From c31f01da707e42b659202b45288d340376342093 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 16:31:26 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/workflows/auto-merge-dependabot.yml | 2 +- .github/workflows/build-vscode-extension.yml | 16 ++++----- .github/workflows/check-translations.yml | 6 ++-- .github/workflows/codeql-analysis.yml | 4 +-- .github/workflows/dotnet.yml | 16 ++++----- .github/workflows/idempotency-tests.yml | 22 ++++++------ .github/workflows/integration-tests.yml | 38 ++++++++++---------- .github/workflows/load-tests.yml | 4 +-- .github/workflows/project-auto-add.yml | 2 +- .github/workflows/sonarcloud.yml | 8 ++--- .github/workflows/surface-area-tests.yml | 18 +++++----- 11 files changed, 68 insertions(+), 68 deletions(-) diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index ee493ee4eb..c06892ff45 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3.1.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/build-vscode-extension.yml b/.github/workflows/build-vscode-extension.yml index 1097eb940a..f8f2e22f02 100644 --- a/.github/workflows/build-vscode-extension.yml +++ b/.github/workflows/build-vscode-extension.yml @@ -40,14 +40,14 @@ jobs: os: macOS-latest runs-on: ${{ matrix.binaries.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x - name: Use .NET 10 - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: "10.0.x" @@ -98,7 +98,7 @@ jobs: - name: Run sonar cloud analysis if: needs.checksecret.outputs.is_SONAR_TOKEN_set == 'true' - uses: SonarSource/sonarqube-scan-action@v8 + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} with: @@ -107,7 +107,7 @@ jobs: -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info,../npm-package/coverage/lcov.info - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ matrix.binaries.architecture }} path: vscode/packages/npm-package/.kiotabin/${{ steps.last_release.outputs.RELEASE_VERSION }}/${{ matrix.binaries.architecture }} @@ -128,9 +128,9 @@ jobs: id: "package" item: "tgz" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x @@ -168,7 +168,7 @@ jobs: if: matrix.builds.id == 'vscode' - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ matrix.builds.name }} path: vscode/packages/${{ matrix.builds.path }}/*.${{ matrix.builds.item }} diff --git a/.github/workflows/check-translations.yml b/.github/workflows/check-translations.yml index daf4eac6b1..dcfce84b5f 100644 --- a/.github/workflows/check-translations.yml +++ b/.github/workflows/check-translations.yml @@ -15,10 +15,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x @@ -27,7 +27,7 @@ jobs: shell: pwsh - name: Upload untranslated strings - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: untranslated-strings path: ./untranslated_strings.html diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 65dba4003e..767f569e26 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -61,10 +61,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 63308229d7..5e8b893773 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -16,16 +16,16 @@ jobs: pull-requests: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Setup Go # required so the integration tests can run gofmt against the generated Go code - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable - name: Restore dependencies @@ -43,13 +43,13 @@ jobs: - name: Add coverage to job summary run: cat ./reports/coverage/SummaryGithub.md >> $GITHUB_STEP_SUMMARY - name: Upload coverage report - uses: actions/upload-code-coverage@v1.4.0 + uses: actions/upload-code-coverage@a72ab75b4dee0e479386fb9bf33c8dcf64b9c772 # v1.4.0 if: github.event_name != 'merge_group' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch)) with: file: ./reports/coverage/Cobertura.xml language: CSharp label: code-coverage/dotnet - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage path: reports/coverage @@ -68,9 +68,9 @@ jobs: ] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Restore dependencies @@ -79,7 +79,7 @@ jobs: run: dotnet publish ./src/kiota/kiota.csproj -c Release -p:PublishSingleFile=true -o ./${{ matrix.os }} -f net10.0 - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ matrix.os }} path: ./${{ matrix.os }} diff --git a/.github/workflows/idempotency-tests.yml b/.github/workflows/idempotency-tests.yml index 9a679c2879..84d06f5368 100644 --- a/.github/workflows/idempotency-tests.yml +++ b/.github/workflows/idempotency-tests.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Restore dependencies @@ -26,7 +26,7 @@ jobs: - name: Build run: dotnet publish ./src/kiota/kiota.csproj -c Release -p:PublishSingleFile=true -p:PublishReadyToRun=true -o ./publish -f net10.0 # -p:PublishTrimmed=true -p:PublishAot=true should be enabled to make test run faster, but there are still limitations - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: generator path: publish @@ -50,8 +50,8 @@ jobs: - "https://raw.githubusercontent.com/github/rest-api-description/refs/heads/main/descriptions/api.github.com/api.github.com.json" - "apisguru::apis.guru" steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: generator path: publish @@ -62,7 +62,7 @@ jobs: - id: replace_url run: ./it/get-description-artifact-key.ps1 -descriptionUrl ${{ matrix.description }} shell: pwsh - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: description-${{ steps.replace_url.outputs.ARTKEY }} # Output is either openapi.json or openapi.yml. Try to upload the one that is found. @@ -100,16 +100,16 @@ jobs: - "https://raw.githubusercontent.com/github/rest-api-description/refs/heads/main/descriptions/api.github.com/api.github.com.json" - "apisguru::apis.guru" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: replace_url run: ./it/get-description-artifact-key.ps1 -descriptionUrl ${{ matrix.description }} shell: pwsh - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 if: startsWith(matrix.description, './') != true with: name: description-${{ steps.replace_url.outputs.ARTKEY }} path: description - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: generator path: publish @@ -124,7 +124,7 @@ jobs: shell: pwsh run: ./it/compare-generation.ps1 -descriptionUrl "${{ steps.replace_url.outputs.DESCRIPTION_PATH }}" -descriptionKey ${{ matrix.description }} -language "${{ matrix.language }}" continue-on-error: ${{ steps.check-suppressed.outputs.IS_SUPPRESSED == 'true' }} - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: idempotency-${{ matrix.language }}-${{ steps.replace_url.outputs.ARTKEY }} @@ -134,7 +134,7 @@ jobs: runs-on: ubuntu-latest needs: idempotency steps: - - uses: jimschubert/delete-artifacts-action@v1 + - uses: jimschubert/delete-artifacts-action@a6a85fe6cc7f54a2abb2aff7440825d98b8eb6e4 # v1.0.3 with: artifact_name: "generator" min_bytes: "0" diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index 6736a44a63..8e6bcc4f4e 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Restore dependencies @@ -26,7 +26,7 @@ jobs: - name: Build run: dotnet publish ./src/kiota/kiota.csproj -c Release -p:PublishSingleFile=true -p:PublishReadyToRun=true -o ./publish -f net10.0 # -p:PublishTrimmed=true -p:PublishAot=true should be enabled to make test run faster, but there are still limitations - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: generator path: publish @@ -51,8 +51,8 @@ jobs: - "apisguru::apis.guru" - "https://github.com/microsoftgraph/msgraph-metadata/raw/refs/heads/master/openapi/beta/openapi.yaml" steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: generator path: publish @@ -63,7 +63,7 @@ jobs: - id: replace_url run: ./it/get-description-artifact-key.ps1 -descriptionUrl ${{ matrix.description }} shell: pwsh - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: description-${{ steps.replace_url.outputs.ARTKEY }} # Output is either openapi.json or openapi.yml. Try to upload the one that is found. @@ -108,23 +108,23 @@ jobs: - "https://github.com/microsoftgraph/msgraph-metadata/raw/refs/heads/master/openapi/beta/openapi.yaml" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: replace_url run: ./it/get-description-artifact-key.ps1 -descriptionUrl ${{ matrix.description }} shell: pwsh - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 if: startsWith(matrix.description, './') != true with: name: description-${{ steps.replace_url.outputs.ARTKEY }} path: description - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: generator path: publish - run: chmod a+x ./publish/kiota # Common dependency needed to run MockServer - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: "17" distribution: "temurin" @@ -132,39 +132,39 @@ jobs: - name: Setup .NET if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Setup Go if: matrix.language == 'go' - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "^1.25" - name: Setup Typescript if: matrix.language == 'typescript' - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x - name: Setup Ruby if: matrix.language == 'ruby' - uses: ruby/setup-ruby@v1.319.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: "3.3" bundler-cache: true - name: Setup PHP if: matrix.language == 'php' - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: "8.2" coverage: xdebug - name: Setup Python if: matrix.language == 'python' - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.14" - name: Setup Dart if: matrix.language == 'dart' - uses: dart-lang/setup-dart@v1 + uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: "stable" @@ -188,7 +188,7 @@ jobs: run: ./it/do-clean.ps1 -language ${{ matrix.language }} if: always() - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: generation-results-${{ matrix.language }}-${{ steps.replace_url.outputs.ARTKEY }} @@ -198,7 +198,7 @@ jobs: runs-on: ubuntu-latest needs: integration steps: - - uses: jimschubert/delete-artifacts-action@v1 + - uses: jimschubert/delete-artifacts-action@a6a85fe6cc7f54a2abb2aff7440825d98b8eb6e4 # v1.0.3 with: artifact_name: "generator" min_bytes: "0" diff --git a/.github/workflows/load-tests.yml b/.github/workflows/load-tests.yml index 651140a8f6..17a142a3e3 100644 --- a/.github/workflows/load-tests.yml +++ b/.github/workflows/load-tests.yml @@ -36,9 +36,9 @@ jobs: ] fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Compile the CLI in debug mode diff --git a/.github/workflows/project-auto-add.yml b/.github/workflows/project-auto-add.yml index b3984e44ae..268f88a74a 100644 --- a/.github/workflows/project-auto-add.yml +++ b/.github/workflows/project-auto-add.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Generate token id: generate_token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ secrets.GRAPHBOT_APP_ID }} private-key: ${{ secrets.GRAPHBOT_APP_PEM }} diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 49c0eb263e..730693bb3b 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -35,20 +35,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: "adopt" java-version: 17 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 10.0.x - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Cache SonarCloud packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar diff --git a/.github/workflows/surface-area-tests.yml b/.github/workflows/surface-area-tests.yml index a5ceda06b5..62ad71704a 100644 --- a/.github/workflows/surface-area-tests.yml +++ b/.github/workflows/surface-area-tests.yml @@ -26,16 +26,16 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Restore dependencies run: dotnet restore kiota.slnx - name: Build run: dotnet publish ./src/kiota/kiota.csproj -c Release -p:PublishSingleFile=true -p:PublishReadyToRun=true -o ./publish -f net10.0 - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: generator path: publish @@ -52,12 +52,12 @@ jobs: description: - "https://github.com/microsoftgraph/msgraph-metadata/raw/refs/heads/master/openapi/beta/openapi.yaml" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: generator path: publish @@ -103,7 +103,7 @@ jobs: - name: Upload patch file as artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: name: surface-area-patch-${{ matrix.language }} @@ -111,7 +111,7 @@ jobs: - name: Upload explanations file as artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: name: surface-area-explanations-${{ matrix.language }} @@ -122,7 +122,7 @@ jobs: needs: surface-diff if: always() steps: - - uses: jimschubert/delete-artifacts-action@v1 + - uses: jimschubert/delete-artifacts-action@a6a85fe6cc7f54a2abb2aff7440825d98b8eb6e4 # v1.0.3 with: artifact_name: "generator" min_bytes: "0"