged: snyk setup/ is identical between v1.0.0 and master, and anchore's v0 tag points at v0.24.0. The version comments let Dependabot keep the tagged pins current. reusable-actions has no tags, so its pin carries the branch name instead. --- .github/workflows/binary_provenance.yml | 6 +++--- .github/workflows/daily-cli-tests.yml | 2 +- .github/workflows/docker.yml | 4 ++-- .github/workflows/main.yml | 2 +- .github/workflows/release.yml | 10 +++++----- .github/workflows/test.yml | 4 ++-- 6 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/binary_provenance.yml b/.github/workflows/binary_provenance.yml index ca891a85f..68689f12c 100644 --- a/.github/workflows/binary_provenance.yml +++ b/.github/workflows/binary_provenance.yml @@ -70,7 +70,7 @@ jobs: echo "ARTIFACT_TLOG_INDEX=$TRANSPARENCY_LOG_INDEX" >> ${GITHUB_ENV} - name: Generate SBOM for the binary - uses: anchore/sbom-action@v0 + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 with: file: ${{matrix.artifact.path}} format: 'spdx-json' @@ -79,7 +79,7 @@ jobs: upload-release-assets: false - name: Generate Cyclone-dx SBOM for the binary - uses: anchore/sbom-action@v0 + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 with: file: ${{matrix.artifact.path}} format: 'cyclonedx-json' @@ -88,7 +88,7 @@ jobs: upload-release-assets: false - name: Publish SBOM - uses: anchore/sbom-action/publish-sbom@v0 + uses: anchore/sbom-action/publish-sbom@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 with: sbom-artifact-match: ".*\\.spdx.json$" diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 316ae240f..0663f78f1 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -103,7 +103,7 @@ jobs: egress-policy: audit - name: Slack Notification on Failure - uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@2f03451c333eea1b7ae07b48d5c887e737136cdb # main with: slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index ab852b4cb..319441a3c 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -289,7 +289,7 @@ jobs: push-to-registry: true - name: Install syft - uses: anchore/sbom-action/download-syft@v0 + uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - name: Generate SBOM for the docker image env: @@ -329,7 +329,7 @@ jobs: push-to-registry: true - name: setup Snyk - uses: snyk/actions/setup@master + uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 - name: Report Docker image to Kosli if: ${{ inputs.report_to_kosli != 'none' }} diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 1c92fc30a..5664d1712 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -148,7 +148,7 @@ jobs: egress-policy: audit - name: Slack Notification on Failure - uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@2f03451c333eea1b7ae07b48d5c887e737136cdb # main with: slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ad15373f6..92d468ca4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: with: egress-policy: audit - - uses: kosli-dev/reusable-actions/slack-release-notify@main + - uses: kosli-dev/reusable-actions/slack-release-notify@2f03451c333eea1b7ae07b48d5c887e737136cdb # main with: slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} slack-channel-id: ${{ vars.SLACK_CHANNEL_ID }} @@ -155,7 +155,7 @@ jobs: check-latest: true - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '24' registry-url: 'https://registry.npmjs.org' @@ -184,7 +184,7 @@ jobs: } >> "$GITHUB_ENV" - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: distribution: goreleaser-pro version: '~> v2' # latest @@ -333,7 +333,7 @@ jobs: egress-policy: audit - name: Slack Notification on Failure - uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@2f03451c333eea1b7ae07b48d5c887e737136cdb # main with: slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} @@ -374,7 +374,7 @@ jobs: echo "value=failure" >> "$GITHUB_OUTPUT" fi - - uses: kosli-dev/reusable-actions/slack-release-notify@main + - uses: kosli-dev/reusable-actions/slack-release-notify@2f03451c333eea1b7ae07b48d5c887e737136cdb # main with: slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} slack-channel-id: ${{ vars.SLACK_CHANNEL_ID }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2e8cacd59..0b1a65411 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -209,7 +209,7 @@ jobs: ref: ${{ inputs.checkout_ref || github.sha }} - name: setup Snyk - uses: snyk/actions/setup@master + uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 - name: setup-kosli-cli uses: kosli-dev/setup-cli-action@v5 @@ -262,7 +262,7 @@ jobs: ref: ${{ inputs.checkout_ref || github.sha }} - name: setup Snyk - uses: snyk/actions/setup@master + uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 - name: setup-kosli-cli uses: kosli-dev/setup-cli-action@v5 From ad41c258eec26de6076c29347ff3a471a3a1115b Mon Sep 17 00:00:00 2001 From: Marko Bevc Date: Thu, 5 Nov 2026 23:11:49 +0000 Subject: [PATCH 2/5] ci: drop two third-party actions from the release workflow dawidd6/action-get-tag only read the tag name from GITHUB_REF; a run step now does the same from GITHUB_REF_NAME and keeps the step id, so every steps.tag.outputs.tag reference is unchanged. It also fails on a non-tag ref, as the action did. dcarbone/install-jq-action installed jq, which ubuntu-latest runner images already ship. It ran in the goreleaser job, which holds contents, id-token and attestations write permissions. --- .github/workflows/release.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 92d468ca4..e238d702c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,7 +39,12 @@ jobs: - name: Get tag id: tag - uses: dawidd6/action-get-tag@v1 + run: | + if [ "$GITHUB_REF_TYPE" != "tag" ]; then + echo "::error::Expected a tag ref, got $GITHUB_REF" + exit 1 + fi + echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT" - name: Verify annotated tag env: @@ -145,9 +150,6 @@ jobs: with: fetch-depth: 0 - - name: Install Jq - uses: dcarbone/install-jq-action@v4 - - name: Set up Go uses: actions/setup-go@v7 with: From 92cf2510db9b2c63a0549e1f851363b62568913d Mon Sep 17 00:00:00 2001 From: Marko Bevc Date: Thu, 5 Nov 2026 23:11:49 +0000 Subject: [PATCH 3/5] ci: pin checkout, setup-go and setup-cli-action to commit SHAs These ran on floating major tags in jobs that hold write tokens and secrets, including the goreleaser job with contents and id-token write, GORELEASER_KEY and FURY_TOKEN. Every use is pinned, so the same action is not mixed pinned and floating across workflows. Each pin is the commit its major tag points at today (checkout v7.0.1, setup-go v7.0.0, setup-cli-action v5.2.4), so behaviour is unchanged. --- .github/workflows/binary_provenance.yml | 4 ++-- .github/workflows/claude-pr-review.yml | 6 +++--- .github/workflows/daily-cli-tests.yml | 6 +++--- .github/workflows/docker.yml | 8 ++++---- .github/workflows/helm-chart.yml | 2 +- .github/workflows/init_kosli.yml | 4 ++-- .github/workflows/install-script-tests.yml | 4 ++-- .github/workflows/main.yml | 2 +- .github/workflows/never_alone_trail.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- .github/workflows/test.yml | 20 ++++++++++---------- .github/workflows/upload-cli-layer.yml | 2 +- 12 files changed, 34 insertions(+), 34 deletions(-) diff --git a/.github/workflows/binary_provenance.yml b/.github/workflows/binary_provenance.yml index 68689f12c..13b092219 100644 --- a/.github/workflows/binary_provenance.yml +++ b/.github/workflows/binary_provenance.yml @@ -39,7 +39,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/download-artifact@v8 with: @@ -47,7 +47,7 @@ jobs: path: ${{ github.workspace }}/${{inputs.dir}} - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index d9e0f4394..b3741879e 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -30,7 +30,7 @@ jobs: egress-policy: audit - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -131,12 +131,12 @@ jobs: egress-policy: audit - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: ".go-version" check-latest: true diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 0663f78f1..7e5674466 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -16,7 +16,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare id: prep @@ -64,9 +64,9 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: '.go-version' check-latest: true diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 319441a3c..8f51a1422 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -135,7 +135,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 3 # No fetch-tags: the version arrives as a build arg, not from here. @@ -213,14 +213,14 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 3 # The smoke tests mount this workspace into a container. persist-credentials: false ref: ${{ inputs.checkout_ref || github.sha }} - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: '.go-version' check-latest: true @@ -243,7 +243,7 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml index 4c01ad0d5..d812753d1 100644 --- a/.github/workflows/helm-chart.yml +++ b/.github/workflows/helm-chart.yml @@ -28,7 +28,7 @@ jobs: app-id: ${{ vars.CI_SIGNED_COMMIT_APP_ID }} private-key: ${{ secrets.CI_SIGNED_COMMIT_APP_PRIVATE_KEY }} - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ steps.generate_token.outputs.token }} fetch-depth: 0 diff --git a/.github/workflows/init_kosli.yml b/.github/workflows/init_kosli.yml index bd0eac8f2..2bf47eae9 100644 --- a/.github/workflows/init_kosli.yml +++ b/.github/workflows/init_kosli.yml @@ -44,13 +44,13 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ inputs.checkout_ref || github.sha }} - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} diff --git a/.github/workflows/install-script-tests.yml b/.github/workflows/install-script-tests.yml index e24a09b75..2f762fac9 100644 --- a/.github/workflows/install-script-tests.yml +++ b/.github/workflows/install-script-tests.yml @@ -38,7 +38,7 @@ jobs: egress-policy: audit - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run install script test shell: bash @@ -57,7 +57,7 @@ jobs: egress-policy: audit - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run Homebrew install shell: bash diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 5664d1712..632c58ad1 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -32,7 +32,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} diff --git a/.github/workflows/never_alone_trail.yml b/.github/workflows/never_alone_trail.yml index 3b21b37cf..93eb3d74d 100644 --- a/.github/workflows/never_alone_trail.yml +++ b/.github/workflows/never_alone_trail.yml @@ -45,12 +45,12 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e238d702c..b778e9ca6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,7 +35,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get tag id: tag @@ -146,12 +146,12 @@ jobs: egress-policy: audit - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: '.go-version' check-latest: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0b1a65411..e4710bd83 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -78,17 +78,17 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.checkout_ref || github.sha }} - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: '.go-version' check-latest: true - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} @@ -127,18 +127,18 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # needed for some tests referencing older commits ref: ${{ inputs.checkout_ref || github.sha }} - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: '.go-version' check-latest: true - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} @@ -204,7 +204,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.checkout_ref || github.sha }} @@ -212,7 +212,7 @@ jobs: uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} @@ -257,7 +257,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.checkout_ref || github.sha }} @@ -265,7 +265,7 @@ jobs: uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 - name: setup-kosli-cli - uses: kosli-dev/setup-cli-action@v5 + uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4 with: version: ${{ vars.KOSLI_CLI_VERSION }} diff --git a/.github/workflows/upload-cli-layer.yml b/.github/workflows/upload-cli-layer.yml index 0962d7d55..4de19d49a 100644 --- a/.github/workflows/upload-cli-layer.yml +++ b/.github/workflows/upload-cli-layer.yml @@ -25,7 +25,7 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v6 From 7c7555ff7ddc5c144ad797a850f561f02b91a34c Mon Sep 17 00:00:00 2001 From: Marko Bevc Date: Thu, 5 Nov 2026 23:11:50 +0000 Subject: [PATCH 4/5] ci: track main again for kosli-dev/reusable-actions reusable-actions has no version tags, and Dependabot only moves a SHA pin when the action's repository has at least one tag, so the pin would go stale. It is our own repository, so following main keeps fixes flowing to every workflow without a manual bump. --- .github/workflows/daily-cli-tests.yml | 2 +- .github/workflows/main.yml | 2 +- .github/workflows/release.yml | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 7e5674466..465392504 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -103,7 +103,7 @@ jobs: egress-policy: audit - name: Slack Notification on Failure - uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@2f03451c333eea1b7ae07b48d5c887e737136cdb # main + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 632c58ad1..2cd59a21e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -148,7 +148,7 @@ jobs: egress-policy: audit - name: Slack Notification on Failure - uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@2f03451c333eea1b7ae07b48d5c887e737136cdb # main + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b778e9ca6..13b5e68a4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: with: egress-policy: audit - - uses: kosli-dev/reusable-actions/slack-release-notify@2f03451c333eea1b7ae07b48d5c887e737136cdb # main + - uses: kosli-dev/reusable-actions/slack-release-notify@main with: slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} slack-channel-id: ${{ vars.SLACK_CHANNEL_ID }} @@ -335,7 +335,7 @@ jobs: egress-policy: audit - name: Slack Notification on Failure - uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@2f03451c333eea1b7ae07b48d5c887e737136cdb # main + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} @@ -376,7 +376,7 @@ jobs: echo "value=failure" >> "$GITHUB_OUTPUT" fi - - uses: kosli-dev/reusable-actions/slack-release-notify@2f03451c333eea1b7ae07b48d5c887e737136cdb # main + - uses: kosli-dev/reusable-actions/slack-release-notify@main with: slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} slack-channel-id: ${{ vars.SLACK_CHANNEL_ID }} From cdab3284493aecc1e32924a850fda4286c4df1bb Mon Sep 17 00:00:00 2001 From: Marko Bevc Date: Thu, 5 Nov 2026 23:11:50 +0000 Subject: [PATCH 5/5] ci: pin every remaining tagged action to a commit SHA The rest of the third-party and first-party actions still resolved their tag at job start. Most run next to secrets or write tokens: AWS OIDC credentials, registry pushes, attestations, the codecov token, the GitHub App token in the Helm workflow, and the cross-repo PATs that peter-evans/repository-dispatch receives in the release workflow. Each pin is the commit its tag points at today, labelled with the most specific version tag at that commit, so behaviour is unchanged and Dependabot can keep the pins current. kosli-dev/reusable-actions is the only action left on a branch, as its repository has no tags. --- .github/workflows/binary_provenance.yml | 6 +++--- .github/workflows/daily-cli-tests.yml | 2 +- .github/workflows/docker.yml | 18 +++++++++--------- .github/workflows/helm-chart.yml | 8 ++++---- .github/workflows/init_kosli.yml | 2 +- .github/workflows/pr-checks.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/test.yml | 8 ++++---- .github/workflows/upload-cli-layer.yml | 2 +- 9 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/binary_provenance.yml b/.github/workflows/binary_provenance.yml index 13b092219..16201ec81 100644 --- a/.github/workflows/binary_provenance.yml +++ b/.github/workflows/binary_provenance.yml @@ -41,7 +41,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{inputs.dir}} path: ${{ github.workspace }}/${{inputs.dir}} @@ -59,7 +59,7 @@ jobs: - name: Attest Build Provenance id: artifact-gh-attest - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-name: ${{matrix.artifact.template_name}} subject-digest: sha256:${{ env.FINGERPRINT }} @@ -94,7 +94,7 @@ jobs: - name: Attest SBOM to Github id: sbom-gh-attest - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: sbom-path: '${{matrix.artifact.template_name}}-sbom.spdx.json' subject-name: ${{matrix.artifact.template_name}} diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 465392504..6b3509477 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -72,7 +72,7 @@ jobs: check-latest: true - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: arn:aws:iam::772819027869:role/cli aws-region: eu-central-1 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 8f51a1422..d292f3bc5 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -145,11 +145,11 @@ jobs: ref: ${{ inputs.checkout_ref || github.sha }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 # No QEMU needed — each runner is already native for its platform - name: Login to GitHub Container Registry - uses: docker/login-action@v4.7.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -157,7 +157,7 @@ jobs: - name: Build and push by digest id: build - uses: docker/build-push-action@v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . build-args: | @@ -179,7 +179,7 @@ jobs: DIGEST: ${{ steps.build.outputs.digest }} - name: Upload digest artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: digest-${{ matrix.slug }} path: /tmp/digests/* @@ -226,17 +226,17 @@ jobs: check-latest: true - name: Download all digest artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: /tmp/digests pattern: digest-* merge-multiple: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to GitHub Container Registry - uses: docker/login-action@v4.7.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -282,7 +282,7 @@ jobs: echo "FINGERPRINT=$ARTIFACT_SHA" >> ${GITHUB_ENV} - name: Attest Build Provenance - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-name: ${{ env.IMAGE }} subject-digest: ${{ steps.docker_build.outputs.digest }} @@ -321,7 +321,7 @@ jobs: fi - name: Attest SBOM to Github - uses: actions/attest@v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: sbom-path: 'sbom.spdx.json' subject-name: ${{ env.IMAGE }} diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml index d812753d1..ded1c3186 100644 --- a/.github/workflows/helm-chart.yml +++ b/.github/workflows/helm-chart.yml @@ -23,7 +23,7 @@ jobs: - name: Generate token id: generate_token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: app-id: ${{ vars.CI_SIGNED_COMMIT_APP_ID }} private-key: ${{ secrets.CI_SIGNED_COMMIT_APP_PRIVATE_KEY }} @@ -34,7 +34,7 @@ jobs: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v5 + uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 with: version: 'latest' @@ -59,7 +59,7 @@ jobs: # Configure AWS credentials - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: arn:aws:iam::358426185766:role/cli aws-region: eu-central-1 @@ -100,7 +100,7 @@ jobs: GH_TOKEN: ${{ steps.generate_token.outputs.token }} - name: Commit and push changes - uses: planetscale/ghcommit-action@v0.2.22 + uses: planetscale/ghcommit-action@a6b150b81dca5dd027baa898604418eec9e11465 # v0.2.22 with: commit_message: 'Update helm docs' repo: ${{ github.repository }} diff --git a/.github/workflows/init_kosli.yml b/.github/workflows/init_kosli.yml index 2bf47eae9..9c61875b9 100644 --- a/.github/workflows/init_kosli.yml +++ b/.github/workflows/init_kosli.yml @@ -55,7 +55,7 @@ jobs: version: ${{ vars.KOSLI_CLI_VERSION }} - - uses: haya14busa/action-cond@v1 + - uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1 id: description with: cond: ${{ inputs.flow_name == 'cli-release' }} diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index f7f0318a1..ec99f6926 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -26,7 +26,7 @@ jobs: egress-policy: audit - name: PR Conventional Commit Validation - uses: ytanikin/pr-conventional-commits@1.5.2 + uses: ytanikin/pr-conventional-commits@639145d78959c53c43112365837e3abd21ed67c1 # 1.5.2 with: task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]' add_label: 'true' @@ -46,7 +46,7 @@ jobs: - name: Label PRs id: label-prs - uses: actions/labeler@v7 + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} sync-labels: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13b5e68a4..f12a12e6c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -199,7 +199,7 @@ jobs: - name: Copy npm packages into dist for provenance run: find npm -name "*.tgz" -exec cp {} dist/ \; - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dist path: dist @@ -258,7 +258,7 @@ jobs: egress-policy: audit - name: Repository Dispatch - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.DOCS_REPO_ACCESS_TOKEN }} repository: kosli-dev/docs @@ -275,7 +275,7 @@ jobs: egress-policy: audit - name: Repository Dispatch - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.KOSLI_REPORTER_REPO_ACCESS_TOKEN }} repository: kosli-dev/terraform-aws-evidence-reporter @@ -292,7 +292,7 @@ jobs: egress-policy: audit - name: Repository Dispatch - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.KOSLI_REPORTER_REPO_ACCESS_TOKEN }} repository: kosli-dev/terraform-aws-kosli-reporter diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e4710bd83..093e9d0d0 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -95,7 +95,7 @@ jobs: - name: Run golangci-lint id: lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: latest args: -v @@ -144,7 +144,7 @@ jobs: ${{ vars.KOSLI_CLI_VERSION }} - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/cli aws-region: ${{ inputs.AWS_REGION }} @@ -153,7 +153,7 @@ jobs: - name: Login to Amazon ECR private id: login-ecr-private - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Run tests env: @@ -187,7 +187,7 @@ jobs: - name: Upload coverage reports to Codecov if: ${{ inputs.report_to_kosli != 'none' }} - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 snyk-code-test: if: ${{ inputs.run_snyk }} diff --git a/.github/workflows/upload-cli-layer.yml b/.github/workflows/upload-cli-layer.yml index 4de19d49a..af5baeb60 100644 --- a/.github/workflows/upload-cli-layer.yml +++ b/.github/workflows/upload-cli-layer.yml @@ -28,7 +28,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/cli aws-region: ${{ inputs.AWS_REGION }}