Skip to content

Commit 45a70b8

Browse files
kruskallkruskall
authored
ci: pin actions to specific commits (#3107)
* ci: pin actions to digest replace mutable tag with digest to improve security and reproducibility * ci: pin more actions * ci: pin more actions * ci: pin more actions * ci: pin more actions
1 parent abd55b3 commit 45a70b8

36 files changed

+126
-126
lines changed

‎.github/actions/aws-asset-inventory-ci/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,15 @@ runs:
5252

5353
- name: Upload test results
5454
if: ${{ always() }}
55-
uses: actions/upload-artifact@v4
55+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
5656
with:
5757
name: allure-results-ci-aws-asset-inventory
5858
path: tests/allure/results/
5959
overwrite: true
6060

6161
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
6262
name: Upload cloudbeat logs
63-
uses: actions/upload-artifact@v4
63+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6464
with:
6565
name: cloubeat-logs-ci-aws-asset-inventory
6666
path: logs/

‎.github/actions/aws-ci/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,15 @@ runs:
5252

5353
- name: Upload test results
5454
if: ${{ always() }}
55-
uses: actions/upload-artifact@v4
55+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
5656
with:
5757
name: allure-results-ci-aws
5858
path: tests/allure/results/
5959
overwrite: true
6060

6161
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
6262
name: Upload cloudbeat logs
63-
uses: actions/upload-artifact@v4
63+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6464
with:
6565
name: cloubeat-logs-ci-aws
6666
path: logs/

‎.github/actions/azure-asset-inventory-ci/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,15 @@ runs:
5353

5454
- name: Upload test results
5555
if: ${{ always() }}
56-
uses: actions/upload-artifact@v4
56+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
5757
with:
5858
name: allure-results-ci-azure
5959
path: tests/allure/results/
6060
overwrite: true
6161

6262
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
6363
name: Upload cloudbeat logs
64-
uses: actions/upload-artifact@v4
64+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6565
with:
6666
name: cloubeat-logs-ci-azure
6767
path: logs/

‎.github/actions/azure-ci/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,15 @@ runs:
5353

5454
- name: Upload test results
5555
if: ${{ always() }}
56-
uses: actions/upload-artifact@v4
56+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
5757
with:
5858
name: allure-results-ci-azure
5959
path: tests/allure/results/
6060
overwrite: true
6161

6262
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
6363
name: Upload cloudbeat logs
64-
uses: actions/upload-artifact@v4
64+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6565
with:
6666
name: cloubeat-logs-ci-azure
6767
path: logs/

‎.github/actions/cnvm-ci/action.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ runs:
2727
elk-version: ${{ inputs.elk-version }}
2828

2929
- name: Configure AWS credentials
30-
uses: aws-actions/configure-aws-credentials@v4
30+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
3131
with:
3232
aws-access-key-id: ${{ inputs.aws-access-key-id }}
3333
aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
@@ -55,15 +55,15 @@ runs:
5555
5656
- name: Upload test results
5757
if: ${{ always() }}
58-
uses: actions/upload-artifact@v4
58+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
5959
with:
6060
name: allure-results-ci-cnvm
6161
path: tests/allure/results/
6262
overwrite: true
6363

6464
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
6565
name: Upload cloudbeat logs
66-
uses: actions/upload-artifact@v4
66+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6767
with:
6868
name: cloubeat-logs-ci-cnvm
6969
path: logs/

‎.github/actions/docker-images/action.yml

+7-7
Original file line numberDiff line numberDiff line change
@@ -58,18 +58,18 @@ runs:
5858
5959
- if: ${{ inputs.build-docker-images == 'true' }}
6060
name: Set up Docker Buildx
61-
uses: docker/setup-buildx-action@v3
61+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
6262

6363
- if: ${{ inputs.build-docker-images == 'true' }}
6464
name: Cache docker build cache
65-
uses: actions/cache@v4
65+
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
6666
with:
6767
path: ${{ inputs.docker-build-cache-folder }}
6868
key: ci-buildx-${{ runner.os }}-${{ runner.arch }}-${{ github.workflow }}
6969

7070
- if: ${{ inputs.build-docker-images == 'true' }}
7171
name: Build cloudbeat-docker image
72-
uses: docker/build-push-action@v5
72+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
7373
with:
7474
context: .
7575
file: ./deploy/Dockerfile
@@ -83,7 +83,7 @@ runs:
8383

8484
- if: ${{ inputs.build-docker-images == 'true' }}
8585
name: Build elastic-agent
86-
uses: docker/build-push-action@v5
86+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
8787
env:
8888
GOOS: ${{ inputs.goos }}
8989
GOARCH: ${{ inputs.goarch }}
@@ -103,7 +103,7 @@ runs:
103103

104104
- if: ${{ inputs.build-docker-images == 'true' }}
105105
name: Build pytest-docker
106-
uses: docker/build-push-action@v5
106+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
107107
with:
108108
context: ./tests/.
109109
push: false
@@ -124,7 +124,7 @@ runs:
124124
- if: ${{ inputs.build-docker-images == 'true' }}
125125
name: Upload docker images
126126
# Pin action version to 4.3.4 See https://github.com/actions/upload-artifact/issues/589
127-
uses: actions/upload-artifact@v4.3.4
127+
uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
128128
with:
129129
name: docker-images
130130
path: ${{ inputs.docker-images-folder }}
@@ -134,7 +134,7 @@ runs:
134134

135135
- if: ${{ inputs.build-docker-images == 'false' }}
136136
name: Download docker images
137-
uses: actions/download-artifact@v4
137+
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4
138138
with:
139139
name: docker-images
140140
path: ${{ inputs.docker-images-folder }}

‎.github/actions/gcp-asset-inventory-ci/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,15 @@ runs:
4949

5050
- name: Upload test results
5151
if: ${{ always() }}
52-
uses: actions/upload-artifact@v4
52+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
5353
with:
5454
name: allure-results-ci-gcp-asset-inventory
5555
path: tests/allure/results/
5656
overwrite: true
5757

5858
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
5959
name: Upload cloudbeat logs
60-
uses: actions/upload-artifact@v4
60+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6161
with:
6262
name: cloubeat-logs-ci-gcp-asset-inventory
6363
path: logs/

‎.github/actions/gcp-ci/action.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ runs:
3131

3232
- id: google-auth
3333
name: Authenticate to Google Cloud
34-
uses: google-github-actions/auth@v2
34+
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
3535
with:
3636
workload_identity_provider: ${{ inputs.workload-identity-provider }}
3737
service_account: ${{ inputs.service-account }}
@@ -57,15 +57,15 @@ runs:
5757
5858
- name: Upload test results
5959
if: ${{ always() }}
60-
uses: actions/upload-artifact@v4
60+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6161
with:
6262
name: allure-results-ci-gcp
6363
path: tests/allure/results/
6464
overwrite: true
6565

6666
- if: ${{ failure() || cancelled() || inputs.debug == 'true' }}
6767
name: Upload cloudbeat logs
68-
uses: actions/upload-artifact@v4
68+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6969
with:
7070
name: cloubeat-logs-ci-gcp
7171
path: logs/

‎.github/actions/hermit/action.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ runs:
1010
steps:
1111
- id: free-disk
1212
name: Free Disk Space
13-
uses: jlumbroso/free-disk-space@main
13+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
1414
with:
1515
tool-cache: false
1616
android: true
@@ -32,7 +32,7 @@ runs:
3232
echo "hash=$hash" >> "$GITHUB_OUTPUT"
3333
3434
- id: cache-tools
35-
uses: actions/cache@v4
35+
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
3636
with:
3737
path: |
3838
~/.cache/hermit/pkg
@@ -42,7 +42,7 @@ runs:
4242
key: ci-hermit-env-${{ runner.os }}-${{ steps.hermit-hash.outputs.hash }}
4343

4444
- id: cache-go-deps
45-
uses: actions/cache@v4
45+
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
4646
with:
4747
path: |
4848
~/go/pkg/

‎.github/actions/init-integration/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ runs:
1717
run: mage -v build
1818

1919
- name: Run elasticsearch
20-
uses: elastic/elastic-github-actions/elasticsearch@master
20+
uses: elastic/elastic-github-actions/elasticsearch@dc110609b1cb3024477ead739ca23ab547b8b9ff # master
2121
with:
2222
stack-version: ${{ inputs.elk-version }}
2323
security-enabled: false

‎.github/actions/k8s-ci/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ runs:
6161

6262
- name: Upload Test Results
6363
if: ${{ always() }}
64-
uses: actions/upload-artifact@v4
64+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
6565
with:
6666
name: allure-results-ci-k8s-${{ inputs.test-target }}-${{ inputs.kind-config }}
6767
path: tests/allure/results/

‎.github/actions/kibana-ftr/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,15 @@ runs:
2626
echo "KIBANA_DIR=kibana" >> "${GITHUB_OUTPUT}"
2727
2828
- name: Checkout Kibana Repository
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3030
with:
3131
repository: elastic/kibana
3232
ref: ${{ inputs.kibana_ref }}
3333
fetch-depth: 1
3434
path: ${{ steps.globals.outputs.KIBANA_DIR }}
3535

3636
- name: Setup Node
37-
uses: actions/setup-node@v4
37+
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
3838
with:
3939
node-version-file: ${{ steps.globals.outputs.KIBANA_DIR }}/package.json
4040

‎.github/actions/slack-notification/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
using: "composite"
3333
steps:
3434
- name: Get Vault credentials
35-
uses: hashicorp/vault-action@v2.7.4
35+
uses: hashicorp/vault-action@affa6f04da5c2d55e6e115b7d1b044a6b1af8c74 # v2.7.4
3636
continue-on-error: true
3737
with:
3838
url: ${{ inputs.vault-url }}
@@ -56,7 +56,7 @@ runs:
5656
5757
- name: Send Slack notification
5858
id: send-slack-notification
59-
uses: slackapi/slack-github-action@v1.24.0
59+
uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
6060
env:
6161
SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
6262
with:

‎.github/workflows/arm-template-lint.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
matrix:
2121
template: [ "ARM-for-organization-account", "ARM-for-single-account" ]
2222
steps:
23-
- uses: actions/checkout@v4
23+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
2424

2525
# Copy files to its own folder because it's what the official ARM-TTK action expects
2626
# Docs https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/test-toolkit#test-parameters
@@ -30,7 +30,7 @@ jobs:
3030
mkdir ${{ matrix.template }}
3131
cp ${{ matrix.template }}.json ${{ matrix.template }}/azuredeploy.json
3232
33-
- uses: microsoft/action-armttk@v1
33+
- uses: microsoft/action-armttk@71252e1767b6e23ad905bf5c456ebdbc7d7ae1bf # v1
3434
name: lint ${{ matrix.template }}
3535
with:
3636
github_token: ${{ secrets.github_token }}

‎.github/workflows/bump-version.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout Cloudbeat Repo
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3232
with:
3333
ref: ${{ github.ref_name }}
3434
token: ${{ secrets.CLOUDSEC_MACHINE_TOKEN }}

‎.github/workflows/ci-pull_request.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
timeout-minutes: 60
2727
steps:
2828
- name: Check out the repo
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3030

3131
- name: Initialize hermit
3232
shell: bash
@@ -78,7 +78,7 @@ jobs:
7878
timeout-minutes: 60
7979
steps:
8080
- name: Check out the repo
81-
uses: actions/checkout@v4
81+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
8282

8383
- name: Initialize hermit
8484
shell: bash
@@ -97,7 +97,7 @@ jobs:
9797
cat cover.out.tmp | grep -v "mock_.*.go" | grep -v "elastic/cloudbeat/deploy" | grep -v "internal/inventory/asset.go" > cover.out # remove mock files and deploy dir
9898
9999
- name: Upload coverage artifact
100-
uses: actions/upload-artifact@v4
100+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
101101
with:
102102
name: coverage-file
103103
path: cover.out

0 commit comments

Comments
 (0)