From e57bf9221630b975aa7842ca258e8c4208ecdfc3 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 5 Sep 2026 19:42:21 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 + .github/workflows/ci-cd.yml | 76 ++++++++++++------------- .github/workflows/cleanup.yml | 4 +- .github/workflows/codeql.yml | 6 +- .github/workflows/dependency-review.yml | 4 +- 5 files changed, 47 insertions(+), 45 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d49b5e8..1fc467b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -44,6 +44,8 @@ updates: labels: - "dependencies" - "github-actions" + cooldown: + default-days: 7 - package-ecosystem: "devcontainers" directory: "/" diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 2f1742b..2be52e2 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -87,10 +87,10 @@ jobs: if: github.event_name != 'pull_request' || github.event.action != 'closed' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -113,7 +113,7 @@ jobs: run: cd api && npm test - name: Upload build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: build path: | @@ -134,10 +134,10 @@ jobs: if: github.event_name != 'pull_request' || github.event.action != 'closed' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -152,7 +152,7 @@ jobs: run: npx playwright test --project=chromium - name: Upload E2E test report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: playwright-report @@ -181,10 +181,10 @@ jobs: static_web_app_name: ${{ steps.infra.outputs.staticWebAppName }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -215,7 +215,7 @@ jobs: - name: Deploy Infrastructure id: infra - uses: azure/arm-deploy@v2 + uses: azure/arm-deploy@a1361c2c2cd398621955b16ca32e01c65ea340f5 # v2.0.0 with: scope: resourcegroup resourceGroupName: ${{ steps.rg.outputs.name }} @@ -261,15 +261,15 @@ jobs: url: ${{ steps.deploy.outputs.static_web_app_url }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Download build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build @@ -282,7 +282,7 @@ jobs: - name: Deploy to Preview id: deploy - uses: Azure/static-web-apps-deploy@v1 + uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1 with: azure_static_web_apps_api_token: ${{ steps.swa-token.outputs.token }} repo_token: ${{ secrets.GITHUB_TOKEN }} @@ -314,10 +314,10 @@ jobs: if: github.event_name == 'pull_request' && github.event.action != 'closed' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -337,7 +337,7 @@ jobs: run: npx playwright test --project=chromium - name: Upload Preview E2E test report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: playwright-report-preview @@ -361,7 +361,7 @@ jobs: steps: - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -373,7 +373,7 @@ jobs: echo "✅ Resource group deletion initiated (running in background)" - name: Comment PR - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const rg = '${{ env.PROJECT_NAME }}-pr-${{ github.event.pull_request.number }}'; @@ -402,10 +402,10 @@ jobs: load_test_resource: ${{ steps.infra.outputs.loadTestResourceName }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -428,7 +428,7 @@ jobs: - name: Deploy QA Infrastructure id: infra - uses: azure/arm-deploy@v2 + uses: azure/arm-deploy@a1361c2c2cd398621955b16ca32e01c65ea340f5 # v2.0.0 with: scope: resourcegroup resourceGroupName: ${{ steps.rg.outputs.name }} @@ -467,15 +467,15 @@ jobs: url: ${{ steps.deploy.outputs.static_web_app_url }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Download build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build @@ -488,7 +488,7 @@ jobs: - name: Deploy to QA id: deploy - uses: Azure/static-web-apps-deploy@v1 + uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1 with: azure_static_web_apps_api_token: ${{ steps.swa-token.outputs.token }} repo_token: ${{ secrets.GITHUB_TOKEN }} @@ -518,10 +518,10 @@ jobs: if: github.ref == 'refs/heads/main' && github.event_name == 'push' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -541,7 +541,7 @@ jobs: run: npx playwright test --project=chromium - name: Upload QA E2E test report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: playwright-report-qa @@ -565,10 +565,10 @@ jobs: if: github.ref == 'refs/heads/main' && github.event_name == 'push' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -580,7 +580,7 @@ jobs: cat tests/load/load-test.jmx - name: Run Load Test - uses: azure/load-testing@v1 + uses: azure/load-testing@5c5d948af73990aa1c0732e255897d1b1b4c0e7b # v1.2.5 with: loadTestConfigFile: tests/load/config.yaml loadTestResource: ${{ needs.deploy-qa-infrastructure.outputs.load_test_resource }} @@ -612,10 +612,10 @@ jobs: static_web_app_name: ${{ steps.prod-infra.outputs.staticWebAppName }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -635,7 +635,7 @@ jobs: - name: Deploy Production Infrastructure id: prod-infra - uses: azure/arm-deploy@v2 + uses: azure/arm-deploy@a1361c2c2cd398621955b16ca32e01c65ea340f5 # v2.0.0 with: scope: resourcegroup resourceGroupName: ${{ env.AZURE_RESOURCE_GROUP }} @@ -671,15 +671,15 @@ jobs: url: ${{ steps.deploy.outputs.static_web_app_url }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Download build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: build @@ -692,7 +692,7 @@ jobs: - name: Deploy to Production id: deploy - uses: Azure/static-web-apps-deploy@v1 + uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1 with: azure_static_web_apps_api_token: ${{ steps.swa-token.outputs.token }} repo_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index 6e1d7ab..798d5f3 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -44,7 +44,7 @@ jobs: steps: - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -100,7 +100,7 @@ jobs: steps: - name: Azure Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: creds: ${{ secrets.AZURE_CREDENTIALS }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 21002b9..fa4e331 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,16 +41,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index db2afd9..1668ad3 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -32,10 +32,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Dependency Review - uses: actions/dependency-review-action@v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: # Fail the workflow on: fail-on-severity: high # moderate, high, critical