Skip to content

fix(security): pin and update github actions #898

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davidspek wants to merge 1 commit into
base: master
Choose a base branch
from
+39 −39
Open

fix(security): pin and update github actions #898

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions .github/workflows/on_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,18 +46,18 @@ jobs:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

- name: Login to DockerHub
uses: docker/login-action@v2
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
Expand All @@ -73,7 +73,7 @@ jobs:

- name: Build client for testing
id: build_client
uses: docker/build-push-action@v6
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
push: false
Expand All @@ -86,7 +86,7 @@ jobs:

- name: Build server for testing
id: build_server
uses: docker/build-push-action@v6
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
push: false
Expand Down Expand Up @@ -166,18 +166,18 @@ jobs:
version_suffix: "-alpine"
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

- name: Login to DockerHub
uses: docker/login-action@v2
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
Expand All @@ -201,7 +201,7 @@ jobs:
echo "cache_ref=${repo}:${latest_tag}" >> "$GITHUB_OUTPUT"

- name: Python setup
uses: actions/setup-python@v5
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.11.8'

Expand All @@ -226,7 +226,7 @@ jobs:
cat packages/__packaging__.py

- name: Build and push ${{ matrix.name }}
uses: docker/build-push-action@v6
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
platforms: linux/amd64,linux/arm64
Expand All @@ -246,12 +246,12 @@ jobs:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Python setup
uses: actions/setup-python@v5
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.11.8'

Expand Down Expand Up @@ -308,7 +308,7 @@ jobs:

# Upload package distributions to the release - All assets in one step
- name: Upload assets to release
uses: shogo82148/actions-upload-release-asset@v1.7.5
uses: shogo82148/actions-upload-release-asset@96bc1f0cb850b65efd58a6b5eaa0a69f88d38077 # v1.10.0
with:
upload_url: ${{ github.event.release.upload_url }}
asset_path: |
Expand All @@ -320,7 +320,7 @@ jobs:
# skip-existing allows re-runs to succeed if some files were already uploaded
# verbose enables detailed error messages from PyPI for debugging upload failures
- name: Publish package distributions to PyPI - Opal-Common
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
password: ${{ secrets.PYPI_TOKEN }}
packages-dir: packages/opal-common/dist/
Expand All @@ -331,7 +331,7 @@ jobs:
url: https://pypi.org/p/opal-common/

- name: Publish package distributions to PyPI - Opal-Client
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
password: ${{ secrets.PYPI_TOKEN }}
packages-dir: packages/opal-client/dist/
Expand All @@ -342,7 +342,7 @@ jobs:
url: https://pypi.org/p/opal-client/

- name: Publish package distributions to PyPI - Opal-Server
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
password: ${{ secrets.PYPI_TOKEN }}
packages-dir: packages/opal-server/dist/
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/pre-commit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@ jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: 3.12.x
- name: install pre-commit
run: python -m pip install 'pre-commit<4'
- name: show environment
run: python -m pip freeze --local
- uses: actions/cache@v4
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.cache/pre-commit
key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/sync_opal_plus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,21 +36,21 @@ jobs:

- name: Get Token
id: get_workflow_token
uses: peter-murray/workflow-application-token-action@v1
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
with:
application_id: ${{ secrets.APPLICATION_ID }}
application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
client-id: ${{ secrets.APPLICATION_ID }}
private-key: ${{ secrets.APPLICATION_PRIVATE_KEY }}

- name: Checkout permitio/opal repository
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: permitio/opal
ref: master
path: opal
fetch-depth: 0

- name: Checkout permitio/opal-plus repository
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: permitio/opal-plus
path: opal-plus
Expand Down
26 changes: 13 additions & 13 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,9 @@ jobs:
python-version: ["3.9", "3.10", "3.11", "3.12"]

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v2
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
Expand All @@ -59,15 +59,15 @@ jobs:
steps:
# BUILD PHASE
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Set up QEMU
uses: docker/setup-qemu-action@v1
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v1
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

- name: Docker Compose install
run: |
Expand All @@ -76,7 +76,7 @@ jobs:

- name: Build client
id: build_client
uses: docker/build-push-action@v2
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
push: false
Expand All @@ -89,7 +89,7 @@ jobs:

- name: Build server
id: build_server
uses: docker/build-push-action@v2
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
push: false
Expand All @@ -101,7 +101,7 @@ jobs:
permitio/opal-server:test

- name: Set up Python
uses: actions/setup-python@v2
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.10"

Expand Down Expand Up @@ -134,15 +134,15 @@ jobs:
name: E2E Tests (Alpine)
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Set up QEMU
uses: docker/setup-qemu-action@v1
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v1
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

- name: Docker Compose install
run: |
Expand All @@ -151,7 +151,7 @@ jobs:

- name: Build client (alpine)
id: build_client_alpine
uses: docker/build-push-action@v2
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
push: false
Expand All @@ -164,7 +164,7 @@ jobs:

- name: Build server (alpine)
id: build_server_alpine
uses: docker/build-push-action@v2
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
file: docker/Dockerfile
push: false
Expand Down