From 19a994cde395901d98343277f7fbd52729d710fe Mon Sep 17 00:00:00 2001 From: David Gamero Date: Wed, 5 Aug 2026 11:35:15 -0400 Subject: [PATCH] ci: pin all GitHub Actions to SHAs and slow dependabot to monthly - pin every third-party action/reusable workflow ref to a full commit SHA with a version comment - fold in the pending github-actions group bumps (checkout 7.0.1, codeql-action 4.37.3, setup-go 7.0.0, k8s-deploy v7, action-gh-release 3.0.2) - dependabot: monthly interval, group only minor/patch so majors land as separate PRs --- .../actions/setup-kind-registry/action.yml | 2 +- .github/dependabot.yml | 30 +++++++++++++++---- .github/workflows/check-signed-commits.yml | 2 +- .github/workflows/codeql-analysis.yml | 6 ++-- .github/workflows/integration-install.yml | 2 +- .../workflows/integration-per-language.yml | 18 +++++------ .github/workflows/poll-starter.yml | 6 ++-- .github/workflows/release-and-publish.yml | 8 ++--- 8 files changed, 46 insertions(+), 28 deletions(-) diff --git a/.github/actions/setup-kind-registry/action.yml b/.github/actions/setup-kind-registry/action.yml index cbb6abf1..225e0b03 100644 --- a/.github/actions/setup-kind-registry/action.yml +++ b/.github/actions/setup-kind-registry/action.yml @@ -14,7 +14,7 @@ runs: steps: - name: start kind id: kind - uses: helm/kind-action@v1.13.0 + uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0 with: registry: true registry_name: kind-registry diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 76661a2d..560053f6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,60 +3,78 @@ updates: - package-ecosystem: gomod directory: / schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: go-dependencies: patterns: - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: ".github/workflows" schedule: - interval: weekly + interval: "monthly" cooldown: default-days: 7 groups: github-actions: patterns: - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/template/workflows/helm/.github/workflows" schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: github-actions: patterns: - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/template/workflows/kustomize/.github/workflows" schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: github-actions: patterns: - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/template/workflows/manifests/.github/workflows" schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: github-actions: patterns: - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/.github/actions" schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: github-actions: patterns: - "*" + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/check-signed-commits.yml b/.github/workflows/check-signed-commits.yml index 75d58495..06b09d6b 100644 --- a/.github/workflows/check-signed-commits.yml +++ b/.github/workflows/check-signed-commits.yml @@ -6,6 +6,6 @@ on: jobs: check-signatures: - uses: Azure/action-release-workflows/.github/workflows/check_signed_commits.yaml@v1 + uses: Azure/action-release-workflows/.github/workflows/check_signed_commits.yaml@3c677ba5ab58f5c5c1a6f0cfb176b333b1f27405 # v1 permissions: pull-requests: write diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 9ef6c0d6..54185adb 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -42,7 +42,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.5 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -53,7 +53,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.5 + uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -67,4 +67,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.5 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 diff --git a/.github/workflows/integration-install.yml b/.github/workflows/integration-install.yml index 6e18f10c..73cb2eff 100644 --- a/.github/workflows/integration-install.yml +++ b/.github/workflows/integration-install.yml @@ -17,7 +17,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get Draft Cli version - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 id: get_draft_version with: result-encoding: string diff --git a/.github/workflows/integration-per-language.yml b/.github/workflows/integration-per-language.yml index 65755d16..0a58d8e7 100644 --- a/.github/workflows/integration-per-language.yml +++ b/.github/workflows/integration-per-language.yml @@ -91,7 +91,7 @@ jobs: echo "imagename=${{ steps.kind-registry.outputs.local-registry }}/testapp" >> "$GITHUB_ENV" # Runs Helm to create manifest files - name: Bake deployment - uses: azure/k8s-bake@v4.1.0 + uses: azure/k8s-bake@0191a5ae5126cfe61885d9bd46511caa8e9a9550 # v4.1.0 with: renderEngine: "helm" helmChart: ./langtest/charts @@ -111,7 +111,7 @@ jobs: context: ./langtest/ # Deploys application based on manifest files from previous step - name: Deploy application - uses: Azure/k8s-deploy@v6 + uses: Azure/k8s-deploy@c7ebd0d5f39477a23f1b5dea0f52e6db04adf28e # v6 continue-on-error: true id: deploy with: @@ -159,7 +159,7 @@ jobs: pwd # Validate generated workflow yaml - name: Install action-validator with asdf - uses: asdf-vm/actions/install@v4 + uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4 with: tool_versions: | action-validator 0.1.2 @@ -192,7 +192,7 @@ jobs: name: draft-binary - run: chmod +x ./draft - run: mkdir ./langtest - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ inputs.repo }} path: ./langtest @@ -243,7 +243,7 @@ jobs: name: draft-binary - run: chmod +x ./draft - run: mkdir ./langtest - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{inputs.repo}} path: ./langtest @@ -262,7 +262,7 @@ jobs: run: | echo "imagename=${{ steps.kind-registry.outputs.local-registry }}/testapp" >> "$GITHUB_ENV" - name: Bake deployment - uses: azure/k8s-bake@v4.1.0 + uses: azure/k8s-bake@0191a5ae5126cfe61885d9bd46511caa8e9a9550 # v4.1.0 id: bake with: renderEngine: "kustomize" @@ -276,7 +276,7 @@ jobs: context: ./langtest/ # Deploys application based on manifest files from previous step - name: Deploy application - uses: Azure/k8s-deploy@v6 + uses: Azure/k8s-deploy@c7ebd0d5f39477a23f1b5dea0f52e6db04adf28e # v6 continue-on-error: true id: deploy with: @@ -324,7 +324,7 @@ jobs: pwd # Validate generated workflow yaml - name: Install action-validator with asdf - uses: asdf-vm/actions/install@v4 + uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4 with: tool_versions: | action-validator 0.1.2 @@ -480,7 +480,7 @@ jobs: --variable NAMESPACE=default # Validate generated workflow yaml - name: Install action-validator with asdf - uses: asdf-vm/actions/install@v4 + uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4 with: tool_versions: | action-validator 0.1.2 diff --git a/.github/workflows/poll-starter.yml b/.github/workflows/poll-starter.yml index fba2ab3f..e4edc435 100644 --- a/.github/workflows/poll-starter.yml +++ b/.github/workflows/poll-starter.yml @@ -19,10 +19,10 @@ jobs: pull-requests: write packages: none steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download run information - uses: dawidd6/action-download-artifact@v21 + uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21 continue-on-error: true id: download with: @@ -83,7 +83,7 @@ jobs: - name: Create Pull Request if: ${{ steps.update-workflows.outputs.changes == 'true' }} - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8 with: commit-message: update starter workflows title: Automated Update Starter Workflows diff --git a/.github/workflows/release-and-publish.yml b/.github/workflows/release-and-publish.yml index 7855b277..45924cd9 100644 --- a/.github/workflows/release-and-publish.yml +++ b/.github/workflows/release-and-publish.yml @@ -22,7 +22,7 @@ jobs: # Read changelog and read versions etc. - name: Check version is mentioned in Changelog.md id: changelog_reader - uses: mindsers/changelog-reader-action@v2 + uses: mindsers/changelog-reader-action@1faaf50aa09d5793d9a100819973df801febfb31 # v2 with: validation_depth: 10 path: './CHANGELOG.md' @@ -38,7 +38,7 @@ jobs: - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.26' + go-version: '1.25' # Check if the newest tag already exists - name: Check if tag exist uses: mukunku/tag-exists-action@5c39604fe8aef7e65acb6fbcf96ec580f7680313 # v1.7.0 @@ -54,7 +54,7 @@ jobs: # If the tag already exists, we don't upload release artifacts - name: Update Draft Release Body if: ${{ steps.check-tag-exists.outputs.exists == 'true' }} - uses: softprops/action-gh-release@v3.0.2 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -64,7 +64,7 @@ jobs: # Create Release with artifacts - name: Create Draft Release if: ${{ steps.check-tag-exists.outputs.exists == 'false'}} - uses: softprops/action-gh-release@v3.0.2 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: