ci: use pinned SHAs for Github actions (#13)

primer-io · Apr 23, 2024 · 0c87da7 · 0c87da7
1 parent 1b42714
commit 0c87da7
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 8 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
         with:
           distribution: 'corretto'
           java-version: '17'

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
@@ -19,7 +19,7 @@ jobs:
     name: "Bump release version and create changelog"
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_ACCESS_TOKEN }}
@@ -44,7 +44,7 @@ jobs:
         run: |
           echo "TO_VERSION=$(cz version --project)" >> $GITHUB_ENV
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83 # v6.0.4
         with:
           token: ${{ secrets.RELEASE_ACCESS_TOKEN }}
           base: main

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
         with:
           distribution: 'corretto'
           java-version: '17'

diff --git a/.github/workflows/post-release-merge.yml b/.github/workflows/post-release-merge.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Git - Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ secrets.RELEASE_ACCESS_TOKEN }}
@@ -30,7 +30,7 @@ jobs:
       - name: Record changelog for current release
         run: cz changelog $FROM_VERSION..$RELEASE_VERSION --file-name="release.md"
       - name: Create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
         with:
           name: "Release ${{ env.RELEASE_VERSION }}"
           tag: ${{ env.RELEASE_VERSION }}