Merge pull request #131 from github/jm-remediations-from-ossf-run

chore: security remediation after turning on ossf scorecoard

Author: jmeridth

.github/workflows/auto-labeler.yml

@@ -21,7 +21,7 @@
       name: Auto label pull requests
       runs-on: ubuntu-latest
       steps:
-        - uses: release-drafter/release-drafter@v6
+        - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           with:

.github/workflows/codeql-analysis.yml

@@ -38,13 +38,13 @@ jobs:
         language: ['python']
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14

.github/workflows/docker-image.yml

@@ -14,6 +14,6 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
       - name: Build the Docker image
         run: docker build . --file Dockerfile --platform linux/amd64 --tag stale_repos:"$(date +%s)"

.github/workflows/linter.yaml

@@ -18,7 +18,7 @@ jobs:
       statuses: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
         with:
           # Full git history is needed to get a proper
           # list of changed files within `super-linter`
@@ -28,7 +28,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements.txt -r requirements-test.txt
       - name: Lint Code Base
-        uses: super-linter/super-linter@v6
+        uses: super-linter/super-linter@4758be622215d0954c8353ee4877ffd60111cf8e
         env:
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-title.yml

@@ -20,7 +20,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@e9fabac35e210fea40ca5b14c0da95a099eff26f
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/python-package.yml

@@ -19,9 +19,9 @@ jobs:
       matrix:
         python-version: [3.9, 3.11, 3.12]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies

.github/workflows/release.yml

@@ -33,7 +33,7 @@
         contents: write
         pull-requests: read
       steps:
-        - uses: release-drafter/release-drafter@v6
+        - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348
           id: release-drafter
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -55,17 +55,17 @@
         IMAGE_NAME: github/stale_repos # different than repo name (underscore instead of dash)
       steps:
         - name: Set up Docker Buildx
-          uses: docker/setup-buildx-action@v3
+          uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
         - name: Log in to the Container registry
-          uses: docker/login-action@v3
+          uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
           with:
             registry: ${{ env.REGISTRY }}
             username: ${{ github.actor }}
             password: ${{ secrets.GITHUB_TOKEN }}
         - uses: actions/checkout@v4
         - name: Push Docker Image
           if: ${{ success() }}
-          uses: docker/build-push-action@v5
+          uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0
           with:
             context: .
             file: ./Dockerfile
@@ -84,7 +84,7 @@
         discussions: write
       steps:
         - name: Create an announcement discussion for release
-          uses: abirismyname/create-discussion@v1.2.0
+          uses: abirismyname/create-discussion@6e6ef67e5eeb042343ef8b3d8d0f5d545cbdf024
           env:
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           with:

.github/workflows/use-action.yml

@@ -31,7 +31,7 @@ jobs:
           ORGANIZATION: github
           INACTIVE_DAYS: 1
       - name: Create issue
-        uses: peter-evans/create-issue-from-file@v5
+        uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94
         with:
           title: Stale repository report
           content-filepath: ./stale_repos.md

Dockerfile

@@ -1,6 +1,6 @@
 #checkov:skip=CKV_DOCKER_2
 #checkov:skip=CKV_DOCKER_3
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:2be8daddbb82756f7d1f2c7ece706aadcb284bf6ab6d769ea695cc3ed6016743
 LABEL com.github.actions.name="stale-repos" \
     com.github.actions.description="Find stale repositories in a GitHub organization." \
     com.github.actions.icon="check-square" \