Skip to content

Commit d1a7b3c

Browse files
thomasferrandizthomasferrandiz
authored
Merge pull request #2214 from thomasferrandiz/pin-gha-versions
Pin all GHA to a specific SHA commit
2 parents bbc744f + e675a7d commit d1a7b3c

File tree

7 files changed

+49
-42
lines changed

7 files changed

+49
-42
lines changed

‎.github/workflows/build.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -13,33 +13,33 @@ jobs:
1313

1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v4
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
1717

1818
- name: set tag
1919
run: echo "GIT_TAG=$(git describe --tags --always)" >> $GITHUB_ENV
2020

2121
- name: Set up Go 1.x
22-
uses: actions/setup-go@v5
22+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
2323
with:
2424
go-version: ${{ env.GO_VERSION }}
2525

2626
- name: go mod vendor
2727
run: go mod vendor
2828

2929
- name: Set up Docker Buildx
30-
uses: docker/setup-buildx-action@v3
30+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 #v3.10.0
3131

3232
- name: Docker meta
3333
id: meta
34-
uses: docker/metadata-action@v5
34+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 #v5.7.0
3535
with:
3636
images: ${{ env.REPOSITORY }}
3737
flavor: latest=false
3838
tags: |
3939
type=ref, event=branch
4040
4141
- name: Build multi-arch Docker image
42-
uses: docker/build-push-action@v5
42+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 #v6.15.0
4343
with:
4444
context: .
4545
file: images/Dockerfile

‎.github/workflows/codeql-analysis.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -41,16 +41,16 @@ jobs:
4141

4242
steps:
4343
- name: Checkout repository
44-
uses: actions/checkout@v4
44+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
4545

4646
- name: Set up Go 1.x
47-
uses: actions/setup-go@v5
47+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
4848
with:
4949
go-version: ${{ env.GO_VERSION }}
5050

5151
# Initializes the CodeQL tools for scanning.
5252
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@v2
53+
uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
5454
with:
5555
languages: ${{ matrix.language }}
5656
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -73,4 +73,4 @@ jobs:
7373
make dist/flanneld
7474
7575
- name: Perform CodeQL Analysis
76-
uses: github/codeql-action/analyze@v2
76+
uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13

‎.github/workflows/e2eTests.yaml

+5-2
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,18 @@ jobs:
99
timeout-minutes: 90
1010
steps:
1111
- name: Set up Go 1.x
12-
uses: actions/setup-go@v5
12+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
1313
with:
1414
go-version: ^1.23
15+
1516
- name: Check out code into the Go module directory
16-
uses: actions/checkout@v4
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
18+
1719
- name: Run tests
1820
id: testing
1921
continue-on-error: true
2022
run: git fetch --unshallow --all --tags && make test 2>&1 > errors.txt
23+
2124
- name: Show additional logs
2225
if: steps.testing.outcome != 'success'
2326
run: |

‎.github/workflows/golangci-lint.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ jobs:
77
name: lint
88
runs-on: ubuntu-latest
99
steps:
10-
- uses: actions/checkout@v4
11-
- uses: actions/setup-go@v5
10+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
11+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
1212
with:
1313
go-version: "1.23"
1414
cache: false
1515
- name: golangci-lint
16-
uses: golangci/[email protected]
16+
uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 #v6.1.1
1717
with:
1818
version: v1.61.0
1919
args: "--out-${NO_FUTURE}format colored-line-number --skip-dirs='backend/udp' --timeout=5m"

‎.github/workflows/k3s-e2eTests.yml

+5-2
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,15 @@ jobs:
1313
runs-on: ubuntu-latest
1414
timeout-minutes: 90
1515
steps:
16-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
17+
1718
- name: Set up Go 1.x
18-
uses: actions/setup-go@v5
19+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
1920
with:
2021
go-version: ${{ env.GO_VERSION }}
22+
2123
- name: build flannel image
2224
run: make image
25+
2326
- name: run e2e tests with k3s
2427
run: make k3s-e2e-test

‎.github/workflows/release.yml

+23-22
Original file line numberDiff line numberDiff line change
@@ -20,28 +20,28 @@ jobs:
2020

2121
steps:
2222
- name: Checkout repository
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2424

2525
- name: set tag
2626
run: echo "GIT_TAG=$(git describe --tags --always)" >> $GITHUB_ENV
2727

2828
- name: Set up Go 1.x
29-
uses: actions/setup-go@v5
29+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
3030
with:
3131
go-version: ${{ env.GO_VERSION }}
3232

3333
- name: go mod vendor
3434
run: go mod vendor
3535

3636
- name: Set up QEMU
37-
uses: docker/setup-qemu-action@v3
37+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 #v3.6.0
3838

3939
- name: Set up Docker Buildx
40-
uses: docker/setup-buildx-action@v3
40+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 #v3.10.0
4141

4242
- name: Docker meta
4343
id: meta
44-
uses: docker/metadata-action@v5
44+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 #v5.7.0
4545
with:
4646
images: ${{ env.REPOSITORY }}
4747
flavor: latest=false
@@ -50,14 +50,14 @@ jobs:
5050
5151
- name: Log in to Docker Hub
5252
if: github.repository_owner == 'flannel-io' && success()
53-
uses: docker/login-action@v3
53+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
5454
with:
5555
username: ${{ secrets.DOCKER_USERNAME }}
5656
password: ${{ secrets.DOCKER_PASSWORD }}
5757

5858
- name: Build and push Docker image
5959
if: github.repository_owner == 'flannel-io' && success()
60-
uses: docker/build-push-action@v5
60+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 #v5.4.0
6161
with:
6262
context: .
6363
file: images/Dockerfile
@@ -76,41 +76,41 @@ jobs:
7676

7777
steps:
7878
- name: Checkout repository
79-
uses: actions/checkout@v4
79+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
8080

8181
- name: set tag
8282
run: echo "GIT_TAG=$(git describe --tags --always)" >> $GITHUB_ENV
8383

8484
- name: Set up Go 1.x
85-
uses: actions/setup-go@v5
85+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
8686
with:
8787
go-version: ${{ env.GO_VERSION }}
8888

8989
- name: go mod vendor
9090
run: go mod vendor
9191

9292
- name: Set up QEMU
93-
uses: docker/setup-qemu-action@v3
93+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 #v3.6.0
9494

9595
- name: Set up Docker Buildx
96-
uses: docker/setup-buildx-action@v3
96+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 #v3.10.0
9797

9898
- name: Log in to the Container registry
99-
uses: docker/login-action@v3
99+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
100100
with:
101101
registry: ${{ env.REGISTRY }}
102102
username: ${{ github.actor }}
103103
password: ${{ secrets.GITHUB_TOKEN }}
104104

105105
- name: Extract metadata (tags, labels) for Docker
106106
id: meta
107-
uses: docker/metadata-action@v5
107+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 #v5.7.0
108108
with:
109109
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
110110

111111
- name: Build and push Docker image
112112
id: push
113-
uses: docker/build-push-action@v5
113+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 #v5.4.0
114114
with:
115115
context: .
116116
file: images/Dockerfile
@@ -121,7 +121,7 @@ jobs:
121121
build-args: TAG=${{ env.GIT_TAG }}
122122

123123
- name: Generate artifact attestation
124-
uses: actions/attest-build-provenance@v2
124+
uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 #v2.2.3
125125
with:
126126
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
127127
subject-digest: ${{ steps.push.outputs.digest }}
@@ -135,18 +135,18 @@ jobs:
135135

136136
steps:
137137
- name: Checkout repository
138-
uses: actions/checkout@v4
138+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
139139

140140
- name: Set up Go 1.x
141-
uses: actions/setup-go@v5
141+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
142142
with:
143143
go-version: ${{ env.GO_VERSION }}
144144

145145
- name: go mod vendor
146146
run: go mod vendor
147147

148148
- name: Set up QEMU
149-
uses: docker/setup-qemu-action@v3
149+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 #v3.6.0
150150

151151
- name: Build release artifacts
152152
run: make release
@@ -171,7 +171,7 @@ jobs:
171171
runs-on: ubuntu-latest
172172
steps:
173173
- name: Checkout repository
174-
uses: actions/checkout@v4
174+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
175175

176176
- name: Package chart
177177
run: make release-chart release-helm
@@ -182,13 +182,14 @@ jobs:
182182
run: gh release upload ${{ env.GIT_TAG }} dist/flannel.tgz
183183

184184
- name: Setup Pages
185-
uses: actions/configure-pages@v4
185+
uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d #v4.0.0
186186

187187
- name: Upload artifact
188-
uses: actions/upload-pages-artifact@v3
188+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa #v3.0.1
189189
with:
190190
path: 'chart/'
191191

192192
- name: Deploy to GitHub Pages
193193
id: deployment
194-
uses: actions/deploy-pages@v4
194+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e #v4.0.5
195+

‎.github/workflows/trivy.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,10 @@ jobs:
3030
runs-on: ubuntu-latest
3131
steps:
3232
- name: Checkout code
33-
uses: actions/checkout@v4
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
3434

3535
- name: Set up Go 1.x
36-
uses: actions/setup-go@v5
36+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
3737
with:
3838
go-version: ${{ env.GO_VERSION }}
3939

@@ -42,14 +42,14 @@ jobs:
4242
ARCH=amd64 TAG=${{ github.sha }} make image
4343
4444
- name: Run Trivy vulnerability scanner in tarball mode
45-
uses: aquasecurity/trivy-action@0.28.0
45+
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 #v0.30.0
4646
with:
4747
input: ./dist/flanneld-${{ github.sha }}-amd64.docker
4848
severity: 'CRITICAL,HIGH'
4949
format: 'sarif'
5050
output: 'trivy-results.sarif'
5151

5252
- name: Upload Trivy scan results to GitHub Security tab
53-
uses: github/codeql-action/upload-sarif@v2
53+
uses: github/codeql-action/upload-sarif@3f0edd48f812cd4456637edc0d7827a0a89d87b9
5454
with:
5555
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)