From c7c6009e1ca8b3f7223ea86b1b5de93c7445f626 Mon Sep 17 00:00:00 2001 From: Jianbo Sun Date: Wed, 21 Dec 2022 14:29:54 +0800 Subject: [PATCH] Chore: enhance workflow with specific git commit id (#5220) Signed-off-by: Jianbo Sun Signed-off-by: Jianbo Sun --- .github/workflows/apiserver-test.yml | 25 ++++++++------- .github/workflows/back-port.yml | 4 +-- .github/workflows/chart.yml | 6 ++-- .github/workflows/codeql-analysis.yml | 2 +- .github/workflows/core-api-test.yml | 4 +-- .github/workflows/definition-lint.yml | 6 ++-- .github/workflows/e2e-multicluster-test.yml | 12 ++++---- .github/workflows/e2e-rollout-test.yml | 10 +++--- .github/workflows/e2e-test.yml | 10 +++--- .github/workflows/go.yml | 34 ++++++++++----------- .github/workflows/issue-commands.yml | 12 ++++---- .github/workflows/license.yml | 2 +- .github/workflows/registry.yml | 6 ++-- .github/workflows/release.yml | 9 ++++-- .github/workflows/scorecards.yml | 2 +- .github/workflows/sync-api.yml | 4 +-- .github/workflows/timed-task.yml | 3 +- .github/workflows/trivy-scan.yml | 2 +- .github/workflows/unit-test.yml | 14 ++++----- 19 files changed, 87 insertions(+), 80 deletions(-) diff --git a/.github/workflows/apiserver-test.yml b/.github/workflows/apiserver-test.yml index 61349a9f0..241345cdd 100644 --- a/.github/workflows/apiserver-test.yml +++ b/.github/workflows/apiserver-test.yml @@ -20,6 +20,9 @@ env: GO_VERSION: '1.19' GOLANGCI_VERSION: 'v1.49' +permissions: + contents: read + jobs: detect-noop: @@ -29,7 +32,7 @@ jobs: steps: - name: Detect No-op Changes id: noop - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 with: github_token: ${{ secrets.GITHUB_TOKEN }} paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]' @@ -43,18 +46,18 @@ jobs: steps: - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} id: go - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Cache Go Dependencies - uses: actions/cache@v3 + uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 with: path: .work/pkg key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} @@ -71,7 +74,7 @@ jobs: # TODO need update action version to resolve node 12 deprecated. - name: install Kubebuilder - uses: RyanSiu1995/kubebuilder-action@v1.2 + uses: RyanSiu1995/kubebuilder-action@ff52bff1bae252239223476e5ab0d71d6ba02343 with: version: 3.1.0 kubebuilderOnly: false @@ -81,7 +84,7 @@ jobs: run: make unit-test-apiserver - name: Upload coverage report - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 with: token: ${{ secrets.CODECOV_TOKEN }} file: ./coverage.txt @@ -101,13 +104,13 @@ jobs: steps: - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} id: go - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true @@ -129,7 +132,7 @@ jobs: echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV - name: Setup K3d (Hub) - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: ${{ matrix.k8s-version }} github-token: ${{ secrets.GITHUB_TOKEN }} @@ -137,7 +140,7 @@ jobs: - name: Setup K3d (Worker) - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: ${{ matrix.k8s-version }} github-token: ${{ secrets.GITHUB_TOKEN }} @@ -179,7 +182,7 @@ jobs: run: make end-e2e-core - name: Upload coverage report - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 with: token: ${{ secrets.CODECOV_TOKEN }} files: /tmp/e2e_apiserver_test.out diff --git a/.github/workflows/back-port.yml b/.github/workflows/back-port.yml index fc0705f66..5e7b35afb 100644 --- a/.github/workflows/back-port.yml +++ b/.github/workflows/back-port.yml @@ -17,12 +17,12 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: fetch-depth: 0 - name: Open Backport PR - uses: zeebe-io/backport-action@v0.0.9 + uses: zeebe-io/backport-action@2ee900dc92632adf994f8e437b6d16840fd61f58 with: github_token: ${{ secrets.GITHUB_TOKEN }} github_workspace: ${{ github.workspace }} diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml index 53c4b309b..d68429d31 100644 --- a/.github/workflows/chart.yml +++ b/.github/workflows/chart.yml @@ -31,18 +31,18 @@ jobs: VELA_ROLLOUT_HELM_CHART_NAME: vela-rollout runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Get git revision id: vars shell: bash run: | echo "git_revision=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT - name: Install Helm - uses: azure/setup-helm@v3 + uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 with: version: v3.4.0 - name: Setup node - uses: actions/setup-node@v3 + uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 with: node-version: '14' - name: Generate helm doc diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 5f959c13f..5009a6e37 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Initialize CodeQL uses: github/codeql-action/init@v2 diff --git a/.github/workflows/core-api-test.yml b/.github/workflows/core-api-test.yml index a1b5139ac..01a0274dd 100644 --- a/.github/workflows/core-api-test.yml +++ b/.github/workflows/core-api-test.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-20.04 steps: - name: Set up Go 1.19 - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 env: GO_VERSION: '1.19' GOLANGCI_VERSION: 'v1.49' @@ -26,7 +26,7 @@ jobs: id: go - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Get the version id: get_version diff --git a/.github/workflows/definition-lint.yml b/.github/workflows/definition-lint.yml index c7fdec3a5..bf1e60f8e 100644 --- a/.github/workflows/definition-lint.yml +++ b/.github/workflows/definition-lint.yml @@ -23,17 +23,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Setup K3d - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: v1.20 github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/e2e-multicluster-test.yml b/.github/workflows/e2e-multicluster-test.yml index a3122b829..0e7cc400f 100644 --- a/.github/workflows/e2e-multicluster-test.yml +++ b/.github/workflows/e2e-multicluster-test.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Detect No-op Changes id: noop - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 with: github_token: ${{ secrets.GITHUB_TOKEN }} paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]' @@ -53,10 +53,10 @@ jobs: steps: - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} @@ -78,14 +78,14 @@ jobs: echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV - name: Setup K3d (Hub) - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: ${{ matrix.k8s-version }} github-token: ${{ secrets.GITHUB_TOKEN }} k3d-args: ${{ env.EGRESS_ARG }} - name: Setup K3d (Worker) - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: ${{ matrix.k8s-version }} github-token: ${{ secrets.GITHUB_TOKEN }} @@ -118,7 +118,7 @@ jobs: run: make end-e2e-core - name: Upload coverage report - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 with: token: ${{ secrets.CODECOV_TOKEN }} files: /tmp/e2e-profile.out,/tmp/e2e_multicluster_test.out diff --git a/.github/workflows/e2e-rollout-test.yml b/.github/workflows/e2e-rollout-test.yml index a7eb678c8..764a77304 100644 --- a/.github/workflows/e2e-rollout-test.yml +++ b/.github/workflows/e2e-rollout-test.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Detect No-op Changes id: noop - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 with: github_token: ${{ secrets.GITHUB_TOKEN }} paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]' @@ -53,10 +53,10 @@ jobs: steps: - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} @@ -78,7 +78,7 @@ jobs: echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV - name: Setup K3d - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: ${{ matrix.k8s-version }} github-token: ${{ secrets.GITHUB_TOKEN }} @@ -102,7 +102,7 @@ jobs: run: make end-e2e - name: Upload coverage report - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 with: token: ${{ secrets.CODECOV_TOKEN }} files: /tmp/e2e-profile.out diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index e0e463094..00c2d796e 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Detect No-op Changes id: noop - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 with: github_token: ${{ secrets.GITHUB_TOKEN }} paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]' @@ -53,10 +53,10 @@ jobs: steps: - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} @@ -78,7 +78,7 @@ jobs: echo "EGRESS_ARG=${EGRESS_ARG}" >> $GITHUB_ENV - name: Setup K3d - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: ${{ matrix.k8s-version }} github-token: ${{ secrets.GITHUB_TOKEN }} @@ -109,7 +109,7 @@ jobs: run: make end-e2e - name: Upload coverage report - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 with: token: ${{ secrets.CODECOV_TOKEN }} files: /tmp/e2e-profile.out diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 87a4918ca..5b5980509 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Detect No-op Changes id: noop - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 with: github_token: ${{ secrets.GITHUB_TOKEN }} paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]' @@ -44,17 +44,17 @@ jobs: steps: - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Cache Go Dependencies - uses: actions/cache@v3 + uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 with: path: .work/pkg key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} @@ -79,17 +79,17 @@ jobs: steps: - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Cache Go Dependencies - uses: actions/cache@v3 + uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 with: path: .work/pkg key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} @@ -111,17 +111,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Setup node - uses: actions/setup-node@v3 + uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 with: node-version: '14' @@ -129,7 +129,7 @@ jobs: run: go install honnef.co/go/tools/cmd/staticcheck@2022.1 - name: Cache Go Dependencies - uses: actions/cache@v3 + uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 with: path: .work/pkg key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} @@ -157,17 +157,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Cache Go Dependencies - uses: actions/cache@v3 + uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 with: path: .work/pkg key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} @@ -188,7 +188,7 @@ jobs: if: needs.detect-noop.outputs.noop != 'true' steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Set up QEMU @@ -208,7 +208,7 @@ jobs: if: needs.detect-noop.outputs.noop != 'true' steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Set up QEMU @@ -228,7 +228,7 @@ jobs: if: needs.detect-noop.outputs.noop != 'true' steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Set up QEMU diff --git a/.github/workflows/issue-commands.yml b/.github/workflows/issue-commands.yml index 3e9c355f9..3b88856f2 100644 --- a/.github/workflows/issue-commands.yml +++ b/.github/workflows/issue-commands.yml @@ -13,13 +13,13 @@ jobs: runs-on: ubuntu-20.04 steps: - name: Checkout Actions - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: repository: "oam-dev/kubevela-github-actions" path: ./actions ref: v0.4.2 - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 with: node-version: '14' cache: 'npm' @@ -41,7 +41,7 @@ jobs: steps: - name: Extract Command id: command - uses: xt0rted/slash-command-action@v2 + uses: xt0rted/slash-command-action@bf51f8f5f4ea3d58abc7eca58f77104182b23e88 with: repo-token: ${{ secrets.VELA_BOT_TOKEN }} command: backport @@ -50,7 +50,7 @@ jobs: allow-edits: "false" permission-level: read - name: Handle Command - uses: actions/github-script@v6 + uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 env: VERSION: ${{ steps.command.outputs.command-arguments }} with: @@ -71,11 +71,11 @@ jobs: }) console.log("Added '" + label + "' label.") - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: fetch-depth: 0 - name: Open Backport PR - uses: zeebe-io/backport-action@v0.0.9 + uses: zeebe-io/backport-action@2ee900dc92632adf994f8e437b6d16840fd61f58 with: github_token: ${{ secrets.GITHUB_TOKEN }} github_workspace: ${{ github.workspace }} diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml index 679cacc0f..3f261e1cf 100644 --- a/.github/workflows/license.yml +++ b/.github/workflows/license.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest name: Check for unapproved licenses steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Set up Ruby uses: ruby/setup-ruby@v1 with: diff --git a/.github/workflows/registry.yml b/.github/workflows/registry.yml index 98de81ae3..0cdfdfbb2 100644 --- a/.github/workflows/registry.yml +++ b/.github/workflows/registry.yml @@ -20,7 +20,7 @@ jobs: packages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Get the version id: get_version run: | @@ -100,7 +100,7 @@ jobs: packages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Get the version id: get_version run: | @@ -182,7 +182,7 @@ jobs: CAPABILITY_ENDPOINT: oss-cn-beijing.aliyuncs.com runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Install ossutil run: wget http://gosspublic.alicdn.com/ossutil/1.7.0/ossutil64 && chmod +x ossutil64 && mv ossutil64 ossutil - name: Configure Alibaba Cloud OSSUTIL diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 857df0fc0..9ca0cee7e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,6 +13,9 @@ env: ACCESS_KEY: ${{ secrets.CLI_OSS_ACCESS_KEY }} ACCESS_KEY_SECRET: ${{ secrets.CLI_OSS_ACCESS_KEY_SECRET }} +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest @@ -27,9 +30,9 @@ jobs: DIST_DIRS: find * -type d -exec steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: 1.19 - name: Get release @@ -132,7 +135,7 @@ jobs: name: upload-sha256sums steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Get release id: get_release uses: bruceadams/get-release@v1.3.2 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 2fde39b73..030cc982e 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -23,7 +23,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: persist-credentials: false diff --git a/.github/workflows/sync-api.yml b/.github/workflows/sync-api.yml index b4e2f6978..7b32c729a 100644 --- a/.github/workflows/sync-api.yml +++ b/.github/workflows/sync-api.yml @@ -18,12 +18,12 @@ jobs: runs-on: ubuntu-20.04 steps: - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Get the version id: get_version diff --git a/.github/workflows/timed-task.yml b/.github/workflows/timed-task.yml index 5ceaefce7..b309b0777 100644 --- a/.github/workflows/timed-task.yml +++ b/.github/workflows/timed-task.yml @@ -3,7 +3,8 @@ on: schedule: - cron: '* * * * *' -permissions: {} +permissions: + contents: read jobs: clean-image: diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index c1d51c7c0..46993d87f 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b - name: Build Vela Core image from Dockerfile run: | diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 3100b60c4..fd3dfe886 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Detect No-op Changes id: noop - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 with: github_token: ${{ secrets.GITHUB_TOKEN }} paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]' @@ -44,17 +44,17 @@ jobs: steps: - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 with: go-version: ${{ env.GO_VERSION }} - name: Check out code into the Go module directory - uses: actions/checkout@v3 + uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b with: submodules: true - name: Cache Go Dependencies - uses: actions/cache@v3 + uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 with: path: .work/pkg key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} @@ -65,14 +65,14 @@ jobs: sudo apt-get install -y golang-ginkgo-dev - name: Setup K3d - uses: nolar/setup-k3d-k3s@v1.0.9 + uses: nolar/setup-k3d-k3s@293b8e5822a20bc0d5bcdd4826f1a665e72aba96 with: version: v1.20 github-token: ${{ secrets.GITHUB_TOKEN }} # TODO need update action version to resolve node 12 deprecated. - name: install Kubebuilder - uses: RyanSiu1995/kubebuilder-action@v1.2 + uses: RyanSiu1995/kubebuilder-action@ff52bff1bae252239223476e5ab0d71d6ba02343 with: version: 3.1.0 kubebuilderOnly: false @@ -82,7 +82,7 @@ jobs: run: make test - name: Upload coverage report - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 with: token: ${{ secrets.CODECOV_TOKEN }} file: ./coverage.txt