Skip to content

Commit ab2f610

Browse files
igawigaw
committed
build: pin all GitHub Actions to SHA of latest release version
Replace mutable version tags (e.g. @v6) with the commit SHA of the latest release in each major version series, keeping the tag as a trailing comment for readability. This prevents a compromised or moved tag from silently changing what code executes in CI. While at it, replace the unmaintained mosteo-actions/docker-run action with a direct docker run command. Signed-off-by: Daniel Wagner <[email protected]>
1 parent 5a78231 commit ab2f610

11 files changed

Lines changed: 50 additions & 53 deletions

‎.github/workflows/build.yml‎

Lines changed: 20 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@ jobs:
1919
container:
2020
image: ghcr.io/linux-nvme/debian.python:latest
2121
steps:
22-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2323
- name: Mark repo as safe for git
2424
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
2525
- name: build
2626
run: |
2727
scripts/build.sh -b ${{ matrix.buildtype }} -c ${{ matrix.compiler }} -x
28-
- uses: actions/upload-artifact@v6
28+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
2929
name: upload logs
3030
if: failure()
3131
with:
@@ -42,13 +42,13 @@ jobs:
4242
container:
4343
image: ghcr.io/linux-nvme/debian.python:latest
4444
steps:
45-
- uses: actions/checkout@v6
45+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4646
- name: Mark repo as safe for git
4747
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
4848
- name: build
4949
run: |
5050
scripts/build.sh -b ${{ matrix.buildtype }} -c ${{ matrix.compiler }} -x libnvme
51-
- uses: actions/upload-artifact@v6
51+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
5252
name: upload logs
5353
if: failure()
5454
with:
@@ -65,27 +65,24 @@ jobs:
6565
- arch: s390x
6666
- arch: ppc64le
6767
steps:
68-
- uses: actions/checkout@v6
68+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6969
- name: enable foreign arch
70-
uses: docker/setup-qemu-action@v3
70+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
7171
- name: Login to GitHub Container Registry
72-
uses: docker/login-action@v3
72+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
7373
with:
7474
registry: ghcr.io
7575
username: ${{ github.actor }}
7676
password: ${{ secrets.GITHUB_TOKEN }}
7777
- name: compile and run unit tests
78-
uses: mosteo-actions/docker-run@v2
79-
with:
80-
image: ghcr.io/linux-nvme/ubuntu-cross-${{ matrix.arch }}:latest
81-
guest-dir: /build
82-
host-dir: ${{ github.workspace }}
83-
command: |
84-
git config --global --add safe.directory /build
85-
scripts/build.sh -b release -c gcc -t ${{ matrix.arch }} cross
86-
params: "--platform linux/amd64"
87-
pull-params: "--platform linux/amd64"
88-
- uses: actions/upload-artifact@v6
78+
run: |
79+
docker run --rm \
80+
--platform linux/amd64 \
81+
-v "${{ github.workspace }}:/build" \
82+
-w /build \
83+
ghcr.io/linux-nvme/ubuntu-cross-${{ matrix.arch }}:latest \
84+
sh -c "git config --global --add safe.directory /build && scripts/build.sh -b release -c gcc -t ${{ matrix.arch }} cross"
85+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
8986
name: upload logs
9087
if: failure()
9188
with:
@@ -100,13 +97,13 @@ jobs:
10097
image: ghcr.io/linux-nvme/debian:latest
10198
if: github.ref == 'refs/heads/master'
10299
steps:
103-
- uses: actions/checkout@v6
100+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
104101
- name: Mark repo as safe for git
105102
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
106103
- name: build
107104
run: |
108105
scripts/build.sh -b release -c gcc fallback
109-
- uses: actions/upload-artifact@v6
106+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
110107
if: failure()
111108
with:
112109
name: log files
@@ -119,7 +116,7 @@ jobs:
119116
container:
120117
image: ghcr.io/linux-nvme/debian:latest
121118
steps:
122-
- uses: actions/checkout@v6
119+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
123120
- name: Mark repo as safe for git
124121
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
125122
- name: build
@@ -132,7 +129,7 @@ jobs:
132129
container:
133130
image: ghcr.io/linux-nvme/debian:latest
134131
steps:
135-
- uses: actions/checkout@v6
132+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
136133
- name: Mark repo as safe for git
137134
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
138135
- name: build
@@ -145,7 +142,7 @@ jobs:
145142
container:
146143
image: ghcr.io/linux-nvme/debian:latest
147144
steps:
148-
- uses: actions/checkout@v6
145+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
149146
- name: Mark repo as safe for git
150147
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
151148
- name: build

‎.github/workflows/checkpatch.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ jobs:
77
steps:
88
- name: 'Calculate PR commits + 1'
99
run: echo "PR_FETCH_DEPTH=$(( ${{ github.event.pull_request.commits }} + 1 ))" >> $GITHUB_ENV
10-
- uses: actions/checkout@v6
10+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1111
with:
1212
ref: ${{ github.event.pull_request.head.sha }}
1313
fetch-depth: 0
1414
- name: Run checkpatch review
15-
uses: webispy/checkpatch-action@v9
15+
uses: webispy/checkpatch-action@58374fe5bb03358b23d3d6871e2ff290ce77fcd2 # v9

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939

4040
steps:
4141
- name: Checkout repository
42-
uses: actions/checkout@v6
42+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4343

4444
- name: Mark repo as safe for git
4545
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
@@ -52,13 +52,13 @@ jobs:
5252
# Initializes the CodeQL tools for scanning.
5353
- if: matrix.language == 'c-cpp'
5454
name: Initialize CodeQL C
55-
uses: github/codeql-action/init@v4
55+
uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
5656
with:
5757
languages: 'c-cpp'
5858

5959
- if: matrix.language == 'python'
6060
name: Initialize CodeQL Python
61-
uses: github/codeql-action/init@v4
61+
uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
6262
with:
6363
languages: 'python'
6464
config-file: ./.github/codeql/codeql-config.yml
@@ -69,6 +69,6 @@ jobs:
6969
ninja -C .build
7070
7171
- name: Perform CodeQL Analysis
72-
uses: github/codeql-action/analyze@v4
72+
uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
7373
with:
7474
category: "/language:${{matrix.language}}"

‎.github/workflows/coverage.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ jobs:
1414
container:
1515
image: ghcr.io/linux-nvme/debian.python:latest
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
- name: Mark repo as safe for git
1919
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
2020
- name: build
2121
run: |
2222
scripts/build.sh coverage
23-
- uses: codecov/codecov-action@v5
23+
- uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
2424
with:
2525
token: ${{ secrets.CODECOV_TOKEN }}
2626
fail_ci_if_error: false

‎.github/workflows/coverity.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
container:
2121
image: ghcr.io/linux-nvme/debian.python:latest
2222
steps:
23-
- uses: actions/checkout@v6
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2424
with:
2525
ref: ${{ github.event.inputs.ref || github.ref }}
2626
fetch-depth: 0
@@ -67,7 +67,7 @@ jobs:
6767
--form description="Automated Coverity Scan from ${{ github.event_name }}" \
6868
https://scan.coverity.com/builds?project=linux-nvme%2Fnvme-cli
6969
70-
- uses: actions/upload-artifact@v5
70+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
7171
name: upload coverity artifacts
7272
if: failure()
7373
with:

‎.github/workflows/docs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
container:
2121
image: ghcr.io/linux-nvme/debian:latest
2222
steps:
23-
- uses: actions/checkout@v6
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2424
- name: Mark repo as safe for git
2525
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
2626
- name: build

‎.github/workflows/libnvme-release-python.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
container:
2222
image: ghcr.io/linux-nvme/debian.python:latest
2323
steps:
24-
- uses: actions/checkout@v6
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525

2626
- name: Allow workspace
2727
run: |
@@ -35,7 +35,7 @@ jobs:
3535
run: |
3636
pipx run twine check dist/*.tar.gz
3737
38-
- uses: actions/upload-artifact@v6
38+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
3939
with:
4040
path: dist/*.tar.gz
4141
retention-days: 5
@@ -49,7 +49,7 @@ jobs:
4949
image: ghcr.io/linux-nvme/debian.python:latest
5050
steps:
5151
- name: Check out repository (with tags)
52-
uses: actions/checkout@v6
52+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5353
with:
5454
fetch-depth: 0 # Required for `git describe`
5555

@@ -93,7 +93,7 @@ jobs:
9393
run: |
9494
pipx run twine check dist/*.tar.gz
9595
96-
- uses: actions/upload-artifact@v6
96+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
9797
with:
9898
name: test_pypi
9999
path: dist/*.tar.gz
@@ -109,13 +109,13 @@ jobs:
109109
id-token: write
110110
if: github.repository == 'linux-nvme/nvme-cli'
111111
steps:
112-
- uses: actions/download-artifact@v7
112+
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
113113
with:
114114
name: test_pypi
115115
path: dist
116116

117117
- name: Publish package to TestPyPI
118-
uses: pypa/[email protected]
118+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
119119
with:
120120
repository-url: https://test.pypi.org/legacy/
121121

@@ -137,12 +137,12 @@ jobs:
137137
fi
138138
139139
- name: Download artifiact
140-
uses: actions/download-artifact@v7
140+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
141141
if: steps.check-tag.outputs.match == 'true'
142142
with:
143143
name: artifact
144144
path: dist
145145

146146
- name: Publish package to PyPI
147-
uses: pypa/[email protected]
147+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
148148
if: steps.check-tag.outputs.match == 'true'

‎.github/workflows/libnvme-release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ jobs:
1414
permissions:
1515
contents: write
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
- name: Mark repo as safe for git
1919
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
20-
- uses: ncipollo/release-action@v1
20+
- uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
2121
with:
2222
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ jobs:
1414
permissions:
1515
contents: write
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
- name: Mark repo as safe for git
1919
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
20-
- uses: ncipollo/release-action@v1
20+
- uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
2121
with:
2222
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/run-nightly-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
if: ${{ github.event_name == 'workflow_dispatch' || github.repository == 'linux-nvme/nvme-cli' }}
1212
runs-on: arc-vm-nvme-cli
1313
steps:
14-
- uses: actions/checkout@v6
14+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1515
with:
1616
repository: "linux-blktests/blktests-ci"
1717
#We don't have to build the kernel here, as we have a cron job running on

0 commit comments

Comments
 (0)