Skip to content

Commit 829de1b

Browse files
xophamxopham
authored
ci: pin github actions by hash and update via dependabot (#3146)
1 parent e1c213d commit 829de1b

18 files changed

+97
-82
lines changed

‎.github/dependabot.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "github-actions"
9+
directory: "/"
10+
schedule:
11+
interval: "monthly"
12+
groups:
13+
gh-actions-packages:
14+
patterns:
15+
- "*"

‎.github/workflows/appsec.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -67,21 +67,21 @@ jobs:
6767
key: ${{ steps.cfg.outputs.key }}
6868
path: ${{ steps.cfg.outputs.path }}
6969
steps:
70-
- uses: actions/checkout@v4
70+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7171

7272
- name: Compute cache configuration
7373
id: cfg
7474
run: |
7575
echo "key=go-pkg-mod-${{ hashFiles('**/go.sum') }}" >> $GITHUB_OUTPUT
7676
echo "path=go_pkg_mod_cache" >> $GITHUB_OUTPUT
7777
78-
- uses: actions/setup-go@v5
78+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
7979
with:
8080
cache: false
8181

8282
- name: Cache Go modules
8383
id: cache
84-
uses: actions/cache@v4
84+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
8585
with:
8686
path: ${{ steps.cfg.outputs.path }}
8787
key: ${{ steps.cfg.outputs.key }}
@@ -104,18 +104,18 @@ jobs:
104104
go-version: [ "1.23", "1.22" ]
105105
fail-fast: true # saving some CI time - macos runners are too long to get
106106
steps:
107-
- uses: actions/checkout@v4
107+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
108108

109109
- name: Restore Go modules cache
110-
uses: actions/cache/restore@v4
110+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
111111
with:
112112
path: ${{ needs.go-mod-caching.outputs.path }}
113113
key: ${{ needs.go-mod-caching.outputs.key }}
114114
restore-keys: go-pkg-mod-
115115
enableCrossOsArchive: true
116116
fail-on-cache-miss: true
117117

118-
- uses: actions/setup-go@v5
118+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
119119
with:
120120
go-version: ${{ matrix.go-version }}
121121
cache: false # we manage the caching ourselves
@@ -151,18 +151,18 @@ jobs:
151151
matrix:
152152
runs-on: [ macos-latest, windows-latest, ubuntu-latest-16-cores ]
153153
steps:
154-
- uses: actions/checkout@v4
154+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
155155

156156
- name: Restore Go modules cache
157-
uses: actions/cache/restore@v4
157+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
158158
with:
159159
path: ${{ needs.go-mod-caching.outputs.path }}
160160
key: ${{ needs.go-mod-caching.outputs.key }}
161161
restore-keys: go-pkg-mod-
162162
enableCrossOsArchive: true
163163
fail-on-cache-miss: true
164164

165-
- uses: actions/setup-go@v5
165+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
166166
with:
167167
go-version: stable
168168
cache: false # we manage the caching ourselves
@@ -199,10 +199,10 @@ jobs:
199199

200200
fail-fast: false
201201
steps:
202-
- uses: actions/checkout@v4
202+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
203203

204204
- name: Restore Go modules cache
205-
uses: actions/cache/restore@v4
205+
uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
206206
with:
207207
path: ${{ needs.go-mod-caching.outputs.path }}
208208
key: ${{ needs.go-mod-caching.outputs.key }}

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,13 @@ jobs:
3535

3636
steps:
3737
- name: Checkout repository
38-
uses: actions/checkout@v3
38+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3939
with:
4040
ref: ${{ inputs.ref || github.ref }}
4141

4242
# Initializes the CodeQL tools for scanning.
4343
- name: Initialize CodeQL
44-
uses: github/codeql-action/init@v2
44+
uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
4545
with:
4646
languages: ${{ matrix.language }}
4747
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -52,7 +52,7 @@ jobs:
5252
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5353
# If this step fails, then you should remove it and run the build manually
5454
- name: Autobuild
55-
uses: github/codeql-action/autobuild@v2
55+
uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
5656

5757
- name: Perform CodeQL Analysis
58-
uses: github/codeql-action/analyze@v2
58+
uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1

‎.github/workflows/datadog-static-analysis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
name: Datadog Static Analyzer
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1616
- name: Check code meets quality and security standards
1717
id: datadog-static-analysis
1818
uses: DataDog/datadog-static-analyzer-github-action@v1

‎.github/workflows/ecosystems-label-issue.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@ jobs:
1515
steps:
1616
# https://github.com/marketplace/actions/actions-ecosystem-add-labels
1717
- name: add label
18-
uses: actions-ecosystem/action-add-labels@v1
18+
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
1919
with:
2020
labels: apm:ecosystem

‎.github/workflows/ecosystems-label-pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ jobs:
1616
steps:
1717
# https://github.com/marketplace/actions/actions-ecosystem-add-labels
1818
- name: add label
19-
uses: actions-ecosystem/action-add-labels@v1
19+
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
2020
with:
2121
labels: apm:ecosystem

‎.github/workflows/govulncheck.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ jobs:
2424
govulncheck-tests:
2525
runs-on: ubuntu-latest
2626
steps:
27-
- uses: actions/checkout@v3
27+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2828
with:
2929
ref: ${{ inputs.ref || github.ref }}
3030
- name: Checkout Go
31-
uses: actions/setup-go@v3
31+
uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
3232
with:
3333
go-version: 'stable'
3434
- name: Install govulncheck
@@ -40,4 +40,4 @@ jobs:
4040
run: |
4141
go list -f '{{.Dir}}' ./contrib/... | while read dir ; do
4242
govulncheck -C $dir .
43-
done
43+
done

‎.github/workflows/multios-unit-tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,10 @@ jobs:
4040
DD_APPSEC_WAF_TIMEOUT: 1h
4141
steps:
4242
- name: Checkout
43-
uses: actions/checkout@v2
43+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
4444
with:
4545
ref: ${{ inputs.ref || github.ref }}
46-
- uses: actions/setup-go@v3
46+
- uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
4747
with:
4848
go-version: ${{ inputs.go-version }}
4949
check-latest: true

‎.github/workflows/needs-triage.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ jobs:
9494

9595
steps:
9696
- name: Notify about ${{ matrix.number }}
97-
uses: slackapi/slack-github-action@v1.24.0
97+
uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
9898
with:
9999
payload: |-
100100
{

‎.github/workflows/orchestrion.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ jobs:
3535
runs-on: ubuntu-latest
3636
steps:
3737
- name: Checkout Code
38-
uses: actions/checkout@v4
38+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3939
- name: Setup Go
40-
uses: actions/setup-go@v5
40+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
4141
with:
4242
go-version: stable
4343
cache: true
@@ -54,12 +54,12 @@ jobs:
5454
json: ${{ steps.matrix.outputs.json }}
5555
steps:
5656
- name: Checkout Code
57-
uses: actions/checkout@v4
57+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5858
with:
5959
repository: ${{ inputs.orchestrion-version != '' && 'DataDog/dd-trace-go' || github.repository }}
6060
ref: ${{ inputs.orchestrion-version != '' && 'main' || github.sha }}
6161
- name: Setup Go
62-
uses: actions/setup-go@v5
62+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
6363
with:
6464
go-version: stable
6565
cache: true
@@ -93,7 +93,7 @@ jobs:
9393
runs-on: ${{ matrix.runs-on == 'ubuntu' && fromJson('{"labels":"ubuntu-16-core-latest","group":"Large Runner Shared Public"}') || (matrix.runs-on == 'windows' && fromJson('{"labels":"windows-shared-8core","group":"LARGE WINDOWS SHARED"}')) || format('{0}-latest', matrix.runs-on) }}
9494
steps:
9595
- name: Checkout Code
96-
uses: actions/checkout@v4
96+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9797
with:
9898
path: ${{ github.workspace }}/dd-trace-go
9999
repository: ${{ inputs.orchestrion-version != '' && 'DataDog/dd-trace-go' || github.repository }}
@@ -102,15 +102,15 @@ jobs:
102102
- name: Check out orchestrion
103103
if: inputs.orchestrion-version != ''
104104
id: checkout-orchestrion
105-
uses: actions/checkout@v4
105+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
106106
with:
107107
path: ${{ github.workspace }}/orchestrion
108108
repository: DataDog/orchestrion
109109
ref: ${{ inputs.orchestrion-version }}
110110

111111
- name: Setup Go
112112
id: setup-go
113-
uses: actions/setup-go@v5
113+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
114114
with:
115115
go-version: ${{ matrix.go-version }}
116116
cache: true
@@ -120,7 +120,7 @@ jobs:
120120
121121
# ddapm-test-agent is used to observe side effects from the tracer during integration tests.
122122
- name: Set up Python
123-
uses: actions/setup-python@v5
123+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
124124
with:
125125
python-version: 3.x
126126
cache: pip
@@ -214,7 +214,7 @@ jobs:
214214
echo "version=$(echo '${{ steps.setup-go.outputs.go-version }}' | cut -d'.' -f1,2)" >> "${GITHUB_OUTPUT}"
215215
- name: Upload coverage report
216216
if: inputs.collect-coverage
217-
uses: actions/upload-artifact@v4
217+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
218218
with:
219219
name: coverage-integration+${{ matrix.mode }}+go${{ steps.go.outputs.version }}+${{ runner.os }}+${{ runner.arch }}
220220
path: ${{ github.workspace }}/orchestrion/coverage/integration.out

0 commit comments

Comments
 (0)