Skip to content

ci: pin all tagged actions to commit SHAs and drop two release-workflow actions #1338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbevc1 merged 5 commits into from
Nov 5, 2026
Merged

ci: pin all tagged actions to commit SHAs and drop two release-workflow actions #1338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5984137
ci: pin mutable action refs to commit SHAs
mbevc1 Nov 5, 2026
ad41c25
ci: drop two third-party actions from the release workflow
mbevc1 Nov 5, 2026
92cf251
ci: pin checkout, setup-go and setup-cli-action to commit SHAs
mbevc1 Nov 5, 2026
7c7555f
ci: track main again for kosli-dev/reusable-actions
mbevc1 Nov 5, 2026
cdab328
ci: pin every remaining tagged action to a commit SHA
mbevc1 Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions .github/workflows/binary_provenance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,15 +39,15 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- uses: actions/download-artifact@v8
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
name: ${{inputs.dir}}
path: ${{ github.workspace }}/${{inputs.dir}}

- name: setup-kosli-cli
uses: kosli-dev/setup-cli-action@v5
uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
with:
version:
${{ vars.KOSLI_CLI_VERSION }}
Expand All @@ -59,7 +59,7 @@ jobs:

- name: Attest Build Provenance
id: artifact-gh-attest
uses: actions/attest@v4.2.2
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with:
subject-name: ${{matrix.artifact.template_name}}
subject-digest: sha256:${{ env.FINGERPRINT }}
Expand All @@ -70,7 +70,7 @@ jobs:
echo "ARTIFACT_TLOG_INDEX=$TRANSPARENCY_LOG_INDEX" >> ${GITHUB_ENV}

- name: Generate SBOM for the binary
uses: anchore/sbom-action@v0
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
file: ${{matrix.artifact.path}}
format: 'spdx-json'
Expand All @@ -79,7 +79,7 @@ jobs:
upload-release-assets: false

- name: Generate Cyclone-dx SBOM for the binary
uses: anchore/sbom-action@v0
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
file: ${{matrix.artifact.path}}
format: 'cyclonedx-json'
Expand All @@ -88,13 +88,13 @@ jobs:
upload-release-assets: false

- name: Publish SBOM
uses: anchore/sbom-action/publish-sbom@v0
uses: anchore/sbom-action/publish-sbom@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
sbom-artifact-match: ".*\\.spdx.json$"

- name: Attest SBOM to Github
id: sbom-gh-attest
uses: actions/attest@v4.2.2
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with:
sbom-path: '${{matrix.artifact.template_name}}-sbom.spdx.json'
subject-name: ${{matrix.artifact.template_name}}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/claude-pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

Expand Down Expand Up @@ -131,12 +131,12 @@ jobs:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

- name: Set up Go
uses: actions/setup-go@v7
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: ".go-version"
check-latest: true
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/daily-cli-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Prepare
id: prep
Expand Down Expand Up @@ -64,15 +64,15 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- uses: actions/setup-go@v7
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: '.go-version'
check-latest: true

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
with:
role-to-assume: arn:aws:iam::772819027869:role/cli
aws-region: eu-central-1
Expand Down
30 changes: 15 additions & 15 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 3
# No fetch-tags: the version arrives as a build arg, not from here.
Expand All @@ -145,19 +145,19 @@ jobs:
ref: ${{ inputs.checkout_ref || github.sha }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
# No QEMU needed — each runner is already native for its platform

- name: Login to GitHub Container Registry
uses: docker/login-action@v4.7.0
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push by digest
id: build
uses: docker/build-push-action@v7
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with:
context: .
build-args: |
Expand All @@ -179,7 +179,7 @@ jobs:
DIGEST: ${{ steps.build.outputs.digest }}

- name: Upload digest artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: digest-${{ matrix.slug }}
path: /tmp/digests/*
Expand Down Expand Up @@ -213,37 +213,37 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 3
# The smoke tests mount this workspace into a container.
persist-credentials: false
ref: ${{ inputs.checkout_ref || github.sha }}

- uses: actions/setup-go@v7
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: '.go-version'
check-latest: true

- name: Download all digest artifacts
uses: actions/download-artifact@v8
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
path: /tmp/digests
pattern: digest-*
merge-multiple: true

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

- name: Login to GitHub Container Registry
uses: docker/login-action@v4.7.0
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: setup-kosli-cli
uses: kosli-dev/setup-cli-action@v5
uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
with:
version: ${{ vars.KOSLI_CLI_VERSION }}

Expand Down Expand Up @@ -282,14 +282,14 @@ jobs:
echo "FINGERPRINT=$ARTIFACT_SHA" >> ${GITHUB_ENV}

- name: Attest Build Provenance
uses: actions/attest@v4.2.2
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with:
subject-name: ${{ env.IMAGE }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true

- name: Install syft
uses: anchore/sbom-action/download-syft@v0
uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0

- name: Generate SBOM for the docker image
env:
Expand Down Expand Up @@ -321,15 +321,15 @@ jobs:
fi

- name: Attest SBOM to Github
uses: actions/attest@v4.2.2
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with:
sbom-path: 'sbom.spdx.json'
subject-name: ${{ env.IMAGE }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true

- name: setup Snyk
uses: snyk/actions/setup@master
uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
Comment thread
mbevc1 marked this conversation as resolved.
Resolved

- name: Report Docker image to Kosli
if: ${{ inputs.report_to_kosli != 'none' }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/helm-chart.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,18 +23,18 @@ jobs:

- name: Generate token
id: generate_token
uses: actions/create-github-app-token@v3
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
app-id: ${{ vars.CI_SIGNED_COMMIT_APP_ID }}
private-key: ${{ secrets.CI_SIGNED_COMMIT_APP_PRIVATE_KEY }}

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ steps.generate_token.outputs.token }}
fetch-depth: 0

- name: Set up Helm
uses: azure/setup-helm@v5
uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
with:
version: 'latest'

Expand All @@ -59,7 +59,7 @@ jobs:

# Configure AWS credentials
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
with:
role-to-assume: arn:aws:iam::358426185766:role/cli
aws-region: eu-central-1
Expand Down Expand Up @@ -100,7 +100,7 @@ jobs:
GH_TOKEN: ${{ steps.generate_token.outputs.token }}

- name: Commit and push changes
uses: planetscale/ghcommit-action@v0.2.22
uses: planetscale/ghcommit-action@a6b150b81dca5dd027baa898604418eec9e11465 # v0.2.22
with:
commit_message: 'Update helm docs'
repo: ${{ github.repository }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/init_kosli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,18 +44,18 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
ref: ${{ inputs.checkout_ref || github.sha }}

- name: setup-kosli-cli
uses: kosli-dev/setup-cli-action@v5
uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
with:
version:
${{ vars.KOSLI_CLI_VERSION }}

- uses: haya14busa/action-cond@v1
- uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1
id: description
with:
cond: ${{ inputs.flow_name == 'cli-release' }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/install-script-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Run install script test
shell: bash
Expand All @@ -57,7 +57,7 @@ jobs:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Run Homebrew install
shell: bash
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/never_alone_trail.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,12 +45,12 @@ jobs:
with:
egress-policy: audit

- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

- name: setup-kosli-cli
uses: kosli-dev/setup-cli-action@v5
uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
with:
version: ${{ vars.KOSLI_CLI_VERSION }}

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/pr-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
egress-policy: audit

- name: PR Conventional Commit Validation
uses: ytanikin/pr-conventional-commits@1.5.2
uses: ytanikin/pr-conventional-commits@639145d78959c53c43112365837e3abd21ed67c1 # 1.5.2
with:
task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'
add_label: 'true'
Expand All @@ -46,7 +46,7 @@ jobs:

- name: Label PRs
id: label-prs
uses: actions/labeler@v7
uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
sync-labels: true
Expand Down
Loading
Loading