update workflows - Pinning GitHub Actions

yarafie · Feb 14, 2025 · 5033ee2 · 5033ee2
1 parent 16228e3
commit 5033ee2
Show file tree

Hide file tree

Showing 7 changed files with 93 additions and 47 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -12,14 +12,17 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Setup Node.JS
-        uses: actions/setup-node@v4
+        # uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: '22'
       - name: Cache node modules
-        uses: actions/[email protected]
-        env:
+        # uses: actions/[email protected]
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
+      env:
           cache-name: cache-node-modules
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
@@ -33,7 +36,8 @@ jobs:
         run: cd website && npm ci
       - id: yamllint
         name: Yamllint
-        uses: reviewdog/action-yamllint@v1
+        # uses: reviewdog/action-yamllint@v1
+        uses: reviewdog/action-yamllint@3f44a3c4def1e6fbbae499295b94cb6b596ce677
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-check
@@ -43,7 +47,8 @@ jobs:
       - if: always()
         id: eslint
         name: ESLint
-        uses: reviewdog/[email protected]
+        # uses: reviewdog/[email protected]
+        uses: reviewdog/action-eslint@9b5b0150e399e1f007ee3c27bc156549810a64e3
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-check
@@ -58,13 +63,16 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Setup Node.JS
-        uses: actions/setup-node@v4
+        # uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: '22'
       - name: Cache node modules
-        uses: actions/[email protected]
+        # uses: actions/[email protected]
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
         env:
           cache-name: cache-node-modules
         with:
@@ -79,7 +87,8 @@ jobs:
         run: npm ci
       - id: prettier
         name: Prettier
-        uses: creyD/[email protected]
+        # uses: creyD/[email protected]
+        uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1
         with:
           dry: true
           prettier_options: --write .
@@ -95,15 +104,18 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           ref: ${{ github.head_ref }}
       - name: Setup Node.JS
-        uses: actions/setup-node@v4
+        # uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: '22'
       - name: Cache node modules
-        uses: actions/[email protected]
+        # uses: actions/[email protected]
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
         env:
           cache-name: cache-node-modules
         with:
@@ -123,7 +135,8 @@ jobs:
       - name: Create .nojekyll file
         run: touch website/build/.nojekyll
       - name: Deploy to GitHub Pages
-        uses: s0/[email protected]
+        # uses: s0/[email protected]
+        uses: s0/git-publish-subdir-action@92faf786f11dfa44fc366ac3eb274d193ca1af7e
         env:
           REPO: self
           BRANCH: gh-pages

diff --git a/.github/workflows/ci_pr.yml b/.github/workflows/ci_pr.yml
@@ -11,13 +11,16 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Setup Node.JS
-        uses: actions/setup-node@v4
+        # uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: '22'
       - name: Cache node modules
-        uses: actions/[email protected]
+        # uses: actions/[email protected]
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
         env:
           cache-name: cache-node-modules
         with:
@@ -32,7 +35,8 @@ jobs:
         run: cd website && npm ci
       - id: yamllint
         name: Yamllint
-        uses: reviewdog/action-yamllint@v1
+        # uses: reviewdog/action-yamllint@v1
+        uses: reviewdog/action-yamllint@3f44a3c4def1e6fbbae499295b94cb6b596ce677
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-check
@@ -42,7 +46,8 @@ jobs:
         continue-on-error: true
       - id: eslint
         name: ESLint
-        uses: reviewdog/[email protected]
+        # uses: reviewdog/[email protected]
+        uses: reviewdog/action-eslint@9b5b0150e399e1f007ee3c27bc156549810a64e3
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-check
@@ -55,7 +60,8 @@ jobs:
         run: mkdir -p lint && echo "yamllint" >> lint/results.txt
       - if: ${{ steps.eslint.outcome == 'failure' }}
         run: mkdir -p lint && echo "eslint" >> lint/results.txt
-      - uses: actions/upload-artifact@v4
+      # - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: lint
           path: lint/results.txt
@@ -71,13 +77,16 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Setup Node.JS
-        uses: actions/setup-node@v4
+        # uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: '22'
       - name: Cache node modules
-        uses: actions/[email protected]
+        # uses: actions/[email protected]
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
         env:
           cache-name: cache-node-modules
         with:
@@ -94,7 +103,8 @@ jobs:
         run: cd website && npm ci
       - id: prettier
         name: Prettier Check
-        uses: creyD/[email protected]
+        # uses: creyD/[email protected]
+        uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1
         with:
           dry: true
           prettier_options: --write .
@@ -104,7 +114,8 @@ jobs:
       - if: ${{ always() && steps.prettier.outcome == 'failure' }}
         run: mkdir -p format-lint && echo "prettier" >> format-lint/results.txt
       - if: ${{ always() && steps.prettier.outcome == 'failure' }}
-        uses: actions/upload-artifact@v4
+        # uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: format-lint
           path: format-lint/results.txt
@@ -116,13 +127,16 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Setup Node.JS
-        uses: actions/setup-node@v4
+        # uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: '22'
       - name: Cache node modules
-        uses: actions/[email protected]
+        # uses: actions/[email protected]
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
         env:
           cache-name: cache-node-modules
         with:
@@ -146,8 +160,10 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+        # uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      # - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd
         id: changes
         with:
           list-files: json
@@ -165,13 +181,15 @@ jobs:
       - env:
           PR_NUM: ${{ github.event.number }}
         run: echo $PR_NUM > pr_num.txt
-      - uses: actions/upload-artifact@v4
+      # - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: changes
           path: blueprints.txt
           retention-days: 5
           if-no-files-found: ignore
-      - uses: actions/upload-artifact@v4
+      # - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: changes
           path: pr_num.txt

diff --git a/.github/workflows/label_management.yml b/.github/workflows/label_management.yml
@@ -23,8 +23,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'issue_comment' && github.actor != 'github-actions[bot]' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions-ecosystem/action-remove-labels@v1
+      # - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      # - uses: actions-ecosystem/action-remove-labels@v1
+      - uses: actions-ecosystem/action-remove-labels@556e306654eb4c343ecaff657772edaa3f1add86
         if: ${{ contains(github.event.issue.labels.*.name, 'status - waiting for feedback') }}
         with:
           labels: 'status - waiting for feedback'
@@ -34,8 +36,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'issues' || github.event_name == 'pull_request' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions-ecosystem/action-remove-labels@v1
+      # - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      # - uses: actions-ecosystem/action-remove-labels@v1
+      - uses: actions-ecosystem/action-remove-labels@556e306654eb4c343ecaff657772edaa3f1add86
         if: ${{ github.event_name == 'issues' && contains(github.event.issue.labels.*.name, 'status - waiting for feedback') || github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'status - waiting for feedback') }}
         with:
           labels: 'status - waiting for feedback'
diff --git a/.github/workflows/pr_commenter.yml b/.github/workflows/pr_commenter.yml
@@ -21,7 +21,8 @@ jobs:
           fi
         env:
           TYPE: ${{ github.event.action }}
-      - uses: hasura/comment-progress@v2
+      # - uses: hasura/comment-progress@v2
+      - uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}

diff --git a/.github/workflows/pr_commenter_result.yml b/.github/workflows/pr_commenter_result.yml
@@ -14,15 +14,17 @@ jobs:
     if: ${{ github.actor != 'dependabot[bot]' && github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download changes analysis
-        uses: dawidd6/action-download-artifact@v8
+        # uses: dawidd6/action-download-artifact@v8
+        uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
           workflow: ci_pr.yml
           name: changes
           path: changes
       - id: pr_info
         run: echo "::set-output name=num::$(cat changes/pr_num.txt)"
-      - uses: hasura/comment-progress@v2
+      # - uses: hasura/comment-progress@v2
+      - uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
@@ -42,7 +44,8 @@ jobs:
           urls=$(printf '%s' "$myblueprints" | jq --raw-input --slurp '.')
           echo "::set-output name=urls::$urls"
       - if: ${{ hashFiles('changes/blueprints.txt') != '' }}
-        uses: hasura/comment-progress@v2
+        # uses: hasura/comment-progress@v2
+        uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
@@ -62,15 +65,17 @@ jobs:
     if: ${{ github.actor != 'dependabot[bot]' && github.event.workflow_run.conclusion == 'failure' }}
     steps:
       - name: Download failure reports
-        uses: dawidd6/action-download-artifact@v8
+        # uses: dawidd6/action-download-artifact@v8
+        uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
           workflow: ci_pr.yml
           workflow_conclusion: failure
       - id: pr_info
         run: echo "::set-output name=num::$(cat changes/pr_num.txt)"
       - name: Create comment to report failure
-        uses: hasura/comment-progress@v2
+        # uses: hasura/comment-progress@v2
+        uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
@@ -84,7 +89,8 @@ jobs:
       # if the artifact exists, linters failed
       - if: ${{ hashFiles('lint/results.txt') != '' }}
         name: Report linters failure
-        uses: hasura/comment-progress@v2
+        # uses: hasura/comment-progress@v2
+        uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
@@ -96,7 +102,8 @@ jobs:
       # if the artifact exists, formatters failed
       - if: ${{ hashFiles('format-lint/results.txt') != '' }}
         name: Report formatters failure
-        uses: hasura/comment-progress@v2
+        # uses: hasura/comment-progress@v2
+        uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
@@ -106,7 +113,8 @@ jobs:
           message: |
             * Your files are not properly formatted. Did you remember to run `npm run format` before submitting your changes?
       - name: Create comment to report failure
-        uses: hasura/comment-progress@v2
+        # uses: hasura/comment-progress@v2
+        uses: hasura/comment-progress@0c4393d5f4d4de95d11b5129506ab87190e892f9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -17,7 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 90 days stale policy for issues & PRs
-        uses: actions/stale@v9
+        # uses: actions/stale@v9
+        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 90

diff --git a/.github/workflows/thread_locker.yml b/.github/workflows/thread_locker.yml
@@ -19,7 +19,8 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5
+      # - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@d42e5f49803f3c4e14ffee0378e31481265dda22
         with:
           # 30 days of inactivity both for closed issues and PRs
           issue-inactive-days: 30