Skip to content

Commit cd3f8d9

Browse files
damientobin1damientobin1
committed
CCM-14499: Pinning all GitHub Actions to SHAs
1 parent 5b3a855 commit cd3f8d9

14 files changed

Lines changed: 47 additions & 94 deletions

‎.github/actions/build-docs/action.yml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,22 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - uses: actions/setup-node@v4
1312
with:
1413
node-version: 22
1514
- name: Npm cli install
1615
working-directory: ./docs
1716
run: npm ci
1817
shell: bash
1918
- name: Setup Ruby
20-
uses: ruby/setup-ruby@v1.180.1
21-
with:
19+
uses: ruby/setup-ruby@3783f195e29b74ae398d7caca108814bbafde90e # v1.180.1 with:
2220
ruby-version: "3.2" # Not needed with a .ruby-version file
2321
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
2422
cache-version: 0 # Increment this number if you need to re-download cached gems
2523
working-directory: "./docs"
2624
- name: Setup Pages
2725
id: pages
28-
uses: actions/configure-pages@v5
29-
- name: Build with Jekyll
26+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - name: Build with Jekyll
3027
working-directory: ./docs
3128
# Outputs to the './_site' directory by default
3229
shell: bash
@@ -36,7 +33,6 @@ runs:
3633
JEKYLL_ENV: production
3734
- name: Upload artifact
3835
# Automatically uploads an artifact from the './_site' directory by default
39-
uses: actions/upload-pages-artifact@v3
40-
with:
36+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with:
4137
path: "docs/_site/"
4238
name: jekyll-docs-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
36-
with:
35+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
3736
name: lines-of-code-report.json.zip
3837
path: ./lines-of-code-report.json.zip
3938
retention-days: 21
@@ -44,8 +43,7 @@ runs:
4443
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4544
- name: "Authenticate to send the report"
4645
if: steps.check.outputs.secrets_exist == 'true'
47-
uses: aws-actions/configure-aws-credentials@v4
48-
with:
46+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with:
4947
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5048
aws-region: ${{ inputs.idp_aws_report_upload_region }}
5149
- name: "Send the CLOC report to the central location"

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
36-
with:
35+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
3736
name: sbom-repository-report.json.zip
3837
path: ./sbom-repository-report.json.zip
3938
retention-days: 21
@@ -47,8 +46,7 @@ runs:
4746
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4847
- name: "Upload vulnerabilities report as an artefact"
4948
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v4
51-
with:
49+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
5250
name: vulnerabilities-repository-report.json.zip
5351
path: ./vulnerabilities-repository-report.json.zip
5452
retention-days: 21
@@ -58,8 +56,7 @@ runs:
5856
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
5957
- name: "Authenticate to send the reports"
6058
if: steps.check.outputs.secrets_exist == 'true'
61-
uses: aws-actions/configure-aws-credentials@v4
62-
with:
59+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 with:
6360
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6461
aws-region: ${{ inputs.idp_aws_report_upload_region }}
6562
- name: "Send the SBOM and vulnerabilities reports to the central location"

‎.github/actions/sync-template-repo/action.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,7 @@ runs:
88
using: "composite"
99
steps:
1010
- name: "Check out template repository"
11-
uses: actions/checkout@v4
12-
with:
11+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with:
1312
repository: NHSDigital/nhs-notify-repository-template
1413
path: nhs-notify-repository-template
1514
token: ${{ inputs.github_token }}

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@ jobs:
2929
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
3030
steps:
3131
- name: "Checkout code"
32-
uses: actions/checkout@v4
33-
- name: "Set CI/CD variables"
32+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: "Set CI/CD variables"
3433
id: variables
3534
run: |
3635
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,7 @@ jobs:
3737
# tag: ${{ steps.variables.outputs.tag }}
3838
steps:
3939
- name: "Checkout code"
40-
uses: actions/checkout@v4
41-
- name: "Set CI/CD variables"
40+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: "Set CI/CD variables"
4241
id: variables
4342
run: |
4443
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
@@ -70,8 +69,7 @@ jobs:
7069
needs: metadata
7170
steps:
7271
- name: "Checkout code"
73-
uses: actions/checkout@v4
74-
72+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
7573
- name: "Get version"
7674
id: get-asset-version
7775
shell: bash
@@ -110,6 +108,5 @@ jobs:
110108

111109
- name: Deploy to GitHub Pages
112110
id: deployment
113-
uses: actions/deploy-pages@v4
114-
with:
111+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 with:
115112
artifact_name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@ jobs:
1515
steps:
1616
- name: combine-prs
1717
id: combine-prs
18-
uses: github/combine-prs@v5.2.0
19-
with:
18+
uses: github/combine-prs@e6d37110da1b512313419ba6992492dad622139f # v5.2.0 with:
2019
ci_required: false
2120
labels: dependencies
2221
pr_title: Combined Dependabot PRs

‎.github/workflows/release_created.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@ jobs:
1919

2020
steps:
2121
- name: Checkout repository
22-
uses: actions/checkout@v5.0.0
23-
22+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2423
- name: "Package and Publish Terraform modules"
2524
run: |
2625
ARTIFACTS_DIR="$PWD/../../artifacts"

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,15 @@ jobs:
1616

1717
steps:
1818
- name: Check out the repository
19-
uses: actions/checkout@v4
20-
19+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2120
- name: Sync repository template
2221
uses: ./.github/actions/sync-template-repo
2322
with:
2423
github_token: ${{ github.token }}
2524

2625
- name: Create Pull Request
2726
if: ${{ !env.ACT }}
28-
uses: peter-evans/create-pull-request@v7.0.8
29-
with:
27+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 with:
3028
token: ${{ secrets.GITHUB_TOKEN }}
3129
commit-message: Drift from template
3230
branch: scheduledTemplateRepositorySync

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,7 @@ jobs:
5959
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6060
# format to the repository Actions tab.
6161
- name: "Upload artifact"
62-
uses: actions/upload-artifact@v4
63-
with:
62+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with:
6463
name: SARIF file
6564
path: results.sarif
6665
retention-days: 5

0 commit comments

Comments
 (0)