ci: hardening security of Github actions (#69)

mato533 · web-flow · commit cf4115bf95aa · 2025-06-23T00:39:55.000+09:00
## Proposed changes This pull request enhances the security of our GitHub Actions workflows by implementing several best practices: - Pinning Actions to Commit SHAs: All external GitHub Actions are now pinned to specific commit SHAs instead of floating versions (e.g., @v4). This prevents unexpected or malicious code from being executed if a version tag is updated. - Updated Actions: All actions have been updated to their latest stable versions to include the latest features and security fixes. - Workflow Cleanup: Minor linter issues have been resolved. ## Types of changes [//]: # 'What types of changes does your code introduce to WebdriverIO?' [//]: # '_Put an `x` in the boxes that apply_' - [ ] Polish (an improvement for an existing feature) - [ ] Bugfix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Documentation update (improvements to the project's docs) - [X] Internal updates (everything related to internal scripts, governance documentation and CI files) ## Checklist [//]: # "_Put an `x` in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code._" - [X] I have read the [CONTRIBUTING](https://github.com/webdriverio/vscode-webdriverio/blob/main/CONTRIBUTING.md) doc - [ ] I have added tests that prove my fix is effective or that my feature works - [ ] I have added the necessary documentation (if appropriate) - [ ] I have added proper type definitions for new commands (if appropriate) ## Further comments [//]: # 'If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...' ### Reviewers: @webdriverio/project-committers
diff --git a/.github/actions/cache-vscode/action.yml b/.github/actions/cache-vscode/action.yml
@@ -13,7 +13,7 @@ runs:
 
     - name: 🗃️ Use cached vscode
       if: ${{ steps.generate-key.outputs.vscode-cache-key != '' }}
-      uses: actions/cache@v4.2.3
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ inputs.path }}
         key: ${{ steps.generate-key.outputs.vscode-cache-key }}
diff --git a/.github/actions/download-archive/action.yml b/.github/actions/download-archive/action.yml
@@ -11,7 +11,7 @@ runs:
   using: 'composite'
   steps:
     - name: ⬇️ Download Build Archive
-      uses: actions/download-artifact@v4.3.0
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}
diff --git a/.github/actions/set-screen-resolution/action.yml b/.github/actions/set-screen-resolution/action.yml
@@ -37,5 +37,7 @@ runs:
       if: runner.os == 'macOS'
       shell: bash
       run: |
+        echo "::group::brew install displayplacer"
         brew install displayplacer
+        echo "::endgroup::"
         displayplacer list
diff --git a/.github/actions/setup-workspace/action.yml b/.github/actions/setup-workspace/action.yml
@@ -9,12 +9,12 @@ runs:
   using: composite
   steps:
     - name: 🧰 Setup PNPM
-      uses: pnpm/action-setup@v4.1.0
+      uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       with:
         run_install: false
 
     - name: 🛠️ Setup Node.js ${{ inputs.node-version }}
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'pnpm'
diff --git a/.github/actions/upload-archive/action.yml b/.github/actions/upload-archive/action.yml
@@ -21,7 +21,7 @@ runs:
       if: ${{ runner.os == 'Windows' }}
 
     - name: ⬆️ Upload Archive
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.output }}
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
@@ -19,12 +19,12 @@ jobs:
     runs-on: ${{ inputs.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: '20'
 
@@ -34,7 +34,7 @@ jobs:
 
       - name: ⬆️ Upload Build Artifacts
         if: ${{ runner.os == 'Linux' }}
-        uses: ./.github/workflows/actions/upload-archive
+        uses: ./.github/actions/upload-archive
         with:
           name: vscode-webdriverio
           output: vscode-webdriverio-build.zip
diff --git a/.github/workflows/ci-e2e.yml b/.github/workflows/ci-e2e.yml
@@ -26,46 +26,46 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
           filename: vscode-webdriverio-build.zip
 
       - name: 🗃️ Use cached vscode
-        uses: ./.github/workflows/actions/cache-vscode
+        uses: ./.github/actions/cache-vscode
         with:
           path: e2e/.wdio-vscode-service
 
       - name: 🖥️ Set screen resolution
-        uses: ./.github/workflows/actions/set-screen-resolution
+        uses: ./.github/actions/set-screen-resolution
 
       - name: 🧪 Run the e2e test
         env:
           E2E_SCENARIO: ${{ matrix.scenario }}
-        run: pnpm --filter @vscode-wdio/e2e run test:e2e:${E2E_SCENARIO}
+        run: pnpm --filter @vscode-wdio/e2e run "test:e2e:${E2E_SCENARIO}"
         shell: bash
 
       - name: 📦 Upload Test Logs on Failure
-        uses: ./.github/workflows/actions/upload-archive
+        uses: ./.github/actions/upload-archive
         if: failure()
         with:
           name: ${{ inputs.compatibility-mode == 'yes' && 'compatibility' || 'e2e' }}-${{ matrix.scenario }}-logs-${{ matrix.os }}
           output: ${{ inputs.compatibility-mode == 'yes' && 'compatibility' || 'e2e' }}-${{ matrix.scenario }}-logs-${{ matrix.os }}.zip
           paths: e2e/logs
 
       - name: 🐛 Debug Build
-        uses: stateful/vscode-server-action@v1.1.0
+        uses: stateful/vscode-server-action@ec99599aefe0bf96d14491e1d5f7e80d30e22247 # v1.1.0
         if: failure()
         with:
           timeout: '180000'
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
@@ -14,12 +14,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: '20'
 
diff --git a/.github/workflows/ci-smoke.yml b/.github/workflows/ci-smoke.yml
@@ -23,46 +23,46 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
           filename: vscode-webdriverio-build.zip
 
       - name: 🗃️ Use cached vscode
-        uses: ./.github/workflows/actions/cache-vscode
+        uses: ./.github/actions/cache-vscode
         with:
           path: e2e/.wdio-vscode-service
 
       - name: 🖥️ Set screen resolution
-        uses: ./.github/workflows/actions/set-screen-resolution
+        uses: ./.github/actions/set-screen-resolution
 
       - name: 🚂 Run the smoke test
         env:
           E2E_SCENARIO: ${{ inputs.scenario }}
-        run: pnpm --filter @vscode-wdio/e2e run test:smoke:${E2E_SCENARIO}
+        run: pnpm --filter @vscode-wdio/e2e run "test:smoke:${E2E_SCENARIO}"
         shell: bash
 
       - name: 📦 Upload Test Logs on Failure
-        uses: ./.github/workflows/actions/upload-archive
+        uses: ./.github/actions/upload-archive
         if: failure()
         with:
           name: smoke-${{ inputs.scenario }}--logs-${{ matrix.os }}
           output: smoke-${{ inputs.scenario }}-logs-${{ matrix.os }}.zip
           paths: e2e/logs
 
       - name: 🐛 Debug Build
-        uses: stateful/vscode-server-action@v1.1.0
+        uses: stateful/vscode-server-action@ec99599aefe0bf96d14491e1d5f7e80d30e22247 # v1.1.0
         if: failure()
         with:
           timeout: '180000'
diff --git a/.github/workflows/ci-typecheck.yml b/.github/workflows/ci-typecheck.yml
@@ -19,17 +19,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
diff --git a/.github/workflows/ci-unit.yml b/.github/workflows/ci-unit.yml
@@ -19,17 +19,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
@@ -40,7 +40,7 @@ jobs:
         shell: bash
 
       - name: 🐛 Debug Build
-        uses: stateful/vscode-server-action@v1.1.0
+        uses: stateful/vscode-server-action@ec99599aefe0bf96d14491e1d5f7e80d30e22247 # v1.1.0
         if: failure()
         with:
           timeout: '180000'
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Auto Label Based on Checklist
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { owner, repo, number } = context.issue;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -54,21 +54,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 👷 Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: 'main'
           fetch-depth: 0
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: '20'
 
       - name: 🪄 Generate Prerelease patch version number
         id: gen-pre-release-ver
         env:
           RELEASE_TYPE: ${{ github.event.inputs.releaseType }}
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           result-encoding: string
           script: |
@@ -112,6 +112,12 @@ jobs:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
           VSCODE_WDIO_DRY_RUN: ${{ github.event.inputs.dryRun }}
 
+      - name: ✅ Push to remote repository
+        env:
+          DRY_RUN_ARGS: ${{ github.event.inputs.dryRun == 'yes' && '--dry-run' || '' }}
+        run: |
+          git push origin --no-verify --follow-tags "${DRY_RUN_ARGS}"
+
       - name: 📝 Create the Github Release
         run: |
           pnpm --filter @vscode-wdio/release run release-note
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
@@ -20,15 +20,15 @@ jobs:
     steps:
       - name: Fetch PR metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.4.0
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Wait for PR CI
         # Don't merge updates to GitHub Actions versions automatically.
         # (Some repos may wish to limit by version range (major/minor/patch), or scope (dep vs dev-dep), too.)
         if: contains(steps.metadata.outputs.package-ecosystem, 'npm')
-        uses: lewagon/wait-on-check-action@v1.3.4
+        uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc # v1.3.4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/infra/release/package.json b/infra/release/package.json
@@ -5,7 +5,6 @@
   "scripts": {
     "cache-key": "tsx ./src/cacheKey.ts",
     "copy": "tsx ./src/copy.ts",
-    "push": "tsx ./src/push.ts",
     "update-version": "tsx ./src/updatePrereleaseVersion.ts",
     "release-note": "tsx ./src/createRelease.ts",
     "changelog": "tsx ./src/changelog.ts"
diff --git a/infra/release/src/push.ts b/infra/release/src/push.ts
diff --git a/packages/vscode-webdriverio/package.json b/packages/vscode-webdriverio/package.json
@@ -38,7 +38,6 @@
     "prepackage:update-version": "pnpm --filter @vscode-wdio/release run update-version",
     "package": "vsce package",
     "publish": "tsx ./scripts/publish.ts",
-    "postpublish": "pnpm --filter @vscode-wdio/release run push",
     "package:next": "pnpm run package --pre-release",
     "publish:next": "pnpm run publish --pre-release",
     "typecheck": "tsc --noEmit --project tsconfig.json",
