From b5a7c076f37a67c049850ebdcec52e23c3d53879 Mon Sep 17 00:00:00 2001 From: Amir Alavi Date: Fri, 15 May 2026 22:21:04 -0400 Subject: [PATCH] ci: pin GitHub Actions to commit SHAs --- .github/workflows/helm.yaml | 10 +++++----- .github/workflows/release.yaml | 6 +++--- .github/workflows/security.yaml | 4 ++-- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 81b550824..9f11a2b8d 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -20,25 +20,25 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v4.2.0 + uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0 with: version: v3.15.1 - - uses: actions/setup-python@v5.1.1 + - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1 with: python-version: 3.12 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: 'go.mod' - name: Set up chart-testing - uses: helm/chart-testing-action@v2.8.0 + uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0 with: version: v3.11.0 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bbc0c45f8..938b9cf05 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: fetch-depth: 0 @@ -23,12 +23,12 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Install Helm - uses: azure/setup-helm@v4.2.0 + uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0 with: version: v3.15.1 - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.6.0 + uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0 env: CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" CR_RELEASE_NAME_TEMPLATE: "descheduler-helm-chart-{{ .Version }}" diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 99425b358..28619e65b 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -19,7 +19,7 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 @@ -38,6 +38,6 @@ jobs: output: 'trivy-results.sarif' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4 with: sarif_file: 'trivy-results.sarif'