From cd78329c3fd8b2f427a095dd48e96b65c06d0260 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 19 May 2026 12:11:18 -0700 Subject: [PATCH] ci: pin all github actions Some were already pinned; let's fix the rest. Signed-off-by: Kir Kolyshkin --- .github/workflows/check_cirrus_cron.yml | 4 ++-- .github/workflows/dev-bump.yml | 4 ++-- .../first_contrib_cert_generator.yml | 4 ++-- .github/workflows/issue-labeler.yml | 2 +- .github/workflows/issue_pr_lock.yml | 2 +- .github/workflows/labeler.yml | 2 +- .github/workflows/machine-os-pr.yml | 2 +- .github/workflows/release.yml | 24 +++++++++---------- .github/workflows/stale.yml | 2 +- .github/workflows/update-podmanio.yml | 2 +- 10 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/check_cirrus_cron.yml b/.github/workflows/check_cirrus_cron.yml index bf04f70abc..15bf140b73 100644 --- a/.github/workflows/check_cirrus_cron.yml +++ b/.github/workflows/check_cirrus_cron.yml @@ -44,7 +44,7 @@ jobs: runs-on: ubuntu-latest steps: # This is where the scripts live - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: containers/podman ref: 'main' @@ -73,7 +73,7 @@ jobs: body: file://./artifacts/email_body.txt - if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ github.job }}_artifacts path: artifacts/* diff --git a/.github/workflows/dev-bump.yml b/.github/workflows/dev-bump.yml index 81e93ffb4c..7fa25c62de 100644 --- a/.github/workflows/dev-bump.yml +++ b/.github/workflows/dev-bump.yml @@ -14,7 +14,7 @@ jobs: contents: write # to create and push to a branch pull-requests: write # to read and create pull requests steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.ref_name }} token: ${{ secrets.PODMANBOT_TOKEN }} @@ -92,7 +92,7 @@ jobs: env: GH_TOKEN: ${{ github.token }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: main token: ${{ secrets.PODMANBOT_TOKEN }} diff --git a/.github/workflows/first_contrib_cert_generator.yml b/.github/workflows/first_contrib_cert_generator.yml index ffe6d0e04f..c39d1fc2b8 100644 --- a/.github/workflows/first_contrib_cert_generator.yml +++ b/.github/workflows/first_contrib_cert_generator.yml @@ -56,7 +56,7 @@ jobs: # Step 2: Checkout the repository containing the certificate HTML file. - name: Checkout containers/automation repository if: ${{ github.event_name == 'workflow_dispatch' || steps.check_first_pr.outputs.is_first_pr == 'true' }} - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: containers/automation path: automation-repo @@ -79,7 +79,7 @@ jobs: # Step 4: Setup Node.js environment - name: Setup Node.js if: ${{ github.event_name == 'workflow_dispatch' || steps.check_first_pr.outputs.is_first_pr == 'true' }} - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: latest diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml index 13fc8545f1..12f2a59576 100644 --- a/.github/workflows/issue-labeler.yml +++ b/.github/workflows/issue-labeler.yml @@ -13,7 +13,7 @@ jobs: issues: write # for github/issue-labeler to create or remove labels runs-on: ubuntu-latest steps: - - uses: github/issue-labeler@v3.4 + - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" configuration-path: .github/issue-labeler.yml diff --git a/.github/workflows/issue_pr_lock.yml b/.github/workflows/issue_pr_lock.yml index c97db1e3ce..303eb48a07 100644 --- a/.github/workflows/issue_pr_lock.yml +++ b/.github/workflows/issue_pr_lock.yml @@ -54,7 +54,7 @@ jobs: # Ref: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow - name: Obtain Stale Locking App token id: generate-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: # N/B: These are both defined at the containers-org level app-id: ${{ vars.STALE_LOCKING_APP_ID }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 91fadab656..8d3f141f30 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -12,6 +12,6 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/labeler@v6 + - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/machine-os-pr.yml b/.github/workflows/machine-os-pr.yml index 3f3417adc9..ee389e736f 100644 --- a/.github/workflows/machine-os-pr.yml +++ b/.github/workflows/machine-os-pr.yml @@ -68,7 +68,7 @@ jobs: run: | pip3 install git+https://github.com/packit/wait-for-copr.git@main - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 if: steps.getversion.outputs.update == 'true' id: checkout with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f6038915e8..20a6d7a42b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -73,12 +73,12 @@ jobs: needs: check steps: - name: Checkout Version - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{needs.check.outputs.version}} persist-credentials: false - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: stable cache: false @@ -89,7 +89,7 @@ jobs: run: | make release-artifacts - name: Upload to Actions as artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-artifacts path: release/* @@ -112,12 +112,12 @@ jobs: KEYCHAIN_PWD: ${{ secrets.MACOS_CI_KEYCHAIN_PWD }} steps: - name: Checkout Version - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{needs.check.outputs.version}} persist-credentials: false - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: stable cache: false @@ -139,7 +139,7 @@ jobs: run: | make ARCH=aarch64 notarize &> /dev/null - name: Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: mac-installers path: | @@ -166,16 +166,16 @@ jobs: } Write-Output "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append - name: Checkout Podman - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Download Windows zip artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: release-artifacts path: ${{ github.workspace }}\release-artifacts - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: stable cache: false @@ -230,7 +230,7 @@ jobs: Copy-Item -Path "podman-${env:VERSION}.msi" -Destination "podman-installer-windows-${env:PODMAN_ARCH}.msi" Pop-Location - name: Upload the MSI - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: win-msi-${{ matrix.arch }} path: | @@ -247,7 +247,7 @@ jobs: VERSION: ${{needs.check.outputs.version}} steps: - name: Checkout Version - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{needs.check.outputs.version}} persist-credentials: false @@ -267,7 +267,7 @@ jobs: - name: Display release notes run: cat $VERSION-release-notes.md - name: Download all artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Show artifacts run: | mv win-installer/* release-artifacts diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index d6be9c4b21..c297392941 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: 'A friendly reminder that this issue had no activity for 30 days.' diff --git a/.github/workflows/update-podmanio.yml b/.github/workflows/update-podmanio.yml index d03a7114a3..a93fb86fcb 100644 --- a/.github/workflows/update-podmanio.yml +++ b/.github/workflows/update-podmanio.yml @@ -73,7 +73,7 @@ jobs: echo "prexists=false" >> "$GITHUB_OUTPUT" fi - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 if: >- steps.getversion.outputs.notRC == 'true' && steps.checkpr.outputs.prexists == 'false'