From a2c89cd083f3b5f91b9ac56ad19987d55e560a58 Mon Sep 17 00:00:00 2001 From: Jack Edwards Date: Fri, 31 Jul 2026 14:42:18 -0500 Subject: [PATCH] Pin GitHub Actions to commit SHAs and update to latest releases Every action is now referenced by commit SHA with the version in a trailing comment, so a retargeted tag cannot silently change what CI runs. Every action also moves to its latest stable release: actions/checkout v4 to v7.0.1, actions/setup-dotnet v4 to v6.0.0, github/codeql-action to v4.37.4, appleboy/ssh-action v1.2.2 to v1.2.5, appleboy/scp-action v0.1.7 to v1.0.0, docker/build-push-action v6 to v7.3.0, docker/setup-buildx-action v3 to v4.2.0, docker/login-action v3 to v4.6.0, docker/metadata-action v5 to v6.2.0, and pnpm/action-setup v4 to v6.0.9. The CodeQL steps had drifted apart on analyze@v2 and init@v3; both now sit on the same version. The docker and pnpm majors move their default runtime to Node 24, which the hosted ubuntu-latest runners already provide. None of the inputs or environment variables those releases dropped were in use here. Co-Authored-By: Claude Opus 5 --- .github/workflows/build-and-push-api.yml | 10 +++++----- .github/workflows/build-and-push-web.yml | 10 +++++----- .github/workflows/codeql-analysis.yml | 12 ++++++------ .github/workflows/deploy-to-environment.yml | 18 +++++++++--------- .github/workflows/detect-code-changes.yml | 2 +- .github/workflows/pr-build-api.yml | 6 +++--- .github/workflows/pr-build-web.yml | 6 +++--- .github/workflows/unit-test.yml | 12 ++++++------ 8 files changed, 38 insertions(+), 38 deletions(-) diff --git a/.github/workflows/build-and-push-api.yml b/.github/workflows/build-and-push-api.yml index cfdf4a61..d1911c50 100644 --- a/.github/workflows/build-and-push-api.yml +++ b/.github/workflows/build-and-push-api.yml @@ -31,16 +31,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 fetch-tags: 'true' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to the Container registry - uses: docker/login-action@v3 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.registry }} username: ${{ github.actor }} @@ -48,14 +48,14 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ env.registry }}/${{ vars.API_IMAGE_NAME }} flavor: | latest=${{ (github.event_name == 'workflow_dispatch' && 'true') || 'auto' }} - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: ./Crypter.API/Dockerfile diff --git a/.github/workflows/build-and-push-web.yml b/.github/workflows/build-and-push-web.yml index dda4b245..230c81d0 100644 --- a/.github/workflows/build-and-push-web.yml +++ b/.github/workflows/build-and-push-web.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 fetch-tags: 'true' @@ -43,10 +43,10 @@ jobs: sed -i 's|${API_BASE_URL}|${{ vars.API_BASE_URL }}|g' wwwroot/appsettings.Staging.json - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to the Container registry - uses: docker/login-action@v3 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.registry }} username: ${{ github.actor }} @@ -54,14 +54,14 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: flavor: | latest=${{ (github.event_name == 'workflow_dispatch' && 'true') || 'auto' }} images: ${{ env.registry }}/${{ vars.WEB_IMAGE_NAME }} - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: ./Crypter.Web/Dockerfile diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 5c35c752..070251af 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,11 +29,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -41,13 +41,13 @@ jobs: # Prefix the list here with "+" to use these queries and those in the config file. # queries: ./path/to/local/query, your-org/your-repo/queries@main - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.18.0 @@ -61,4 +61,4 @@ jobs: run: dotnet build --no-restore - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 diff --git a/.github/workflows/deploy-to-environment.yml b/.github/workflows/deploy-to-environment.yml index 40643d0a..fd47e022 100644 --- a/.github/workflows/deploy-to-environment.yml +++ b/.github/workflows/deploy-to-environment.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Stop service - uses: appleboy/ssh-action@v1.2.2 + uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -38,7 +38,7 @@ jobs: fi - name: Push latest systemctl service file - uses: appleboy/scp-action@v0.1.7 + uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -49,7 +49,7 @@ jobs: strip_components: 2 - name: Reload systemctl daemon - uses: appleboy/ssh-action@v1.2.2 + uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -58,7 +58,7 @@ jobs: script: systemctl --user daemon-reload - name: Push latest Docker Compose file - uses: appleboy/scp-action@v0.1.7 + uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -69,7 +69,7 @@ jobs: - name: Push latest Docker Compose override file if deploying to Staging server if: github.event.inputs.environment == 'staging' - uses: appleboy/scp-action@v0.1.7 + uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -79,7 +79,7 @@ jobs: target: crypter-web-container/ - name: Pull latest images - uses: appleboy/ssh-action@v1.2.2 + uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -88,7 +88,7 @@ jobs: script: docker compose --project-directory crypter-web-container --profile ${{ env.docker_compose_profile }} pull - name: Migrate database - uses: appleboy/ssh-action@v1.2.2 + uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} @@ -97,7 +97,7 @@ jobs: script: docker compose --project-directory crypter-web-container --profile ${{ env.docker_compose_profile }} run api /app/efbundle - name: Start service - uses: appleboy/ssh-action@v1.2.2 + uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5 with: host: ${{ secrets.APPSERVER_SSH_HOST }} port: ${{ secrets.APPSERVER_SSH_PORT }} diff --git a/.github/workflows/detect-code-changes.yml b/.github/workflows/detect-code-changes.yml index f1660dd4..4aa4dbdf 100644 --- a/.github/workflows/detect-code-changes.yml +++ b/.github/workflows/detect-code-changes.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/pr-build-api.yml b/.github/workflows/pr-build-api.yml index f600c4d2..f1a1030c 100644 --- a/.github/workflows/pr-build-api.yml +++ b/.github/workflows/pr-build-api.yml @@ -16,13 +16,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: ./Crypter.API/Dockerfile diff --git a/.github/workflows/pr-build-web.yml b/.github/workflows/pr-build-web.yml index b7b81ace..cd4b173e 100644 --- a/.github/workflows/pr-build-web.yml +++ b/.github/workflows/pr-build-web.yml @@ -16,13 +16,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: ./Crypter.Web/Dockerfile diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index bda6b10b..4e6b2944 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -14,14 +14,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.18.0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x @@ -40,14 +40,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.18.0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x