feat: Pin action by hash in CI workflows (#1249)

- Add hash to every CI action
stacks-network · Jan 22, 2025 · f53b9bf · f53b9bf
1 parent a53ab63
commit f53b9bf
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 14 deletions.
diff --git a/.github/workflows/buf-ci.yaml b/.github/workflows/buf-ci.yaml
@@ -14,8 +14,8 @@ jobs:
     name: Run protobuf lints
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: bufbuild/buf-action@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: bufbuild/buf-action@3fb70352251376e958c4c2c92c3818de82a71c2b #v1.0.2
         with:
           version: 1.42.0
           setup_only: true

diff --git a/.github/workflows/contract-tests.yaml b/.github/workflows/contract-tests.yaml
@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-      - uses: pnpm/action-setup@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 #v4.0
 
       - name: Set Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af #v4.1.0
         with:
           node-version: 22.1.0
           cache: "pnpm"

diff --git a/.github/workflows/image-build.yaml b/.github/workflows/image-build.yaml
@@ -49,7 +49,7 @@ jobs:
       ## Setup Docker for the builds
       - name: Docker setup
         id: docker_setup
-        uses: stacks-network/actions/docker@main
+        uses: stacks-network/actions/docker@922078e86a42551502809ac517fd2837840433e6
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -106,7 +106,7 @@ jobs:
             GIT_COMMIT=${{ github.ref_name }}
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb #v2.1.0
         with:
           subject-name: index.docker.io/${{ env.docker-org }}/sbtc
           subject-digest: ${{ steps.docker_build.outputs.digest }}

diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml
@@ -15,26 +15,26 @@ jobs:
     name: Run Unit Tests
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 #v4.0
 
       - name: Set Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af #v4.1.0
         with:
           node-version: 22.1.0
           cache: "pnpm"
 
-      - uses: arduino/setup-protoc@v3
+      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b #v3.0
         with:
           version: "25.3"
 
       - name: Setup rust toolchain
         run: rustup show
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 #v2.7.7
 
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@da41fb311fbbcecf899732e575aaeaa2fe65c934 #v2.47.21
         with:
           tool: [email protected]
 
@@ -58,7 +58,7 @@ jobs:
         run: make integration-env-down-ci
 
       - name: Upload integration test logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
         if: always()
         with:
           path: ./target/emily-server.log