Merge pull request #16 from k1LoW/pindeps

k1LoW · web-flow · commit 90957edb824f · 2025-03-19T19:44:54.000+09:00
fix: pin dependencies
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
@@ -10,7 +10,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./
         with:
           config: testdata/path/to/.octocov.yml
@@ -22,7 +22,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./
         with:
           work-dir: testdata/path/to
@@ -34,7 +34,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./
         with:
           config: testdata/path/to/.octocov.yml
diff --git a/.github/workflows/tag-v0.yml b/.github/workflows/tag-v0.yml
@@ -9,10 +9,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     -
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         ref: docker-action
     -
-      uses: haya14busa/action-update-semver@v1
+      uses: haya14busa/action-update-semver@fb48464b2438ae82cc78237be61afb4f461265a1 # v1.2.1
       with:
         major_version_tag_only: true
diff --git a/.github/workflows/tagpr.yml b/.github/workflows/tagpr.yml
@@ -13,13 +13,13 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: run-tagpr
         name: Run tagpr
-        uses: Songmu/tagpr@v1
+        uses: Songmu/tagpr@e89d37247ca73d3e5620bf074a53fbd5b39e66b0 # v1.5.1
 
-      - uses: haya14busa/action-update-semver@v1
+      - uses: haya14busa/action-update-semver@fb48464b2438ae82cc78237be61afb4f461265a1 # v1.2.1
         if: "steps.run-tagpr.outputs.tag != ''"
         with:
           major_version_tag_only: true
diff --git a/.pinact.yaml b/.pinact.yaml
@@ -0,0 +1,9 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+# pinact - https://github.com/suzuki-shunsuke/pinact
+files:
+  - pattern: "^\\.github/workflows/.*\\.ya?ml$"
+  - pattern: "^(.*/)?action\\.ya?ml$"
+
+ignore_actions:
+# - name: actions/checkout
+# - name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml
diff --git a/action.yml b/action.yml
@@ -12,6 +12,10 @@ inputs:
     description: Version of octocov
     default: latest
     required: false
+  checksum:
+    description: Checksum of octocov
+    default: ''
+    required: false
   check-existence:
     description: Check for the existence of an existing octocov
     default: 'false'
@@ -39,18 +43,19 @@ runs:
   using: 'composite'
   steps:
     -
-      uses: k1LoW/gh-setup@v1
+      uses: k1LoW/gh-setup@e2f12d046abe942ed4e6976980e53e2388238273 # v1.10.0
       with:
         repo: github.com/k1LoW/octocov
         github-token: ${{ inputs.github-token }}
         version: ${{ inputs.version }}
         bin-dir: ${{ inputs.install-dir }}
         bin-match: octocov
+        checksum: ${{ inputs.checksum }}
         strict: true
         force: ${{ inputs.check-existence != 'true' }}
     -
       name: Run octocov
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:
         script: |
           const path = require('path');

Original file line number	Diff line number	Diff line change
`@@ -9,10 +9,10 @@ jobs:`
`9`	`9`	`runs-on: ubuntu-latest`
`10`	`10`	`steps:`
`11`	`11`	`-`
`12`		`- uses: actions/checkout@v4`
	`12`	`+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2`
`13`	`13`	`with:`
`14`	`14`	`ref: docker-action`
`15`	`15`	`-`
`16`		`- uses: haya14busa/action-update-semver@v1`
	`16`	`+ uses: haya14busa/action-update-semver@fb48464b2438ae82cc78237be61afb4f461265a1 # v1.2.1`
`17`	`17`	`with:`
`18`	`18`	`major_version_tag_only: true`