From 9160152fbbb8149a0f05fadeb511bee929dae8fe Mon Sep 17 00:00:00 2001 From: Stephan Bauer Date: Sun, 8 Nov 2026 16:44:29 +0100 Subject: [PATCH] chore(actions): migrate from dedicated version to sha --- .github/actions/mxd-test-action/action.yml | 2 +- .github/workflows/publish-playground.yaml | 6 +++--- .github/workflows/run-end2end-tests.yml | 12 ++++++------ .github/workflows/run-tests.yaml | 12 ++++++------ .github/workflows/secrets-scan.yml | 4 ++-- .github/workflows/stale-bot.yml | 8 ++++---- .github/workflows/verify-playground.yml | 8 ++++---- .github/workflows/verify.yaml | 6 +++--- 8 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/actions/mxd-test-action/action.yml b/.github/actions/mxd-test-action/action.yml index e791b100..00d82613 100644 --- a/.github/actions/mxd-test-action/action.yml +++ b/.github/actions/mxd-test-action/action.yml @@ -24,7 +24,7 @@ runs: using: "composite" steps: - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 18 diff --git a/.github/workflows/publish-playground.yaml b/.github/workflows/publish-playground.yaml index 954ca566..ca45d131 100644 --- a/.github/workflows/publish-playground.yaml +++ b/.github/workflows/publish-playground.yaml @@ -35,9 +35,9 @@ jobs: contents: write pages: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 18 - name: npm ci, build and test @@ -46,7 +46,7 @@ jobs: npm run build -- --base-href=/tutorial-resources/policy-playground/ - name: deploy to gh-pages - uses: peaceiris/actions-gh-pages@v4 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: ./edc-policy-playground/dist diff --git a/.github/workflows/run-end2end-tests.yml b/.github/workflows/run-end2end-tests.yml index 52125ef9..1997c96c 100644 --- a/.github/workflows/run-end2end-tests.yml +++ b/.github/workflows/run-end2end-tests.yml @@ -32,20 +32,20 @@ jobs: steps: - name: "Setup Helm" - uses: azure/setup-helm@v4 + uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 with: version: v3.8.1 - name: "Setup Kubectl" - uses: azure/setup-kubectl@v4 + uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1 - name: Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: java-version: '21' distribution: 'temurin' - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: "Build Runtime Docker Images" working-directory: mxd-runtimes @@ -53,10 +53,10 @@ jobs: ./gradlew clean dockerize - name: "Setup Terraform" - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 - name: "Create k8s Kind Cluster" - uses: helm/kind-action@v1.10.0 + uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0 with: config: mxd/kind.config.yaml cluster_name: mxd diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml index 1875f7b4..e1a9f6cb 100644 --- a/.github/workflows/run-tests.yaml +++ b/.github/workflows/run-tests.yaml @@ -36,8 +36,8 @@ jobs: Unit-Tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: 'temurin' java-version: '21' @@ -49,8 +49,8 @@ jobs: API-Tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: 'temurin' java-version: '21' @@ -62,8 +62,8 @@ jobs: Component-Tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: 'temurin' java-version: '21' diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml index ebe52ae2..f18de4c6 100644 --- a/.github/workflows/secrets-scan.yml +++ b/.github/workflows/secrets-scan.yml @@ -40,13 +40,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 # Ensure full clone for pull request workflows - name: TruffleHog OSS id: trufflehog - uses: trufflesecurity/trufflehog@main + uses: trufflesecurity/trufflehog@ea68ca03c865c5f324e86e849ced20ed3cf9dbbb # v3.99.8 continue-on-error: true with: path: ./ # Scan the entire repository diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml index 8fbf544b..19a316cc 100644 --- a/.github/workflows/stale-bot.yml +++ b/.github/workflows/stale-bot.yml @@ -35,7 +35,7 @@ jobs: issues: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: operations-per-run: 1000 days-before-issue-stale: 32 @@ -55,7 +55,7 @@ jobs: permissions: issues: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: operations-per-run: 1000 days-before-issue-stale: 32 @@ -75,7 +75,7 @@ jobs: permissions: issues: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: operations-per-run: 1000 days-before-issue-stale: 14 @@ -96,7 +96,7 @@ jobs: permissions: pull-requests: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: operations-per-run: 1000 days-before-issue-stale: -1 # ignore issues (overwrite default days-before-stale) diff --git a/.github/workflows/verify-playground.yml b/.github/workflows/verify-playground.yml index 48baf544..21c0d90a 100644 --- a/.github/workflows/verify-playground.yml +++ b/.github/workflows/verify-playground.yml @@ -37,11 +37,11 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Run dash id: run-dash - uses: eclipse-tractusx/sig-infra/.github/actions/run-dash@main + uses: eclipse-tractusx/sig-infra/.github/actions/run-dash@1a2be9d3b599c081a4a307d8124f33d209f7c54e # main with: dash_input: "edc-policy-playground/package-lock.json" check-playground: @@ -50,9 +50,9 @@ jobs: run: working-directory: edc-policy-playground steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 18 - name: Run npm ci diff --git a/.github/workflows/verify.yaml b/.github/workflows/verify.yaml index 6de6ef9e..025c9061 100644 --- a/.github/workflows/verify.yaml +++ b/.github/workflows/verify.yaml @@ -39,7 +39,7 @@ jobs: verify-license-headers: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: "Check for files without a license header" run: |- # checks all java, yaml, kts and sql files for an Apache 2.0 license header @@ -54,10 +54,10 @@ jobs: validate-terraform-format: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: "Setup Terraform" - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 - name: "Validate Terraform format" working-directory: mxd