From 3d0bd057ddc702c3ef37c4cb442586e21e90932d Mon Sep 17 00:00:00 2001 From: Julian Chang Date: Mon, 3 Aug 2026 20:00:38 +0700 Subject: [PATCH] pin workflows to hash --- .github/actions/install-cargo-tool/action.yml | 2 +- .github/actions/setup-rust/action.yml | 4 ++-- .github/workflows/aur_publish.yml | 8 ++++---- .github/workflows/oneclient_nightly.yml | 4 ++-- .github/workflows/oneclient_release.yml | 16 ++++++++-------- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/actions/install-cargo-tool/action.yml b/.github/actions/install-cargo-tool/action.yml index 0ff8a6b8..579de1a5 100644 --- a/.github/actions/install-cargo-tool/action.yml +++ b/.github/actions/install-cargo-tool/action.yml @@ -27,7 +27,7 @@ runs: - name: Setup cargo-binstall if: steps.check.outputs.installed == 'false' - uses: cargo-bins/cargo-binstall@main + uses: cargo-bins/cargo-binstall@e00d2c94cc0067b77737821097a62d91c0301baa # v1.21.1 - name: Install ${{ inputs.tool }} if: steps.check.outputs.installed == 'false' diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index b216f6de..a3f4ad65 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -25,7 +25,7 @@ runs: using: composite steps: - name: Install Rust (stable) - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable branch @ 2026-07-16 with: toolchain: stable targets: ${{ inputs.target }} @@ -33,7 +33,7 @@ runs: - name: Cache Rust if: ${{ inputs.restore-cache == 'true' }} - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: key: ${{ inputs.target }} save-if: ${{ inputs.save-cache }} diff --git a/.github/workflows/aur_publish.yml b/.github/workflows/aur_publish.yml index cef6d6d5..ba6a52ae 100644 --- a/.github/workflows/aur_publish.yml +++ b/.github/workflows/aur_publish.yml @@ -30,7 +30,7 @@ jobs: needs: resolve runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Compute source sha256 id: hash @@ -52,7 +52,7 @@ jobs: sed -i "s/^sha256sums=.*/sha256sums=('${SHA256}')/" "$PKGBUILD" - name: Publish to AUR - uses: KSXGitHub/github-actions-deploy-aur@v3 + uses: KSXGitHub/github-actions-deploy-aur@a97f56a8425a7a7f3b8c58607f769c69b089cadb # v3.0.1 with: pkgname: oneclient pkgbuild: distribution/aur/oneclient/PKGBUILD @@ -65,7 +65,7 @@ jobs: needs: resolve runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Compute deb sha256 id: hash @@ -87,7 +87,7 @@ jobs: sed -i "s/^sha256sums=.*/sha256sums=('${SHA256}')/" "$PKGBUILD" - name: Publish to AUR - uses: KSXGitHub/github-actions-deploy-aur@v3 + uses: KSXGitHub/github-actions-deploy-aur@a97f56a8425a7a7f3b8c58607f769c69b089cadb # v3.0.1 with: pkgname: oneclient-bin pkgbuild: distribution/aur/oneclient-bin/PKGBUILD diff --git a/.github/workflows/oneclient_nightly.yml b/.github/workflows/oneclient_nightly.yml index be98d49f..e7249aff 100644 --- a/.github/workflows/oneclient_nightly.yml +++ b/.github/workflows/oneclient_nightly.yml @@ -58,7 +58,7 @@ jobs: runs-on: ${{ matrix.platform }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: (macOS) Pin deployment target if: matrix.macos_deployment_target != '' @@ -205,7 +205,7 @@ jobs: ls -la dist - name: Upload unsigned installers - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: oneclient-nightly-${{ matrix.os_key }}-${{ matrix.arch }} path: dist/* diff --git a/.github/workflows/oneclient_release.yml b/.github/workflows/oneclient_release.yml index f8e2e044..9cc21dc3 100644 --- a/.github/workflows/oneclient_release.yml +++ b/.github/workflows/oneclient_release.yml @@ -36,7 +36,7 @@ jobs: tag: ${{ steps.version.outputs.tag }} sha: ${{ steps.version.outputs.sha }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Rust if: inputs.bump != 'none' @@ -191,7 +191,7 @@ jobs: steps: # Pin to the commit `prepare` resolved — with `bump` that is the version # commit it just pushed, which github.sha would not point at. - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ needs.prepare.outputs.sha }} @@ -285,14 +285,14 @@ jobs: - name: (Windows) Upload unsigned app binary artifact if: matrix.platform == 'windows-latest' id: win_upload_unsigned_bin - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: oneclient-windows-binary-unsigned path: target/release/oneclient_app.exe - name: (Windows) Submit SignPath signing request for app binary if: matrix.platform == 'windows-latest' - uses: signpath/github-action-submit-signing-request@v1 + uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1.3 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }} @@ -406,14 +406,14 @@ jobs: - name: (Windows) Upload unsigned installer artifact if: matrix.platform == 'windows-latest' id: win_upload_unsigned - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: oneclient-windows-installer-unsigned path: ${{ steps.win_installer.outputs.path }} - name: (Windows) Submit SignPath signing request if: matrix.platform == 'windows-latest' - uses: signpath/github-action-submit-signing-request@v1 + uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1.3 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }} @@ -527,7 +527,7 @@ jobs: PY - name: Upload manifest fragment - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: manifest-${{ matrix.os_key }}-${{ matrix.arch }} path: fragments/*.json @@ -539,7 +539,7 @@ jobs: contents: write steps: - name: Download all manifest fragments - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: pattern: manifest-* path: fragments