From d1a9fef5558c661f276fe49b0979ff3132e67252 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Fri, 26 Jun 2026 05:16:39 -0500 Subject: [PATCH 1/2] chore(renovate): adopt config:best-practices and pin GitHub Action digests Switches devsy's Renovate config to config:best-practices plus helpers:pinGitHubActionDigests so GitHub Actions are pinned to commit SHAs. Keeps the existing devsy-specific allowedVersions pins. --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index e8a9231a5..a79ee0ba4 100644 --- a/renovate.json +++ b/renovate.json @@ -3,7 +3,7 @@ "automerge": false, "automergeType": "pr", "automergeStrategy": "squash", - "extends": ["config:recommended"], + "extends": ["config:best-practices", "helpers:pinGitHubActionDigests"], "pre-commit": { "enabled": true }, From 54eaf3c71b532333fcf11023e95ddc91d17021eb Mon Sep 17 00:00:00 2001 From: Samuel K Date: Fri, 26 Jun 2026 05:39:33 -0500 Subject: [PATCH 2/2] ci: pin GitHub Actions to commit SHAs --- .github/workflows/act.yml | 30 ++++++++-------- .github/workflows/commit.yml | 6 ++-- .github/workflows/desktop-ci.yml | 22 ++++++------ .github/workflows/devcontainer.yml | 6 ++-- .github/workflows/labeler.yml | 2 +- .github/workflows/pr-ci.yml | 46 ++++++++++++------------- .github/workflows/release.yml | 44 +++++++++++------------ .github/workflows/workflow-approval.yml | 4 +-- 8 files changed, 80 insertions(+), 80 deletions(-) diff --git a/.github/workflows/act.yml b/.github/workflows/act.yml index ee4511102..72ccf5a15 100644 --- a/.github/workflows/act.yml +++ b/.github/workflows/act.yml @@ -13,15 +13,15 @@ jobs: name: E2E Tests runs-on: js-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: "24" - name: setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -29,7 +29,7 @@ jobs: run: go install github.com/go-task/task/v3/cmd/task@latest - name: install goreleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7 with: distribution: goreleaser version: "~> v2" @@ -43,7 +43,7 @@ jobs: - name: generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 with: app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }} private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }} @@ -67,10 +67,10 @@ jobs: name: Build User Interface runs-on: js-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: "22" @@ -90,14 +90,14 @@ jobs: name: Build Desktop App runs-on: js-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: "22" - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -106,7 +106,7 @@ jobs: GOOS=linux GOARCH=amd64 go build -o desktop/resources/bin/devsy . chmod +x desktop/resources/bin/devsy - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" @@ -133,7 +133,7 @@ jobs: GH_TOKEN: ${{ github.token }} - name: upload desktop linux artifact for flatpak - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: devsy-flatpak path: desktop/release/*.deb @@ -146,10 +146,10 @@ jobs: image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-48 options: --privileged steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: download desktop linux artifact - uses: actions/download-artifact@v5 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 with: name: devsy-flatpak path: desktop/flatpak/ @@ -165,7 +165,7 @@ jobs: exit 1 fi - - uses: flatpak/flatpak-github-actions/flatpak-builder@v6 + - uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # v6 with: bundle: Devsy.flatpak manifest-path: desktop/flatpak/sh.devsy.app.yml diff --git a/.github/workflows/commit.yml b/.github/workflows/commit.yml index 9f61310af..1d731e7db 100644 --- a/.github/workflows/commit.yml +++ b/.github/workflows/commit.yml @@ -11,8 +11,8 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: 1Password/check-signed-commits-action@v1 + - uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52 # v1 - - uses: wagoid/commitlint-github-action@v6 + - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6 diff --git a/.github/workflows/desktop-ci.yml b/.github/workflows/desktop-ci.yml index 5d4384f5d..64a6b1961 100644 --- a/.github/workflows/desktop-ci.yml +++ b/.github/workflows/desktop-ci.yml @@ -20,9 +20,9 @@ jobs: lint-and-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 cache: npm @@ -62,13 +62,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 cache: npm @@ -102,7 +102,7 @@ jobs: run: echo "GYP_MSVS_VERSION=2022" >> $env:GITHUB_ENV - name: Setup Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" @@ -139,7 +139,7 @@ jobs: CSC_IDENTITY_AUTO_DISCOVERY: "false" - name: Upload artifacts - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: desktop-${{ matrix.os }} path: | @@ -159,10 +159,10 @@ jobs: options: --privileged steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Download Linux .deb artifact - uses: actions/download-artifact@v5 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 with: name: desktop-ubuntu-latest path: desktop/flatpak/ @@ -179,14 +179,14 @@ jobs: fi - name: Build Flatpak - uses: flatpak/flatpak-github-actions/flatpak-builder@v6 + uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # v6 with: manifest-path: desktop/flatpak/sh.devsy.app.yml bundle: Devsy.flatpak cache-key: flatpak-builder-${{ github.sha }} - name: Upload Flatpak artifact - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: desktop-flatpak path: Devsy.flatpak diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml index 00e8abe6d..5ef27b612 100644 --- a/.github/workflows/devcontainer.yml +++ b/.github/workflows/devcontainer.yml @@ -29,12 +29,12 @@ jobs: name: Build and Run Devcontainer runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: "latest" - - uses: devcontainers/ci@v0.3 + - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3 with: runCmd: ${{ inputs.runCmd || env.DEFAULT_RUN_CMD }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index f70b54963..87f56c78c 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -14,7 +14,7 @@ jobs: issues: write runs-on: ubuntu-latest steps: - - uses: skevetter/pr-size-labeler@v1 + - uses: skevetter/pr-size-labeler@a5723b449a38e6fb620a8ab0fd3cba0ea9794e0b # v1 with: xs_label: "size/xs" xs_max_size: "10" diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index e571b600c..032b037a5 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -22,8 +22,8 @@ jobs: outputs: go: ${{ steps.filter.outputs.go }} steps: - - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3 id: filter with: filters: | @@ -41,23 +41,23 @@ jobs: name: Pre-commit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: j178/prek-action@v2 + - uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2 lint: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9 with: version: v2.12.2 only-new-issues: true @@ -89,9 +89,9 @@ jobs: - runner: windows-latest runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -105,7 +105,7 @@ jobs: fi echo "runner_os=$OS" >> "$GITHUB_OUTPUT" - - uses: goreleaser/goreleaser-action@v7 + - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7 with: distribution: goreleaser version: "~> v2" @@ -113,7 +113,7 @@ jobs: env: DEVSY_CLI_VERSION: v0.0.0 - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: devsy-${{ steps.os.outputs.runner_os }} path: dist/devsy-${{ steps.os.outputs.runner_os }}_*/devsy-${{ steps.os.outputs.runner_os }}-* @@ -124,9 +124,9 @@ jobs: if: needs.changes.outputs.go == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -161,10 +161,10 @@ jobs: runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -176,7 +176,7 @@ jobs: echo "runner_os=$OS" >> "$GITHUB_OUTPUT" - name: download CLI artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: devsy-${{ steps.os.outputs.runner_os }} path: ${{ runner.temp }}/devsy-bin/ @@ -415,15 +415,15 @@ jobs: runs-on: ${{ matrix.runner }} steps: - - uses: jlumbroso/free-disk-space@v1.3.1 + - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 if: matrix.free-disk-space == true && runner.os == 'Linux' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 if: matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true' - name: setup Go if: matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true' - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -444,7 +444,7 @@ jobs: - name: download CLI artifacts if: matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: devsy-${{ steps.os.outputs.runner_os }} path: ${{ runner.temp }}/devsy-bin/ @@ -452,7 +452,7 @@ jobs: - name: download Linux CLI artifacts for Windows if: runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: devsy-linux path: ${{ runner.temp }}/devsy-bin/ @@ -543,7 +543,7 @@ jobs: # NOTE: skevetter/setup-kind does not work on Windows runners - name: setup kind if: matrix.install-kind == true && runner.os != 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') - uses: skevetter/setup-kind@v1 + uses: skevetter/setup-kind@7febac2ed35df332069b3bb687c6b1fa00fc0883 # v1 with: name: ${{ steps.uuid.outputs.result }} version: v0.24.0 @@ -577,7 +577,7 @@ jobs: - name: generate GitHub App token if: matrix.requires-secret == true && needs.can-read-secret.outputs.secret-set == 'true' id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 with: app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }} private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d066b3f44..0ca4f16e4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,9 +20,9 @@ jobs: - runner: windows-latest runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -36,7 +36,7 @@ jobs: fi echo "runner_os=$OS" >> "$GITHUB_OUTPUT" - - uses: goreleaser/goreleaser-action@v7 + - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7 with: distribution: goreleaser version: "~> v2" @@ -45,7 +45,7 @@ jobs: DEVSY_CLI_VERSION: ${{ inputs.tag || github.ref_name }} DEVSY_POSTHOG_API_KEY: ${{ secrets.DEVSY_POSTHOG_API_KEY }} - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: devsy-${{ steps.os.outputs.runner_os }} path: dist/devsy-${{ steps.os.outputs.runner_os }}_*/devsy-${{ steps.os.outputs.runner_os }}-* @@ -81,15 +81,15 @@ jobs: builder-args: --win runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 cache: npm cache-dependency-path: desktop/package-lock.json - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod @@ -104,7 +104,7 @@ jobs: echo "runner_os=$OS" >> "$GITHUB_OUTPUT" - name: download CLI artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: devsy-* path: ${{ runner.temp }}/devsy-bin/ @@ -145,7 +145,7 @@ jobs: $vsPath = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath echo "GYP_MSVS_OVERRIDE_PATH=$vsPath" >> $env:GITHUB_ENV - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" @@ -220,7 +220,7 @@ jobs: --goos "$MATRIX_GO_OS" --goarch "$MATRIX_GO_ARCH" - name: upload desktop artifacts to release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ inputs.tag || github.ref_name }} draft: true @@ -243,7 +243,7 @@ jobs: go run hack/rewrite_manifest_urls/main.go desktop/release/ "$REPO" "$TAG" - name: upload update metadata artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: update-metadata-${{ matrix.name }} path: | @@ -252,7 +252,7 @@ jobs: if-no-files-found: ignore - name: upload cli assets - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 if: matrix.name == 'linux-x64' with: tag_name: ${{ inputs.tag || github.ref_name }} @@ -262,7 +262,7 @@ jobs: - name: upload desktop linux artifact for flatpak if: matrix.name == 'linux-x64' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: devsy-flatpak path: desktop/release/*.deb @@ -274,16 +274,16 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod - name: download update metadata artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: update-metadata-* path: metadata/ @@ -309,7 +309,7 @@ jobs: find metadata/ -name 'beta.yml' -exec cp {} publish-dir/desktop/ \; - name: deploy to Netlify (dl.devsy.sh) - uses: nwtgck/actions-netlify@v3 + uses: nwtgck/actions-netlify@4cbaf4c08f1a7bfa537d6113472ef4424e4eb654 # v3 with: publish-dir: ./publish-dir production-deploy: true @@ -327,10 +327,10 @@ jobs: image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-48 options: --privileged steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: download desktop linux artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: devsy-flatpak path: desktop/flatpak/ @@ -347,7 +347,7 @@ jobs: fi - name: build flatpak - uses: flatpak/flatpak-github-actions/flatpak-builder@v6 + uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # v6 with: bundle: Devsy.flatpak manifest-path: desktop/flatpak/sh.devsy.app.yml @@ -355,7 +355,7 @@ jobs: upload-artifact: true - name: upload flatpak bundle - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ inputs.tag || github.ref_name }} draft: true @@ -370,7 +370,7 @@ jobs: if: github.event.release.prerelease runs-on: ubuntu-latest steps: - - uses: softprops/action-gh-release@v3 + - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: ${{ inputs.tag || github.ref_name }} prerelease: true diff --git a/.github/workflows/workflow-approval.yml b/.github/workflows/workflow-approval.yml index f2b2f9d18..ed2046393 100644 --- a/.github/workflows/workflow-approval.yml +++ b/.github/workflows/workflow-approval.yml @@ -10,13 +10,13 @@ jobs: name: Approve Workflows runs-on: ubuntu-latest steps: - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 id: app-token with: app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }} private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }} - - uses: skevetter/automatic-approve-action@v2 + - uses: skevetter/automatic-approve-action@80f16f6e6bea1dfc0f613df222390ee143a4d8e9 # v2 with: token: ${{ steps.app-token.outputs.token }} workflows: "commit.yml,lint.yml,pr-ci.yml,pre-commit.yml,release-please.yml,promote-release.yml"