Skip to content

(chore): Pin github actions to specific commit hashes #1105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vyazelenko merged 2 commits into from
May 5, 2026
Merged

(chore): Pin github actions to specific commit hashes #1105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f66b9a4
Pin GitHub actions versions to hashes
swadaptive May 5, 2026
50db56c
Move to rust setup action that support Dependabot-friendly versioning
swadaptive May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 30 additions & 30 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,11 @@ jobs:
echo "TMP=$env:RUNNER_TEMP" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
echo "TEMP=$env:RUNNER_TEMP" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Setup java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ matrix.java }}
Expand All @@ -62,12 +62,12 @@ jobs:
echo "BUILD_JAVA_HOME=$env:JAVA_HOME" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
echo "BUILD_JAVA_VERSION=${{ matrix.java }}" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
- name: Setup java to run Gradle
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Build with Gradle
run: ./gradlew
- name: Copy test logs
Expand All @@ -78,7 +78,7 @@ jobs:
./gradlew tarTestLogs
- name: Upload crash logs
if: always() && steps.copy_test_logs.outputs.file == 'build/distributions/test_logs.tbz2'
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: crash-logs-${{ matrix.os }}-java-${{ matrix.java }}
path: ${{ steps.copy_test_logs.outputs.file }}
Expand All @@ -96,11 +96,11 @@ jobs:
DOTNET_CLI_TELEMETRY_OPTOUT: 1
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -110,16 +110,16 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Cache NuGet dependencies
uses: actions/cache@v4
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.nuget/packages
key: ${{ runner.os }}-nuget-${{ hashFiles('csharp/**/*.sln') }}
restore-keys: |
${{ runner.os }}-nuget-
- name: Setup dotnet
uses: actions/setup-dotnet@v5
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
dotnet-version: ${{ matrix.dotnet }}
dotnet-quality: 'ga'
Expand All @@ -143,7 +143,7 @@ jobs:
CXX: g++-${{ matrix.version }}
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Install compiler
Expand All @@ -152,7 +152,7 @@ jobs:
sudo apt-get update
sudo apt-get install -y g++-${{ matrix.version }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -162,7 +162,7 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Build
run: ./cppbuild/cppbuild

Expand All @@ -179,7 +179,7 @@ jobs:
CXX: clang++-${{ matrix.version }}
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Install compiler
Expand All @@ -190,7 +190,7 @@ jobs:
sudo apt-get update
sudo apt-get install -y clang-${{ matrix.version }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -200,7 +200,7 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Build
run: ./cppbuild/cppbuild

Expand All @@ -217,11 +217,11 @@ jobs:
CXX: clang++
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -231,7 +231,7 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Build
run: cmake --version && ./cppbuild/cppbuild

Expand All @@ -252,11 +252,11 @@ jobs:
echo "TMP=$env:RUNNER_TEMP" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
echo "TEMP=$env:RUNNER_TEMP" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -266,7 +266,7 @@ jobs:
echo "BUILD_JAVA_HOME=$env:JAVA_HOME" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Build
run: cppbuild/cppbuild.cmd

Expand All @@ -280,15 +280,15 @@ jobs:
rust: [ stable, beta, nightly ]
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Rust setup
uses: dtolnay/rust-toolchain@stable
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
with:
toolchain: ${{ matrix.rust }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -298,7 +298,7 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- run: ./gradlew runRustTests

golang-build:
Expand All @@ -311,15 +311,15 @@ jobs:
version: [ '1.23.x', '1.24.x' ]
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}
- name: Setup Go
uses: actions/setup-go@v4
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ matrix.version }}
- name: Setup java to run Gradle script
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -329,7 +329,7 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Generate jar
run: ./gradlew assemble
- name: Run tests
Expand Down
38 changes: 19 additions & 19 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,12 +39,12 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}

- name: Setup java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ matrix.java }}
Expand All @@ -56,10 +56,10 @@ jobs:
echo "BUILD_JAVA_VERSION=${{ matrix.java }}" >> $GITHUB_ENV

- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
languages: ${{ matrix.language }}
config-file: ./.github/codeql/codeql-config.yml
Expand All @@ -68,7 +68,7 @@ jobs:
run: ./gradlew

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
category: "/language:${{matrix.language}}"

Expand All @@ -89,20 +89,20 @@ jobs:
DOTNET_CLI_TELEMETRY_OPTOUT: 1
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}

- name: Cache NuGet dependencies
uses: actions/cache@v4
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.nuget/packages
key: ${{ runner.os }}-nuget-${{ hashFiles('csharp/**/*.sln') }}
restore-keys: |
${{ runner.os }}-nuget-

- name: Setup java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -114,15 +114,15 @@ jobs:
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV

- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

- name: Setup dotnet
uses: actions/setup-dotnet@v5
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
dotnet-version: ${{ matrix.dotnet }}

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
languages: ${{ matrix.language }}
config-file: ./.github/codeql/codeql-config.yml
Expand All @@ -131,7 +131,7 @@ jobs:
run: ./csharp/build.sh

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
category: "/language:${{matrix.language}}"

Expand All @@ -152,12 +152,12 @@ jobs:
CXX: g++-${{ matrix.version }}
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.sha }}

- name: Setup java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -169,14 +169,14 @@ jobs:
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV

- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

- name: Install compiler
run: |
sudo apt-get install -y g++-${{ matrix.version }}

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
languages: ${{ matrix.language }}
config-file: ./.github/codeql/codeql-config.yml
Expand All @@ -185,21 +185,21 @@ jobs:
run: ./cppbuild/cppbuild

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
category: "/language:${{ matrix.language }}"
upload: false
output: sarif-results

- name: filter-sarif
uses: advanced-security/filter-sarif@v1
uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1
with:
patterns: |
-**/thirdparty/**
input: sarif-results/${{ matrix.language }}.sarif
output: sarif-results/${{ matrix.language }}.sarif

- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v4
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
sarif_file: sarif-results/${{ matrix.language }}.sarif
6 changes: 3 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.ref }}
- name: Setup java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: ${{ env.JAVA_VERSION }}
Expand All @@ -37,7 +37,7 @@ jobs:
echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
echo "BUILD_JAVA_VERSION=${{ env.JAVA_VERSION }}" >> $GITHUB_ENV
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v6
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
- name: Publish with Gradle
run: ./gradlew publish uploadArtifactsToCentralPortal
env:
Expand Down
Loading
Loading