From b5b6ced3b1a1a1b64f23699f79a5cf8b2b56c276 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 21:39:14 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++ .github/workflows/bloat.yml | 8 ++-- .github/workflows/ci.yml | 12 ++--- .github/workflows/codeql.yml | 8 ++-- .github/workflows/reusable-build.yml | 66 ++++++++++++++-------------- .github/workflows/spelling.yml | 4 +- 6 files changed, 60 insertions(+), 49 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/bloat.yml b/.github/workflows/bloat.yml index dfb28c65..5ac1a64d 100644 --- a/.github/workflows/bloat.yml +++ b/.github/workflows/bloat.yml @@ -116,7 +116,7 @@ jobs: crate_share_overrides: "clap_builder=0.25 regex_automata=0.20 regex_syntax=0.15" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install apt packages (Linux only) if: runner.os == 'Linux' && matrix.apt_packages != '' @@ -124,11 +124,11 @@ jobs: sudo apt-get update sudo apt-get install -y ${{ matrix.apt_packages }} - - uses: dtolnay/rust-toolchain@1.95.0 + - uses: dtolnay/rust-toolchain@a5f673d0ba8626c3977bb416a1612774bc82181b # 1.95.0 with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: bloat-${{ matrix.target }}-${{ matrix.crate }} @@ -159,7 +159,7 @@ jobs: - name: Upload bloat report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: bloat-report-${{ matrix.target }}-${{ matrix.crate }} path: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 50d62846..443954ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,13 +17,13 @@ jobs: linux_lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install eBPF build dependencies run: | sudo apt-get update sudo apt-get install -y libbpf-dev libbpfcc-dev clang llvm - - uses: Swatinem/rust-cache@v2 - - uses: dtolnay/rust-toolchain@1.95.0 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: dtolnay/rust-toolchain@a5f673d0ba8626c3977bb416a1612774bc82181b # 1.95.0 with: components: rustfmt clippy - run: cargo fmt --all -- --check -l @@ -37,9 +37,9 @@ jobs: win_lint: runs-on: windows-2022 steps: - - uses: actions/checkout@v4 - - uses: Swatinem/rust-cache@v2 - - uses: dtolnay/rust-toolchain@1.95.0 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: dtolnay/rust-toolchain@a5f673d0ba8626c3977bb416a1612774bc82181b # 1.95.0 with: components: rustfmt clippy - run: cargo fmt --all -- --check -l diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bc414e62..561ededf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -58,10 +58,10 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install Clang - uses: egor-tensin/setup-clang@v1 + uses: egor-tensin/setup-clang@ef434b41eb33a70396fb336b1bae39c76d740c3d # v1.4 - name: Setup an eBPF Development Environment in Ubuntu run: | @@ -83,7 +83,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -113,6 +113,6 @@ jobs: fi - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 53e84d7c..99d45f6e 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -17,7 +17,7 @@ jobs: - name: Create GitHub Release id: create_release if: inputs.generate_release == true - uses: actions/create-release@v1 + uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout Project - uses: actions/checkout@v3.3.0 + uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - name: Install Clang working-directory: ${{env.GITHUB_WORKSPACE}} @@ -39,10 +39,10 @@ jobs: choco install -y llvm --version 11.0.1 --allow-downgrade - name: setup-msbuild - uses: microsoft/setup-msbuild@v1.3.1 + uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1 - name: rust-toolchain - uses: actions-rs/toolchain@v1.0.6 + uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6 with: toolchain: stable @@ -54,7 +54,7 @@ jobs: - name: Upload debug amd64 build zip packages if: (success() || failure()) - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-debug-windows-amd64.zip @@ -67,7 +67,7 @@ jobs: - name: Upload release amd64 build zip package if: (success() || failure()) - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-release-windows-amd64.zip @@ -146,7 +146,7 @@ jobs: - name: get current release id: get_current_release if: inputs.generate_release == true - uses: joutvhu/get-release@v1.0.2 + uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2 with: # do not push two tags/releases at the same time latest: true @@ -155,7 +155,7 @@ jobs: - name: Upload debug amd64 build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -168,7 +168,7 @@ jobs: - name: Upload release amd64 build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -185,7 +185,7 @@ jobs: steps: - name: Checkout Project - uses: actions/checkout@v3.3.0 + uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - name: Install Clang working-directory: ${{env.GITHUB_WORKSPACE}} @@ -193,10 +193,10 @@ jobs: choco install -y llvm --version 11.0.1 --allow-downgrade - name: setup-msbuild - uses: microsoft/setup-msbuild@v1.3.1 + uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # v1.3.1 - name: rust-toolchain - uses: actions-rs/toolchain@v1.0.6 + uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6 with: toolchain: stable @@ -205,7 +205,7 @@ jobs: - name: Upload debug arm64 build zip packages if: (success() || failure()) - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-debug-windows-arm64.zip @@ -218,7 +218,7 @@ jobs: - name: Upload release arm64 build zip package if: (success() || failure()) - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-release-windows-arm64.zip @@ -228,7 +228,7 @@ jobs: - name: get current release id: get_current_release if: inputs.generate_release == true - uses: joutvhu/get-release@v1.0.2 + uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2 with: # do not push two tags/releases at the same time latest: true @@ -237,7 +237,7 @@ jobs: - name: Upload debug arm64 build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -250,7 +250,7 @@ jobs: - name: Upload release arm64 build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -267,13 +267,13 @@ jobs: steps: - name: Checkout Project - uses: actions/checkout@v3.3.0 + uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - name: Install Clang - uses: egor-tensin/setup-clang@v1 + uses: egor-tensin/setup-clang@ef434b41eb33a70396fb336b1bae39c76d740c3d # v1.4 - name: rust-toolchain - uses: actions-rs/toolchain@v1.0.6 + uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6 with: toolchain: stable @@ -304,7 +304,7 @@ jobs: run: ./build-linux.sh debug amd64 - name: Upload debug build amd64 zip package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-debug-linux-amd64.zip @@ -315,7 +315,7 @@ jobs: run: ./build-linux.sh release - name: Upload release amd64 build zip package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-release-linux-amd64.zip @@ -403,7 +403,7 @@ jobs: - name: get current release id: get_current_release if: inputs.generate_release == true - uses: joutvhu/get-release@v1.0.2 + uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2 with: # do not push two tags/releases at the same time latest: true @@ -412,7 +412,7 @@ jobs: - name: Upload debug build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -425,7 +425,7 @@ jobs: - name: Upload release build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -442,13 +442,13 @@ jobs: steps: - name: Checkout Project - uses: actions/checkout@v3.3.0 + uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - name: Install Clang - uses: egor-tensin/setup-clang@v1 + uses: egor-tensin/setup-clang@ef434b41eb33a70396fb336b1bae39c76d740c3d # v1.4 - name: rust-toolchain - uses: actions-rs/toolchain@v1.0.6 + uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # v1.0.6 with: toolchain: stable @@ -475,7 +475,7 @@ jobs: run: ./build-linux.sh debug arm64 - name: Upload debug arm64 build zip package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-debug-linux-arm64.zip @@ -486,7 +486,7 @@ jobs: run: ./build-linux.sh release arm64 - name: Upload release arm64 build zip package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: # Artifact name name: build-release-linux-arm64.zip @@ -496,7 +496,7 @@ jobs: - name: get current release id: get_current_release if: inputs.generate_release == true - uses: joutvhu/get-release@v1.0.2 + uses: joutvhu/get-release@144629279c62511778ae157f397f35c358626160 # v1.0.2 with: # do not push two tags/releases at the same time latest: true @@ -505,7 +505,7 @@ jobs: - name: Upload debug build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -518,7 +518,7 @@ jobs: - name: Upload release build if: inputs.generate_release == true - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml index c85e2e0c..7a8de2f0 100644 --- a/.github/workflows/spelling.yml +++ b/.github/workflows/spelling.yml @@ -18,10 +18,10 @@ jobs: cancel-in-progress: true steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Check Spelling - uses: streetsidesoftware/cspell-action@v8 + uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8.4.0 with: config: cspell.json # On pull requests, only check files changed in the PR.