Updated to pin commits to actions and name all steps

Signed-off-by: Roger Barker <[email protected]>
hashgraph · May 28, 2024 · dd6b228 · dd6b228
1 parent 483566e
commit dd6b228
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 25 deletions.
diff --git a/.github/workflows/chart-lint-test.yaml b/.github/workflows/chart-lint-test.yaml
@@ -21,23 +21,23 @@ jobs:
         egress-policy: audit
 
     - name: Checkout
-      uses: actions/[email protected].0
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
       with:
         fetch-depth: 0
 
     - name: Setup Helm
-      uses: azure/setup-helm@v3.5
+      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
       with:
         version: 'v3.13.0'
 
     # ct (chart testing) requires python
     - name: Setup Python
-      uses: actions/setup-python@v4.7.1
+      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
       with:
         python-version: '3.x'
 
     - name: Install chart-testing
-      uses: helm/[email protected]
+      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
 
     - name: Run chart-testing (list-changed)
       id: list-changed
@@ -51,7 +51,7 @@ jobs:
       run: ct lint --config .github/ct.yaml
 
     - name: Create kind cluster
-      uses: helm/kind-action@v1.8.0
+      uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
       if: steps.list-changed.outputs.changed == 'true'
 
     - name: Run chart-testing (install)

diff --git a/.github/workflows/flow-pr-title-check.yaml b/.github/workflows/flow-pr-title-check.yaml
@@ -45,6 +45,6 @@ jobs:
           egress-policy: audit
 
       - name: Check PR Title
-        uses: aslafy-z/conventional-pr-title-action@v3
+        uses: aslafy-z/conventional-pr-title-action@a0b851005a0f82ac983a56ead5a8111c0d8e044a # v3.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-image-to-github.yaml b/.github/workflows/release-image-to-github.yaml
@@ -23,7 +23,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: 'true'
 
@@ -34,20 +34,20 @@ jobs:
         run: ./scripts/hedera-apply-h5ai-nginx-patch.sh
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Qemu
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
 
       - name: Build and push UI image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: ./ui
           file: ./ui/Dockerfile
@@ -56,7 +56,7 @@ jobs:
           tags: ${{ env.REGISTRY }}/${{ github.repository }}:ui-${{env.TAG}}
 
       - name: Build and push SERVER image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: .
           file: ./src/Dockerfile.server
@@ -65,7 +65,7 @@ jobs:
           tags: ${{ env.REGISTRY }}/${{ github.repository }}:server-${{env.TAG}}
 
       - name: Build and Push REPOSITORY Image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: ./h5ai-nginx
           file: ./h5ai-nginx/Dockerfile

diff --git a/.github/workflows/release-integration.yml b/.github/workflows/release-integration.yml
@@ -29,7 +29,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: true
       - name: Apply Sourcify server patch customizations
@@ -46,20 +46,20 @@ jobs:
           fi
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Qemu
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
 
       - name: Build and push UI image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: ./ui
           file: ./ui/Dockerfile
@@ -68,7 +68,7 @@ jobs:
           tags: ${{ env.REGISTRY }}/${{ github.repository }}/ui:${{env.TAG}}
 
       - name: Build and push SERVER image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: ./sourcify
 
@@ -86,7 +86,7 @@ jobs:
           tags: ${{ env.REGISTRY }}/${{ github.repository }}/server:${{env.TAG}}
 
       - name: Build and Push REPOSITORY Image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: ./h5ai-nginx
 

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
@@ -14,10 +14,12 @@ jobs:
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
-      - uses: actions/checkout@v3
+      - name: Checkout Code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: true
-      - uses: actions/setup-node@v3
+      - name: Setup node
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 18
       - name: Apply Sourcify server patch customizations
@@ -41,10 +43,12 @@ jobs:
           egress-policy: audit
 
 
-      - uses: actions/checkout@v3
+      - name: Checkout Code
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: true
-      - uses: actions/setup-node@v3
+      - name: Setup Node
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 18
       - name: Apply Sourcify server patch customizations
@@ -64,7 +68,7 @@ jobs:
           (npm run server:start&)
 
       - name: Wait for hedera-sourcify server
-        uses: iFaxity/wait-on-action@v1
+        uses: iFaxity/wait-on-action@a7d13170ec542bdca4ef8ac4b15e9c6aa00a6866 # v1.2.1
         with:
           resource: http://127.0.0.1:5555/chains