ci: pin GitHub Actions to full-length commit SHAs - #57
Merged
Conversation
The repository now only permits official/verified actions and requires
every action to be pinned to a full-length commit SHA. All 16 `uses:`
entries referenced floating tags, so both workflows were being rejected.
- Pin every action to its release commit SHA, with a trailing version
comment so the intended version stays readable:
actions/checkout v3 -> v7.0.1 (3d3c42e)
actions/setup-java v3 -> v5.6.0 (03ad4de)
actions/cache v3 -> v6.1.0 (55cc834)
actions/upload-artifact v4 -> v7.0.1 (043fb46)
codecov/codecov-action v3 -> v7.0.0 (fb8b358)
- Rename the Codecov `file` input to `files`; `file` was removed in v4.
- Add `permissions: contents: read` to both workflows so jobs stop
running with the default write-capable token.
- Add `persist-credentials: false` to checkout so the token is not left
behind in .git/config. Nothing in either workflow pushes.
- Add the github-actions ecosystem to Dependabot, grouped and weekly, so
the new pins get bumped instead of silently rotting.
Job graphs, step order and Maven commands are unchanged.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
🤖 ThrillhouseBot PR SummaryWhat this PR doesThis change pins every GitHub Action in both CI workflows to a full-length commit SHA, adds top-level read-only repository permissions, sets persist-credentials to false on all checkout steps, renames the Codecov file input to files, and introduces a Dependabot configuration for the github-actions ecosystem with weekly grouping to keep the pins fresh. Changes Overview
Changed Files
Risk Assessment
No new issues found in this PR, but the review cannot be approved until CI is confirmed green.
|
| Check | Type | Status | Detail |
|---|---|---|---|
| validate | check-run | ⏳ Pending | - |
| Test and Analysis | check-run | ⏳ Pending | - |
Automated review by ThrillhouseBot. Reply with /review to re-run.
thrillhousebot
Bot
added
the
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repository now only permits official/verified actions and requires every action to be pinned to a full-length commit SHA. All 16
uses:entries referenced floating tags, so both workflows were being rejected.actions/checkout v3 -> v7.0.1 (3d3c42e)
actions/setup-java v3 -> v5.6.0 (03ad4de)
actions/cache v3 -> v6.1.0 (55cc834)
actions/upload-artifact v4 -> v7.0.1 (043fb46)
codecov/codecov-action v3 -> v7.0.0 (fb8b358)
fileinput tofiles;filewas removed in v4.permissions: contents: readto both workflows so jobs stoprunning with the default write-capable token.
persist-credentials: falseto checkout so the token is not leftbehind in .git/config. Nothing in either workflow pushes.
the new pins get bumped instead of silently rotting.
Job graphs, step order and Maven commands are unchanged.