From 9343cc4b4abbb5c227ebd6a7b7338895e2078425 Mon Sep 17 00:00:00 2001 From: Arshad Anwer Date: Fri, 18 Sep 2026 17:13:06 +1200 Subject: [PATCH] chore: Pin GitHub Actions to commit SHAs --- .github/workflows/build-image.yml | 2 +- .github/workflows/create-release.yml | 4 ++-- .github/workflows/scan-images.yml | 2 +- .github/workflows/scan-repo.yml | 4 ++-- .github/workflows/validate-commits.yml | 2 +- .github/workflows/validate-config.yml | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index 770390fc..acb27cdf 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 #v4 with: fetch-depth: 1 - name: Log in to Docker Hub diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 50568c76..16d632cf 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -18,11 +18,11 @@ jobs: id-token: write steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 #v4 with: fetch-depth: 0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #v4 with: node-version: 20 - name: Install dependencies diff --git a/.github/workflows/scan-images.yml b/.github/workflows/scan-images.yml index 8155c8be..65558272 100644 --- a/.github/workflows/scan-images.yml +++ b/.github/workflows/scan-images.yml @@ -42,6 +42,6 @@ jobs: output: trivy-results-${{ matrix.image }}-image.sarif severity: 'CRITICAL,HIGH' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 #v4 with: sarif_file: trivy-results-${{ matrix.image }}-image.sarif diff --git a/.github/workflows/scan-repo.yml b/.github/workflows/scan-repo.yml index 4caa69d1..bf3dccb9 100644 --- a/.github/workflows/scan-repo.yml +++ b/.github/workflows/scan-repo.yml @@ -20,7 +20,7 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 #v4 with: fetch-depth: 1 - name: Run Trivy vulnerability scanner @@ -34,7 +34,7 @@ jobs: exit-code: '1' severity: 'CRITICAL,HIGH' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 #v4 if: always() with: sarif_file: 'trivy-results-repo.sarif' diff --git a/.github/workflows/validate-commits.yml b/.github/workflows/validate-commits.yml index 9da252bb..3cd2e5a8 100644 --- a/.github/workflows/validate-commits.yml +++ b/.github/workflows/validate-commits.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 #v4 with: fetch-depth: 0 - name: Validate commits are Conventional Commits diff --git a/.github/workflows/validate-config.yml b/.github/workflows/validate-config.yml index 8daa5ccf..bf6b1c02 100644 --- a/.github/workflows/validate-config.yml +++ b/.github/workflows/validate-config.yml @@ -17,7 +17,7 @@ jobs: php-version: ['8.5', '5.5'] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 #v4 with: fetch-depth: 1 - name: Create symlinks for config.php includes