Skip to content

Commit 29ec641

Browse files
timokoesslertimokoessler
committed
Update, pin and harden GH actions
1 parent ad84753 commit 29ec641

8 files changed

Lines changed: 58 additions & 32 deletions

File tree

‎.github/workflows/benchmark.yml‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,16 @@ jobs:
1111
timeout-minutes: 10
1212
steps:
1313
- name: Checkout code
14-
uses: actions/checkout@v4
14+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
15+
with:
16+
persist-credentials: false
17+
1518
- name: Start databases
16-
working-directory: ./sample-apps/databases
19+
working-directory: ./sample-apps/databases
1720
run: docker compose up --build -d
1821

1922
- name: Set up Python 3.9
20-
uses: actions/setup-python@v5
23+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
2124
with:
2225
python-version: 3.9
2326
- name: Setup safe-chain
@@ -46,12 +49,14 @@ jobs:
4649
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
4750
steps:
4851
- name: Checkout code
49-
uses: actions/checkout@v4
52+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
53+
with:
54+
persist-credentials: false
5055
- name: Start databases
51-
working-directory: ./sample-apps/databases
56+
working-directory: ./sample-apps/databases
5257
run: docker compose up --build -d
5358
- name: Set up Python ${{ matrix.python-version }}
54-
uses: actions/setup-python@v5
59+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
5560
with:
5661
python-version: ${{ matrix.python-version }}
5762
- name: Install dependencies & build
@@ -63,7 +68,7 @@ jobs:
6368
run: nohup make runBenchmark & nohup make runZenDisabled &
6469

6570
- name: Check app health (max 3 attempts)
66-
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
71+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
6772
with:
6873
timeout_minutes: 5
6974
max_attempts: 3
@@ -72,9 +77,9 @@ jobs:
7277
cd ./sample-apps/flask-mysql && make health-check
7378
7479
- name: Install K6
75-
uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
80+
uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1
7681
- name: Run flask-mysql k6 Benchmark (max 3 attempts)
77-
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
82+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
7883
with:
7984
timeout_minutes: 20
8085
max_attempts: 3
@@ -94,12 +99,14 @@ jobs:
9499
python-version: "3.14"
95100
steps:
96101
- name: Checkout code
97-
uses: actions/checkout@v4
102+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
103+
with:
104+
persist-credentials: false
98105
- name: Start databases
99-
working-directory: ./sample-apps/databases
106+
working-directory: ./sample-apps/databases
100107
run: docker compose up --build -d
101108
- name: Set up Python ${{ matrix.python-version }}
102-
uses: actions/setup-python@v5
109+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
103110
with:
104111
python-version: ${{ matrix.python-version }}
105112
- name: Install dependencies & build
@@ -111,7 +118,7 @@ jobs:
111118
run: nohup make runBenchmark & nohup make runZenDisabled &
112119

113120
- name: Check app health (max 3 attempts)
114-
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
121+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
115122
with:
116123
timeout_minutes: 5
117124
max_attempts: 3
@@ -124,7 +131,7 @@ jobs:
124131
sudo apt-get update
125132
sudo apt-get install -y wrk
126133
- name: Run benchmarks (max 3 attempts)
127-
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
134+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
128135
with:
129136
timeout_minutes: 20
130137
max_attempts: 3

‎.github/workflows/end2end.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,15 @@ jobs:
77
build:
88
runs-on: ubuntu-latest
99
steps:
10-
- uses: actions/checkout@v4
10+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
11+
with:
12+
persist-credentials: false
1113
- name: Install poetry
1214
run: pip install poetry
1315
- name: Build
1416
run: make build
1517
- name: Upload artifacts
16-
uses: actions/upload-artifact@v4
18+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1719
with:
1820
name: pkg-build
1921
path: ./
@@ -46,7 +48,7 @@ jobs:
4648
- name: Install packages
4749
run: sudo apt update && sudo apt install python3-dev libmysqlclient-dev
4850
- name: Download artifacts
49-
uses: actions/download-artifact@v4
51+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
5052
with:
5153
name: pkg-build
5254

@@ -59,7 +61,7 @@ jobs:
5961
docker run --name mock_core -d -p 5000:5000 mock_core
6062
6163
- name: Set up Python ${{ matrix.python-version }}
62-
uses: actions/setup-python@v5
64+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
6365
with:
6466
python-version: ${{ matrix.python-version }}
6567
- name: Setup safe-chain

‎.github/workflows/lint.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ jobs:
99

1010
steps:
1111
- name: Checkout code
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
13+
with:
14+
persist-credentials: false
1315

1416
- name: Set up Python
15-
uses: actions/setup-python@v5
17+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
1618
with:
1719
python-version: '3.14'
1820
- name: Setup safe-chain

‎.github/workflows/publish.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ jobs:
1111
name: Linting and running tests
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/checkout@v4
14+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
15+
with:
16+
persist-credentials: false
1517
- name: Start databases
1618
working-directory: ./sample-apps/databases
1719
run: docker compose up --build -d
@@ -54,7 +56,9 @@ jobs:
5456
runs-on: ubuntu-latest
5557

5658
steps:
57-
- uses: actions/checkout@v4
59+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
60+
with:
61+
persist-credentials: false
5862
- name: Install poetry
5963
run: pip install poetry
6064
- name: Set the version for this release

‎.github/workflows/qa-tests.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,22 @@ jobs:
1111
timeout-minutes: 30
1212
steps:
1313
- name: Checkout firewall-python
14-
uses: actions/checkout@v5
14+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1515
with:
1616
path: firewall-python
17+
persist-credentials: false
1718

1819
- name: Checkout zen-demo-python
19-
uses: actions/checkout@v5
20+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2021
with:
2122
repository: Aikido-demo-apps/zen-demo-python
2223
path: zen-demo-python
2324
ref: qa-test
2425
submodules: true
26+
persist-credentials: false
2527

2628
- name: Set up Python
27-
uses: actions/setup-python@v5
29+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
2830
with:
2931
python-version: "3.14"
3032
- name: Setup safe-chain

‎.github/workflows/smoke-test-ffi.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ jobs:
1818

1919
steps:
2020
- name: Checkout code
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
22+
with:
23+
persist-credentials: false
2224

2325
- name: Set up Python
24-
uses: actions/setup-python@v5
26+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
2527
with:
2628
python-version: 3.14
2729

‎.github/workflows/test-publish.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ jobs:
1212
name: Linting and running tests
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
16+
with:
17+
persist-credentials: false
18+
1619
- name: Start databases
1720
working-directory: ./sample-apps/databases
1821
run: docker compose up --build -d
@@ -55,7 +58,9 @@ jobs:
5558
runs-on: ubuntu-latest
5659

5760
steps:
58-
- uses: actions/checkout@v4
61+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
62+
with:
63+
persist-credentials: false
5964
- name: Install poetry
6065
run: pip install poetry
6166
- name: Set the version for this release

‎.github/workflows/unit-test.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,9 @@ jobs:
1515
python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
1616
steps:
1717
- name: Checkout code
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
19+
with:
20+
persist-credentials: false
1921

2022
- name: Start databases
2123
working-directory: ./sample-apps/databases
@@ -29,7 +31,7 @@ jobs:
2931
docker run --name mock_core -d -p 5050:5000 mock_core
3032
3133
- name: Set up Python ${{ matrix.python-version }}
32-
uses: actions/setup-python@v5
34+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
3335
with:
3436
python-version: ${{ matrix.python-version }}
3537
- name: Setup safe-chain
@@ -44,7 +46,7 @@ jobs:
4446
make cov
4547
4648
- name: Upload coverage report to Codecov
47-
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
49+
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
4850
with:
4951
fail_ci_if_error: true
5052
files: ./coverage.xml

0 commit comments

Comments
 (0)