From da37d06d344079f15582a67a8a04c590d17dbd77 Mon Sep 17 00:00:00 2001 From: KiloClaw Security Date: Sun, 28 Jun 2026 04:19:49 +0000 Subject: [PATCH] ci: pin GitHub Actions to full commit SHAs Pin unpinned action references to immutable commit SHAs. Version tags retained as inline comments. See: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions --- .github/workflows/ci.yaml | 14 +++++++------- .github/workflows/e2e.yaml | 6 +++--- .github/workflows/manual.yaml | 8 ++++---- .github/workflows/scripts.yaml | 4 ++-- .github/workflows/website.yaml | 10 +++++----- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 5d9bb1742b4..a57a32a031e 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -48,9 +48,9 @@ jobs: timeout-minutes: 360 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up JDK ${{ matrix.profile.jdk }} - uses: actions/setup-java@v5 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5 with: java-version: ${{ matrix.profile.jdk }} distribution: temurin @@ -67,21 +67,21 @@ jobs: MAVEN_OPTS: -Djansi.force=true - name: Upload unit test results if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: surefire-reports-${{ matrix.profile.name }} path: ./**/target/surefire-reports/ if-no-files-found: ignore - name: Upload integration test results if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: failsafe-reports-${{ matrix.profile.name }} path: ./**/target/failsafe-reports/ if-no-files-found: ignore - name: Upload cppunit test logs if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: cppunit-logs-${{ matrix.profile.name }} path: ./zookeeper-client/zookeeper-client-c/target/c/TEST-*.txt @@ -93,9 +93,9 @@ jobs: if: ${{ github.event_name == 'pull_request' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Check typos - uses: crate-ci/typos@v1.22.4 + uses: crate-ci/typos@acbff432fb0e7c8cbb9f032311d8f13927dbaaf3 # v1.22.4 # To run the typo check locally, you can follow these steps: # 1. Install typos locally using cargo: # cargo install typos-cli diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index d912c3929fa..1a5feb04c66 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -31,9 +31,9 @@ jobs: timeout-minutes: 360 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up JDK ${{ matrix.jdk }} - uses: actions/setup-java@v5 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5 with: java-version: ${{ matrix.jdk }} distribution: temurin @@ -51,7 +51,7 @@ jobs: - name: Cache ZooKeeper ${{ matrix.zk }} id: dist-cache if: matrix.zk != 'nightly' - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: key: apache-zookeeper-${{ matrix.zk }}-bin.tar.gz path: apache-zookeeper-${{ matrix.zk }}-bin.tar.gz diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml index 0c9d01565d2..d45612e016f 100644 --- a/.github/workflows/manual.yaml +++ b/.github/workflows/manual.yaml @@ -43,11 +43,11 @@ jobs: timeout-minutes: 360 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: ref: ${{ github.event.inputs.buildRef }} - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5 with: java-version: 17 distribution: temurin @@ -64,14 +64,14 @@ jobs: MAVEN_OPTS: -Djansi.force=true - name: Upload unit test results if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: surefire-reports path: ./**/target/surefire-reports/ if-no-files-found: ignore - name: Upload integration test results if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: failsafe-reports path: ./**/target/failsafe-reports/ diff --git a/.github/workflows/scripts.yaml b/.github/workflows/scripts.yaml index 98217b74700..fadd41ed7e6 100644 --- a/.github/workflows/scripts.yaml +++ b/.github/workflows/scripts.yaml @@ -36,7 +36,7 @@ jobs: timeout-minutes: 3 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Show the first log message run: git log -n1 - name: Install shfmt @@ -49,7 +49,7 @@ jobs: timeout-minutes: 3 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Show the first log message run: git log -n1 - name: Install shfmt diff --git a/.github/workflows/website.yaml b/.github/workflows/website.yaml index a5110130824..0e374a854f4 100644 --- a/.github/workflows/website.yaml +++ b/.github/workflows/website.yaml @@ -32,15 +32,15 @@ jobs: timeout-minutes: 120 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up JDK 25 - uses: actions/setup-java@v5 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5 with: java-version: 25 distribution: temurin cache: 'maven' - name: Set up Node.js 22 - uses: actions/setup-node@v5 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 with: node-version: 22 cache: 'npm' @@ -59,14 +59,14 @@ jobs: MAVEN_OPTS: -Djansi.force=true - name: Upload website Playwright report if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: website-playwright-report path: zookeeper-website/playwright-report/ if-no-files-found: ignore - name: Upload website test results if: ${{ failure() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: website-test-results path: zookeeper-website/test-results/