Skip to content

Commit ac6e321

Browse files
damientobin1damientobin1
authored
CCM-14499: Pin GitHub Actions to SHAs (#227)
* CCM-15100: Changing Results Bucket Config * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Correct configure-aws-credentials v4 SHA * CCM-14499: Correct annotated tag SHA pins * CCM-14499: Pinning all GitHub Actions to SHAs * CCM-14499: Pin remaining GitHub Actions refs to SHAs * CCM-14499: Pinning all GitHub Actions to SHAs
1 parent a3cbde0 commit ac6e321

14 files changed

Lines changed: 49 additions & 53 deletions

‎.github/actions/build-docs/action.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,24 +8,24 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
12+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1313
with:
1414
node-version: 18
1515
- name: Npm cli install
1616
working-directory: ./docs
1717
run: npm ci
1818
shell: bash
1919
- name: Setup Ruby
20-
uses: ruby/setup-ruby@v1.180.1
20+
uses: ruby/setup-ruby@3783f195e29b74ae398d7caca108814bbafde90e # v1.180.1
2121
with:
2222
ruby-version: "3.2" # Not needed with a .ruby-version file
2323
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
2424
cache-version: 0 # Increment this number if you need to re-download cached gems
2525
working-directory: "./docs"
2626
- name: Setup Pages
2727
id: pages
28-
uses: actions/configure-pages@v5
28+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
2929
- name: Build with Jekyll
3030
working-directory: ./docs
3131
# Outputs to the './_site' directory by default
@@ -36,7 +36,7 @@ runs:
3636
JEKYLL_ENV: production
3737
- name: Upload artifact
3838
# Automatically uploads an artifact from the './_site' directory by default
39-
uses: actions/upload-pages-artifact@v3
39+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
4040
with:
4141
path: "docs/_site/"
4242
name: jekyll-docs-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
35+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3636
with:
3737
name: lines-of-code-report.json.zip
3838
path: ./lines-of-code-report.json.zip
@@ -44,7 +44,7 @@ runs:
4444
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4545
- name: "Authenticate to send the report"
4646
if: steps.check.outputs.secrets_exist == 'true'
47-
uses: aws-actions/configure-aws-credentials@v4
47+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
4848
with:
4949
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5050
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
35+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3636
with:
3737
name: sbom-repository-report.json.zip
3838
path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
4747
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4848
- name: "Upload vulnerabilities report as an artefact"
4949
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v4
50+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5151
with:
5252
name: vulnerabilities-repository-report.json.zip
5353
path: ./vulnerabilities-repository-report.json.zip
@@ -58,7 +58,7 @@ runs:
5858
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
5959
- name: "Authenticate to send the reports"
6060
if: steps.check.outputs.secrets_exist == 'true'
61-
uses: aws-actions/configure-aws-credentials@v4
61+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
6262
with:
6363
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6464
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
3434
steps:
3535
- name: "Checkout code"
36-
uses: actions/checkout@v6
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3737
- name: "Set CI/CD variables"
3838
id: variables
3939
run: |

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ jobs:
5858
deploy_environment: ${{ steps.variables.outputs.deploy_environment }}
5959
steps:
6060
- name: "Checkout code"
61-
uses: actions/checkout@v6
61+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6262
- name: "Set CI/CD variables"
6363
id: variables
6464
run: |
@@ -114,9 +114,9 @@ jobs:
114114
CI_PIPELINE_IID: ${{ needs.metadata.outputs.ci_pipeline_iid }}
115115
steps:
116116
- name: "Checkout code"
117-
uses: actions/checkout@v6
117+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
118118
- name: Configure AWS credentials
119-
uses: aws-actions/configure-aws-credentials@v6
119+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6
120120
with:
121121
role-to-assume: "arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ASSUME_ROLE_NAME }}"
122122
role-session-name: deployInfra

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
steps:
1616
- name: combine-prs
1717
id: combine-prs
18-
uses: github/combine-prs@v5.2.0
18+
uses: github/combine-prs@2909f404763c3177a456e052bdb7f2e85d3a7cb3 # v5.2.0
1919
with:
2020
ci_required: false
2121
labels: dependencies

‎.github/workflows/pr_closed.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Checkout repository
51-
uses: actions/checkout@v6
52-
51+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5352
- name: Updating Main Environment
5453
env:
5554
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}

‎.github/workflows/release_created.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,7 @@ jobs:
2424

2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v6
28-
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2928
- name: Updating Main Environment
3029
env:
3130
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,9 @@ jobs:
1616

1717
steps:
1818
- name: Check out the repository
19-
uses: actions/checkout@v6
20-
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2120
- name: Check out external repository
22-
uses: actions/checkout@v6
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2322
with:
2423
repository: NHSDigital/nhs-notify-repository-template
2524
path: nhs-notify-repository-template
@@ -32,7 +31,7 @@ jobs:
3231
3332
- name: Create Pull Request
3433
if: ${{ !env.ACT }}
35-
uses: peter-evans/create-pull-request@v8.1.0
34+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
3635
with:
3736
token: ${{ secrets.GITHUB_TOKEN }}
3837
commit-message: Drift from template

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6060
# format to the repository Actions tab.
6161
- name: "Upload artifact"
62-
uses: actions/upload-artifact@v7
62+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
6363
with:
6464
name: SARIF file
6565
path: results.sarif

0 commit comments

Comments
 (0)