Skip to content

Commit 51deade

Browse files
Pin our GitHub Actions dependencies (#18255)
After the [recent supply chain attack](https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup) in `tj-actions/changed-files` and actions based on it, it's become clear that relying on git tags to pin our dependencies is not enough (as tags can simply be replaced). Therefore we need to switch to hashes. Dependabot should continue to update these dependencies for us. Best reviewed commit-by-commit. Though if CI passes, we're *probably* fine.
1 parent 47e295b commit 51deade

14 files changed

+145
-144
lines changed

.github/workflows/docker.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -18,22 +18,22 @@ jobs:
1818
steps:
1919
- name: Set up QEMU
2020
id: qemu
21-
uses: docker/setup-qemu-action@v3
21+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
2222
with:
2323
platforms: arm64
2424

2525
- name: Set up Docker Buildx
2626
id: buildx
27-
uses: docker/setup-buildx-action@v3
27+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
2828

2929
- name: Inspect builder
3030
run: docker buildx inspect
3131

3232
- name: Install Cosign
33-
uses: sigstore/[email protected]
33+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
3434

3535
- name: Checkout repository
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3737

3838
- name: Extract version from pyproject.toml
3939
# Note: explicitly requesting bash will mean bash is invoked with `-eo pipefail`, see
@@ -43,21 +43,21 @@ jobs:
4343
echo "SYNAPSE_VERSION=$(grep "^version" pyproject.toml | sed -E 's/version\s*=\s*["]([^"]*)["]/\1/')" >> $GITHUB_ENV
4444
4545
- name: Log in to DockerHub
46-
uses: docker/login-action@v3
46+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
4747
with:
4848
username: ${{ secrets.DOCKERHUB_USERNAME }}
4949
password: ${{ secrets.DOCKERHUB_TOKEN }}
5050

5151
- name: Log in to GHCR
52-
uses: docker/login-action@v3
52+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
5353
with:
5454
registry: ghcr.io
5555
username: ${{ github.repository_owner }}
5656
password: ${{ secrets.GITHUB_TOKEN }}
5757

5858
- name: Calculate docker image tag
5959
id: set-tag
60-
uses: docker/metadata-action@master
60+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
6161
with:
6262
images: |
6363
docker.io/matrixdotorg/synapse
@@ -72,7 +72,7 @@ jobs:
7272
7373
- name: Build and push all platforms
7474
id: build-and-push
75-
uses: docker/build-push-action@v6
75+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
7676
with:
7777
push: true
7878
labels: |

.github/workflows/docs-pr-netlify.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
path: book
2323

2424
- name: 📤 Deploy to Netlify
25-
uses: matrix-org/netlify-pr-preview@v3
25+
uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
2626
with:
2727
path: book
2828
owner: ${{ github.event.workflow_run.head_repository.owner.login }}

.github/workflows/docs-pr.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
name: GitHub Pages
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1717
with:
1818
# Fetch all history so that the schema_versions script works.
1919
fetch-depth: 0
@@ -24,7 +24,7 @@ jobs:
2424
mdbook-version: '0.4.17'
2525

2626
- name: Setup python
27-
uses: actions/setup-python@v5
27+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
2828
with:
2929
python-version: "3.x"
3030

@@ -39,7 +39,7 @@ jobs:
3939
cp book/welcome_and_overview.html book/index.html
4040
4141
- name: Upload Artifact
42-
uses: actions/upload-artifact@v4
42+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
4343
with:
4444
name: book
4545
path: book
@@ -50,7 +50,7 @@ jobs:
5050
name: Check links in documentation
5151
runs-on: ubuntu-latest
5252
steps:
53-
- uses: actions/checkout@v4
53+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454

5555
- name: Setup mdbook
5656
uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0

.github/workflows/docs.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
needs:
5151
- pre
5252
steps:
53-
- uses: actions/checkout@v4
53+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454
with:
5555
# Fetch all history so that the schema_versions script works.
5656
fetch-depth: 0
@@ -64,7 +64,7 @@ jobs:
6464
run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
6565

6666
- name: Setup python
67-
uses: actions/setup-python@v5
67+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
6868
with:
6969
python-version: "3.x"
7070

.github/workflows/fix_lint.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,19 @@ jobs:
1313

1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v4
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1717

1818
- name: Install Rust
19-
uses: dtolnay/rust-toolchain@master
19+
uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master (rust 1.85.1)
2020
with:
2121
# We use nightly so that `fmt` correctly groups together imports, and
2222
# clippy correctly fixes up the benchmarks.
2323
toolchain: nightly-2022-12-01
2424
components: clippy, rustfmt
25-
- uses: Swatinem/rust-cache@v2
25+
- uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
2626

2727
- name: Setup Poetry
28-
uses: matrix-org/setup-python-poetry@v1
28+
uses: matrix-org/setup-python-poetry@4421c92b6223f03ae55560e29aa8ebd39cf6314a # v1.2.4
2929
with:
3030
install-project: "false"
3131

@@ -43,6 +43,6 @@ jobs:
4343
- run: cargo fmt
4444
continue-on-error: true
4545

46-
- uses: stefanzweifel/git-auto-commit-action@v5
46+
- uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0
4747
with:
4848
commit_message: "Attempt to fix linting"

.github/workflows/latest_deps.yml

+16-16
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,14 @@ jobs:
3939
if: needs.check_repo.outputs.should_run_workflow == 'true'
4040
runs-on: ubuntu-latest
4141
steps:
42-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4343
- name: Install Rust
44-
uses: dtolnay/rust-toolchain@stable
45-
- uses: Swatinem/rust-cache@v2
44+
uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
45+
- uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
4646

4747
# The dev dependencies aren't exposed in the wheel metadata (at least with current
4848
# poetry-core versions), so we install with poetry.
49-
- uses: matrix-org/setup-python-poetry@v1
49+
- uses: matrix-org/setup-python-poetry@4421c92b6223f03ae55560e29aa8ebd39cf6314a # v1.2.4
5050
with:
5151
python-version: "3.x"
5252
poetry-version: "1.3.2"
@@ -72,11 +72,11 @@ jobs:
7272
postgres-version: "14"
7373

7474
steps:
75-
- uses: actions/checkout@v4
75+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7676

7777
- name: Install Rust
78-
uses: dtolnay/rust-toolchain@stable
79-
- uses: Swatinem/rust-cache@v2
78+
uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
79+
- uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
8080

8181
- run: sudo apt-get -qq install xmlsec1
8282
- name: Set up PostgreSQL ${{ matrix.postgres-version }}
@@ -86,7 +86,7 @@ jobs:
8686
-e POSTGRES_PASSWORD=postgres \
8787
-e POSTGRES_INITDB_ARGS="--lc-collate C --lc-ctype C --encoding UTF8" \
8888
postgres:${{ matrix.postgres-version }}
89-
- uses: actions/setup-python@v5
89+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
9090
with:
9191
python-version: "3.x"
9292
- run: pip install .[all,test]
@@ -145,11 +145,11 @@ jobs:
145145
BLACKLIST: ${{ matrix.workers && 'synapse-blacklist-with-workers' }}
146146

147147
steps:
148-
- uses: actions/checkout@v4
148+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
149149

150150
- name: Install Rust
151-
uses: dtolnay/rust-toolchain@stable
152-
- uses: Swatinem/rust-cache@v2
151+
uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
152+
- uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
153153

154154
- name: Ensure sytest runs `pip install`
155155
# Delete the lockfile so sytest will `pip install` rather than `poetry install`
@@ -164,7 +164,7 @@ jobs:
164164
if: ${{ always() }}
165165
run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
166166
- name: Upload SyTest logs
167-
uses: actions/upload-artifact@v4
167+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
168168
if: ${{ always() }}
169169
with:
170170
name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.*, ', ') }})
@@ -192,15 +192,15 @@ jobs:
192192
database: Postgres
193193

194194
steps:
195-
- name: Run actions/checkout@v4 for synapse
196-
uses: actions/checkout@v4
195+
- name: Check out synapse codebase
196+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
197197
with:
198198
path: synapse
199199

200200
- name: Prepare Complement's Prerequisites
201201
run: synapse/.ci/scripts/setup_complement_prerequisites.sh
202202

203-
- uses: actions/setup-go@v5
203+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
204204
with:
205205
cache-dependency-path: complement/go.sum
206206
go-version-file: complement/go.mod
@@ -225,7 +225,7 @@ jobs:
225225
runs-on: ubuntu-latest
226226

227227
steps:
228-
- uses: actions/checkout@v4
228+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
229229
- uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
230230
env:
231231
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/poetry_lockfile.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ jobs:
1616
name: "Check locked dependencies have sdists"
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v4
20-
- uses: actions/setup-python@v5
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
2121
with:
2222
python-version: '3.x'
2323
- run: pip install tomli

.github/workflows/push_complement_image.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -33,29 +33,29 @@ jobs:
3333
packages: write
3434
steps:
3535
- name: Checkout specific branch (debug build)
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3737
if: github.event_name == 'workflow_dispatch'
3838
with:
3939
ref: ${{ inputs.branch }}
4040
- name: Checkout clean copy of develop (scheduled build)
41-
uses: actions/checkout@v4
41+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4242
if: github.event_name == 'schedule'
4343
with:
4444
ref: develop
4545
- name: Checkout clean copy of master (on-push)
46-
uses: actions/checkout@v4
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4747
if: github.event_name == 'push'
4848
with:
4949
ref: master
5050
- name: Login to registry
51-
uses: docker/login-action@v3
51+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
5252
with:
5353
registry: ghcr.io
5454
username: ${{ github.actor }}
5555
password: ${{ secrets.GITHUB_TOKEN }}
5656
- name: Work out labels for complement image
5757
id: meta
58-
uses: docker/metadata-action@v5
58+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
5959
with:
6060
images: ghcr.io/${{ github.repository }}/complement-synapse
6161
tags: |

0 commit comments

Comments
 (0)