Skip to content

Commit c212fe5

Browse files
bdukesbdukes
committed
Pin GitHub Actions to commit SHA for security
1 parent a3e7937 commit c212fe5

3 files changed

Lines changed: 34 additions & 34 deletions

File tree

‎.github/workflows/browserslist-update-db.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
1-
name: Update Browserslist database
1+
name: "Update Browserslist database"
22

33
on:
44
schedule:
5-
- cron: '0 2 1,15 * *'
5+
- cron: "0 2 1,15 * *"
66

77
permissions:
8-
contents: write
9-
pull-requests: write
8+
contents: "write"
9+
pull-requests: "write"
1010

1111
jobs:
1212
update-browserslist-database:
13-
runs-on: ubuntu-latest
13+
runs-on: "ubuntu-latest"
1414
steps:
15-
- name: Checkout repository
16-
uses: actions/checkout@v6
15+
- name: "Checkout repository"
16+
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
1717
with:
1818
fetch-depth: 0
19-
- name: Configure git
19+
- name: "Configure git"
2020
run: |
2121
# Setup for commiting using built-in token. See https://github.com/actions/checkout#push-a-commit-using-the-built-in-token
2222
git config user.name "github-actions[bot]"
23-
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
24-
- run: corepack enable
25-
- name: Update Browserslist database and create PR if applies
26-
uses: c2corg/browserslist-update-action@v2
23+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
24+
- run: "corepack enable"
25+
- name: "Update Browserslist database and create PR if applies"
26+
uses: "c2corg/browserslist-update-action@a76abb476199caea5399f9e28ff3f16e491ec566" # v2
2727
with:
2828
github_token: ${{ secrets.GITHUB_TOKEN }}
29-
branch: browserslist-update
30-
base_branch: develop
31-
labels: 'javascript, Type: Maintenance'
29+
branch: "browserslist-update"
30+
base_branch: "develop"
31+
labels: "javascript, Type: Maintenance"

‎.github/workflows/ci.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,14 +69,14 @@ jobs:
6969
"RUN_TESTS=${{ inputs.RUN_TESTS || env.RUN_TESTS }}" >> $env:GITHUB_ENV;
7070
7171
- name: "Checkout"
72-
uses: "actions/checkout@v6.0.2"
72+
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
7373
with:
7474
fetch-depth: 0 # include all history for GitVersion
7575

7676
# Built-in caching is broken for Yarn, using setup-node twice
7777
# See https://github.com/actions/setup-node/issues/531#issuecomment-3335630863
7878
- name: "Setup Node.js"
79-
uses: "actions/setup-node@v6.3.0"
79+
uses: "actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f" # v6.3.0
8080
with:
8181
node-version-file: ".node-version"
8282
package-manager-cache: false
@@ -85,12 +85,12 @@ jobs:
8585
run: "corepack enable"
8686

8787
- name: "Setup Yarn cache"
88-
uses: "actions/setup-node@v6.3.0"
88+
uses: "actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f" # v6.3.0
8989
with:
9090
cache: "yarn"
9191

9292
- name: "Setup .NET SDK"
93-
uses: "actions/setup-dotnet@v5.2.0"
93+
uses: "actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7" # v5.2.0
9494
with:
9595
global-json-file: "global.json"
9696

@@ -121,14 +121,14 @@ jobs:
121121
continue-on-error: true
122122

123123
- name: "Publish Test Results"
124-
uses: "EnricoMi/publish-unit-test-result-action/windows@v2.23.0"
124+
uses: "EnricoMi/publish-unit-test-result-action/windows@c950f6fb443cb5af20a377fd0dfaa78838901040" # v2.23.0
125125
if: ${{ !cancelled() && env.RUN_TESTS == 'true' }}
126126
with:
127127
files: "**/TestResults/*.trx"
128128
action_fail: true
129129

130130
- name: "Publish Artifacts"
131-
uses: "actions/upload-artifact@v7.0.0"
131+
uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7.0.0
132132
if: ${{ !cancelled() }}
133133
with:
134134
path: "Artifacts"

‎.github/workflows/image-actions.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Compress images
1+
name: "Compress images"
22
on:
33
pull_request: # PRs with image (but we can't push changes back to other forks)
44
paths:
@@ -19,25 +19,25 @@ jobs:
1919
github.repository == 'dnnsoftware/Dnn.Platform' &&
2020
(github.event_name != 'pull_request' ||
2121
github.event.pull_request.head.repo.full_name == github.repository)
22-
name: calibreapp/image-actions
23-
runs-on: ubuntu-latest
22+
name: "calibreapp/image-actions"
23+
runs-on: "ubuntu-latest"
2424
steps:
25-
- name: Checkout Repo
26-
uses: actions/checkout@v6
25+
- name: "Checkout Repo"
26+
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
2727

28-
- name: Compress Images
29-
id: compress_images
30-
uses: calibreapp/image-actions@1.4.1
28+
- name: "Compress Images"
29+
id: "compress_images"
30+
uses: "calibreapp/image-actions@f32575787d333b0579f0b7d506ff03be63a669d1" # 1.4.1
3131
with:
3232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3333
compressOnly: ${{ github.event_name != 'pull_request' }} # For non-Pull Requests, run in compressOnly mode and we'll PR after.
3434

35-
- name: Create Pull Request
35+
- name: "Create Pull Request"
3636
if: | # If it's not a Pull Request then commit any changes as a new PR.
3737
github.event_name != 'pull_request' && steps.compress_images.outputs.markdown != ''
38-
uses: peter-evans/create-pull-request@v8
38+
uses: "peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0" # v8.1.0
3939
with:
40-
title: Auto Compress Images
41-
branch-suffix: timestamp
42-
commit-message: Compress Images
40+
title: "Auto Compress Images"
41+
branch-suffix: "timestamp"
42+
commit-message: "Compress Images"
4343
body: ${{ steps.compress_images.outputs.markdown }}

0 commit comments

Comments
 (0)