Skip to content

Commit 60eb5ba

Browse files
kikosokikoso
committed
build: pin GitHub Actions to commit SHAs
The org's zizmor policy check (triggered whenever workflow files change) requires every `uses:` reference to be pinned to a full commit SHA rather than a floating version tag. Touching these three files for the checkout/setup-python bump made the check actually run for the first time in a while and it flagged all 36 `uses:` lines in them (not just the ones changed), so pins every action reference across build.yml, lint.yml, and generate-v3.yml, each with a version comment. release-please.yml is untouched by this PR and wasn't flagged, so left as-is.
1 parent 87bfc44 commit 60eb5ba

3 files changed

Lines changed: 36 additions & 36 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,16 @@ jobs:
3232
timeout-minutes: 45
3333

3434
steps:
35-
- uses: actions/checkout@v7
35+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3636

3737
- name: set up Java 21
38-
uses: actions/setup-java@v5
38+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
3939
with:
4040
distribution: 'temurin'
4141
java-version: '21'
4242

4343
- name: Setup Gradle
44-
uses: gradle/actions/setup-gradle@v6
44+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
4545

4646
- name: Build and check
4747
run: |
@@ -55,16 +55,16 @@ jobs:
5555
timeout-minutes: 45
5656

5757
steps:
58-
- uses: actions/checkout@v7
58+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5959

6060
- name: set up Java 21
61-
uses: actions/setup-java@v5
61+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
6262
with:
6363
distribution: 'temurin'
6464
java-version: '21'
6565

6666
- name: Setup Gradle
67-
uses: gradle/actions/setup-gradle@v6
67+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
6868

6969
- name: Build and check
7070
run: ./gradlew :WearOS:Wearable:assembleDebug
@@ -74,16 +74,16 @@ jobs:
7474
timeout-minutes: 45
7575

7676
steps:
77-
- uses: actions/checkout@v7
77+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7878

7979
- name: set up Java 21
80-
uses: actions/setup-java@v5
80+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
8181
with:
8282
distribution: 'temurin'
8383
java-version: '21'
8484

8585
- name: Setup Gradle
86-
uses: gradle/actions/setup-gradle@v6
86+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
8787

8888
- name: Build and check
8989
run: ./gradlew :FireMarkers:app:assembleDebug
@@ -93,16 +93,16 @@ jobs:
9393
timeout-minutes: 45
9494

9595
steps:
96-
- uses: actions/checkout@v7
96+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
9797

9898
- name: set up Java 21
99-
uses: actions/setup-java@v5
99+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
100100
with:
101101
distribution: 'temurin'
102102
java-version: '21'
103103

104104
- name: Setup Gradle
105-
uses: gradle/actions/setup-gradle@v6
105+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
106106

107107
- name: Build and check
108108
run: |
@@ -118,16 +118,16 @@ jobs:
118118
timeout-minutes: 45
119119

120120
steps:
121-
- uses: actions/checkout@v7
121+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
122122

123123
- name: set up Java 21
124-
uses: actions/setup-java@v5
124+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
125125
with:
126126
distribution: 'temurin'
127127
java-version: '21'
128128

129129
- name: Setup Gradle
130-
uses: gradle/actions/setup-gradle@v6
130+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
131131

132132
- name: Build and check
133133
run: |
@@ -143,9 +143,9 @@ jobs:
143143
- build-Snippets
144144
- build-tutorials
145145
steps:
146-
- uses: actions/checkout@v7
146+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
147147
- name: set up Java 21
148-
uses: actions/setup-java@v5
148+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
149149
with:
150150
distribution: 'temurin'
151151
java-version: '21'

‎.github/workflows/generate-v3.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,16 @@ jobs:
2525
timeout-minutes: 45
2626

2727
steps:
28-
- uses: actions/checkout@v7
28+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2929

3030
- name: set up JDK 17
31-
uses: actions/setup-java@v5
31+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
3232
with:
3333
distribution: 'temurin'
3434
java-version: 17
3535

3636
- name: Setup Gradle
37-
uses: gradle/actions/setup-gradle@v6
37+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
3838

3939
- name: Install NDK
4040
run: |
@@ -48,7 +48,7 @@ jobs:
4848
echo "files-changed=$(git status -s | wc -l)" >> $GITHUB_OUTPUT
4949
5050
- name: PR Changes
51-
uses: peter-evans/create-pull-request@v8
51+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
5252
if: steps.gradlew-generate-v3.outputs.files-changed > 0
5353
with:
5454
token: ${{ secrets.SYNCED_GITHUB_TOKEN_REPO }}

‎.github/workflows/lint.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,24 +25,24 @@ jobs:
2525

2626
steps:
2727
- name: Checkout code
28-
uses: actions/checkout@v7
28+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2929

3030
- name: Set up JDK 17
31-
uses: actions/setup-java@v5
31+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
3232
with:
3333
distribution: 'temurin'
3434
java-version: '21'
3535

3636
- name: Set up Python
37-
uses: actions/setup-python@v7
37+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
3838
with:
3939
python-version: '3.x'
4040

4141
- name: Check documentation versions
4242
run: python3 scripts/update_docs_versions.py --check
4343

4444
- name: Setup Gradle
45-
uses: gradle/actions/setup-gradle@v6
45+
uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
4646

4747
- name: Run Android Lint
4848
run: |
@@ -59,67 +59,67 @@ jobs:
5959
./gradlew :FireMarkers:app:lintDebug
6060
6161
- name: Upload SARIF for ApiDemos:kotlin-app
62-
uses: github/codeql-action/upload-sarif@v4
62+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
6363
with:
6464
sarif_file: ApiDemos/project/kotlin-app/build/reports/lint-results-debug.sarif
6565
category: ApiDemos-kotlin-app
6666

6767
- name: Upload SARIF for ApiDemos:java-app
68-
uses: github/codeql-action/upload-sarif@v4
68+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
6969
with:
7070
sarif_file: ApiDemos/project/java-app/build/reports/lint-results-debug.sarif
7171
category: ApiDemos-java-app
7272

7373
- name: Upload SARIF for ApiDemos:common-ui
74-
uses: github/codeql-action/upload-sarif@v4
74+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
7575
with:
7676
sarif_file: ApiDemos/project/common-ui/build/reports/lint-results-debug.sarif
7777
category: ApiDemos-common-ui
7878

7979
- name: Upload SARIF for snippets:app
80-
uses: github/codeql-action/upload-sarif@v4
80+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
8181
with:
8282
sarif_file: snippets/app/build/reports/lint-results-debug.sarif
8383
category: snippets-app
8484

8585
- name: Upload SARIF for snippets:app-utils
86-
uses: github/codeql-action/upload-sarif@v4
86+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
8787
with:
8888
sarif_file: snippets/app-utils/build/reports/lint-results-debug.sarif
8989
category: snippets-app-utils
9090

9191
- name: Upload SARIF for snippets:app-utils-ktx
92-
uses: github/codeql-action/upload-sarif@v4
92+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
9393
with:
9494
sarif_file: snippets/app-utils-ktx/build/reports/lint-results-debug.sarif
9595
category: snippets-app-utils-ktx
9696

9797
- name: Upload SARIF for snippets:app-places-ktx
98-
uses: github/codeql-action/upload-sarif@v4
98+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
9999
with:
100100
sarif_file: snippets/app-places-ktx/build/reports/lint-results-debug.sarif
101101
category: snippets-app-places-ktx
102102

103103
- name: Upload SARIF for snippets:app-ktx
104-
uses: github/codeql-action/upload-sarif@v4
104+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
105105
with:
106106
sarif_file: snippets/app-ktx/build/reports/lint-results-debug.sarif
107107
category: snippets-app-ktx
108108

109109
- name: Upload SARIF for snippets:app-compose
110-
uses: github/codeql-action/upload-sarif@v4
110+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
111111
with:
112112
sarif_file: snippets/app-compose/build/reports/lint-results-debug.sarif
113113
category: snippets-app-compose
114114

115115
- name: Upload SARIF for WearOS:Wearable
116-
uses: github/codeql-action/upload-sarif@v4
116+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
117117
with:
118118
sarif_file: WearOS/Wearable/build/reports/lint-results-debug.sarif
119119
category: WearOS-Wearable
120120

121121
- name: Upload SARIF for FireMarkers:app
122-
uses: github/codeql-action/upload-sarif@v4
122+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
123123
with:
124124
sarif_file: FireMarkers/app/build/reports/lint-results-debug.sarif
125125
category: FireMarkers-app

0 commit comments

Comments
 (0)