Skip to content

Pin GitHub Actions to commit SHAs #285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tas50 wants to merge 1 commit into
base: main
Choose a base branch
from
+26 −10
Open

Pin GitHub Actions to commit SHAs #285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
---
version: 2
updates:
- package-ecosystem: bundler
directory: "/"
schedule:
interval: weekly

# Workflow actions are pinned to immutable commit SHAs, so nothing bumps them
# without Dependabot. It reads the trailing "# vX.Y.Z" comment on each `uses:`
# to know the current version and rewrites both the SHA and the comment.
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: weekly
2 changes: 1 addition & 1 deletion .github/workflows/allchecks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
checks: read
contents: read
steps:
- uses: wechuli/allcheckspassed@v1
- uses: wechuli/allcheckspassed@e22f45a4f25f4cf821d1273705ac233355400db1 # v1.2.0
with:
# This seems to be working lately even for external
# contributors, so maybe we don't need to exclude it?
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/dco.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ jobs:
name: DCO Check
steps:
- name: Get PR Commits
uses: actionshub/get-pr-commits@main
uses: actionshub/get-pr-commits@0f1d778e95718cdf9a80f57d36c0a8754e874fa1 # v2.0.0
id: 'get-pr-commits'
with:
token: ${{ secrets.GITHUB_TOKEN }}
- name: DCO Check
uses: actionshub/dco@main
uses: actionshub/dco@624651527997baebfe5fd772d216f9c77bfd40f3 # v2.0.0
with:
commits: ${{ steps.get-pr-commits.outputs.commits }}
allow-obvious-fix-label: "obvious-fix"
15 changes: 8 additions & 7 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,30 +17,31 @@ jobs:
env:
BUNDLE_WITHOUT: ruby_shadow:packaging
steps:
- uses: actions/checkout@v6
- uses: ruby/setup-ruby@v1
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
with:
ruby-version: 3.4
bundler-cache: false
- uses: r7kamura/rubocop-problem-matchers-action@v1 # this shows the failures in the PR
# shows the failures in the PR
- uses: r7kamura/rubocop-problem-matchers-action@59f1a0759f50cc2649849fd850b8487594bb5a81 # v1.2.2
- run: |
bundle install
bundle exec cookstyle --chefstyle -c .rubocop.yml

spellcheck:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- run: |
curl --location 'https://raw.githubusercontent.com/chef/chef_dictionary/main/chef.txt' --output chef_dictionary.txt
- uses: streetsidesoftware/cspell-action@v8.4.0
- uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8.4.0

linelint:
runs-on: ubuntu-latest
name: Check if all files end in newline
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Linelint
uses: fernandrone/linelint@master
uses: fernandrone/linelint@7907a5dca0c28ea7dd05c6d8d8cacded713aca11 # 0.0.6
id: linelint
Loading