diff --git a/.github/workflows/benchmark-tests.yml b/.github/workflows/benchmark-tests.yml index caab8330b7..0e3f3cddf8 100644 --- a/.github/workflows/benchmark-tests.yml +++ b/.github/workflows/benchmark-tests.yml @@ -5,13 +5,15 @@ on: pull_request: workflow_dispatch: name: benchmark-tests +permissions: + contents: read jobs: java-benchmarks: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: 17 diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 00a38e30c4..19302e340f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -4,6 +4,8 @@ on: - main pull_request: name: ci +permissions: + contents: read env: GOOGLE_CLOUD_PROJECT: "span-cloud-testing" GOOGLE_CLOUD_INSTANCE: "pgadapter-testing" @@ -25,8 +27,8 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 21 distribution: 'zulu' @@ -37,8 +39,8 @@ jobs: if: needs.check-env.outputs.has-key == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 11 distribution: 'zulu' @@ -50,11 +52,11 @@ jobs: sudo apt-get update sudo apt-get install postgresql-client-12 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' - id: 'setup-gcloud' - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ env.GOOGLE_CLOUD_PROJECT }} - name: "Install gcloud alpha component" @@ -66,8 +68,8 @@ jobs: if: needs.check-env.outputs.has-key == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 11 distribution: 'zulu' @@ -79,11 +81,11 @@ jobs: sudo apt-get update sudo apt-get install postgresql-client-13 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' - id: 'setup-gcloud' - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ env.GOOGLE_CLOUD_PROJECT }} - name: "Install gcloud alpha component" @@ -95,8 +97,8 @@ jobs: if: needs.check-env.outputs.has-key == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 11 distribution: 'zulu' @@ -108,11 +110,11 @@ jobs: sudo apt-get update sudo apt-get install postgresql-client-14 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' - id: 'setup-gcloud' - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ env.GOOGLE_CLOUD_PROJECT }} - name: "Install gcloud alpha component" @@ -124,8 +126,8 @@ jobs: if: needs.check-env.outputs.has-key == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 11 distribution: 'zulu' @@ -137,11 +139,11 @@ jobs: sudo apt-get update sudo apt-get install postgresql-client-15 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' - id: 'setup-gcloud' - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ env.GOOGLE_CLOUD_PROJECT }} - name: "Install gcloud alpha component" @@ -153,8 +155,8 @@ jobs: if: needs.check-env.outputs.has-key == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 11 distribution: 'zulu' @@ -166,11 +168,11 @@ jobs: sudo apt-get update sudo apt-get install postgresql-client-16 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' - id: 'setup-gcloud' - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ env.GOOGLE_CLOUD_PROJECT }} - name: "Install gcloud alpha component" @@ -182,8 +184,8 @@ jobs: if: needs.check-env.outputs.has-key == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 11 distribution: 'zulu' @@ -195,11 +197,11 @@ jobs: sudo apt-get update sudo apt-get install postgresql-client-17 - id: 'auth' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' - id: 'setup-gcloud' - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ env.GOOGLE_CLOUD_PROJECT }} - name: "Install gcloud alpha component" diff --git a/.github/workflows/go-sample-test.yaml b/.github/workflows/go-sample-test.yaml index 0ccb6d552b..65e0bcf400 100644 --- a/.github/workflows/go-sample-test.yaml +++ b/.github/workflows/go-sample-test.yaml @@ -4,6 +4,8 @@ on: - postgresql-dialect pull_request: name: go-sample-test +permissions: + contents: read env: GOOGLE_CLOUD_PROJECT: "span-cloud-testing" GOOGLE_CLOUD_INSTANCE: "pgadapter-testing" @@ -26,23 +28,23 @@ jobs: timeout-minutes: 60 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: 11 - run: java -version - name: Setup Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '^1.20.0' - name: Auth - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: ${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }} - name: Setup GCloud - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ secrets.GCP_PROJECT_ID }} - run: go version diff --git a/.github/workflows/integration-emulator.yaml b/.github/workflows/integration-emulator.yaml index 8a17d53734..98175cae86 100644 --- a/.github/workflows/integration-emulator.yaml +++ b/.github/workflows/integration-emulator.yaml @@ -5,6 +5,8 @@ on: pull_request: workflow_dispatch: name: integration-emulator +permissions: + contents: read env: GOOGLE_CLOUD_PROJECT: "test-project" GOOGLE_CLOUD_INSTANCE: "test-instance" @@ -30,7 +32,7 @@ jobs: --health-timeout 5s --health-retries 5 emulator: - image: gcr.io/cloud-spanner-emulator/emulator + image: gcr.io/cloud-spanner-emulator/emulator # zizmor: ignore[unpinned-images] ports: - 9010:9010 - 9020:9020 @@ -39,25 +41,25 @@ jobs: matrix: java: [11, 21] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: ${{matrix.java}} - run: java -version - name: Setup Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '^1.17.7' - run: go version - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '4.0.6' bundler-cache: true diff --git a/.github/workflows/integration-tests-against-docker.yaml b/.github/workflows/integration-tests-against-docker.yaml index 477672deed..e3ecfa1cfc 100644 --- a/.github/workflows/integration-tests-against-docker.yaml +++ b/.github/workflows/integration-tests-against-docker.yaml @@ -4,6 +4,8 @@ on: # pull_request: # branches: [ postgresql-dialect ] name: integration-tests-against-docker +permissions: + contents: read jobs: integration_tests: runs-on: ubuntu-latest @@ -13,13 +15,13 @@ jobs: GOOGLE_CLOUD_ENDPOINT: "spanner.googleapis.com" DOCKERFILE: "build/Dockerfile.ci" steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 8 distribution: 'zulu' - id: 'auth' - uses: 'google-github-actions/auth@v3' + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: '${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }}' export_environment_variables: true @@ -31,10 +33,10 @@ jobs: run: | docker run \ -d -p 5432:5432 \ - -v ${{env.GOOGLE_APPLICATION_CREDENTIALS}}:/credentials.json:ro \ + -v "$GOOGLE_APPLICATION_CREDENTIALS":/credentials.json:ro \ -e GOOGLE_APPLICATION_CREDENTIALS=/credentials.json \ pgadapter \ - -p ${{env.GOOGLE_CLOUD_PROJECT}} -i ${{env.GOOGLE_CLOUD_INSTANCE}} -d ${{env.GOOGLE_CLOUD_DATABASE}} \ + -p "$GOOGLE_CLOUD_PROJECT" -i "$GOOGLE_CLOUD_INSTANCE" -d "$GOOGLE_CLOUD_DATABASE" \ -x - name: Run integration tests run: | @@ -43,4 +45,4 @@ jobs: -DskipITs=false \ -DPG_ADAPTER_ADDRESS="localhost" \ -DPG_ADAPTER_LOCAL_PORT="5432" \ - -DPG_ADAPTER_DATABASE="${{env.GOOGLE_CLOUD_DATABASE}}" + -DPG_ADAPTER_DATABASE="$GOOGLE_CLOUD_DATABASE" diff --git a/.github/workflows/integration-windows.yaml b/.github/workflows/integration-windows.yaml index 002a1f6eca..e43780ce89 100644 --- a/.github/workflows/integration-windows.yaml +++ b/.github/workflows/integration-windows.yaml @@ -2,6 +2,8 @@ on: pull_request: workflow_dispatch: name: integration-windows +permissions: + contents: read env: GOOGLE_CLOUD_PROJECT: "span-cloud-testing" GOOGLE_CLOUD_INSTANCE: "pgadapter-testing" @@ -25,18 +27,18 @@ jobs: timeout-minutes: 60 runs-on: windows-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: 17 - run: java -version - - uses: actions/setup-dotnet@v6 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '6.0.x' - name: Auth - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: ${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }} - name: Run integration tests diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index d73c5fa83a..c18ca47e92 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -18,7 +18,6 @@ on: name: integration permissions: contents: read - issues: write env: GOOGLE_CLOUD_PROJECT: "span-cloud-testing" GOOGLE_CLOUD_INSTANCE: "pgadapter-testing" @@ -39,6 +38,9 @@ jobs: integration-test: needs: [check-env] if: needs.check-env.outputs.has-key == 'true' + permissions: + contents: read + issues: write timeout-minutes: 60 runs-on: ubuntu-latest # Add a PostgreSQL Docker container @@ -62,8 +64,10 @@ jobs: steps: - id: set-manual-endpoint if: "${{ inputs.endpoint }}" + env: + ENDPOINT: ${{ inputs.endpoint }} run: | - echo "GOOGLE_CLOUD_ENDPOINT=${{ inputs.endpoint }}" >> $GITHUB_ENV + echo "GOOGLE_CLOUD_ENDPOINT=$ENDPOINT" >> $GITHUB_ENV - id: set-preprod-scheduled-endpoint if: github.event.schedule=='52 4 * * *' run: | @@ -84,25 +88,25 @@ jobs: if: github.event_name == 'pull_request' run: | echo "EXCLUDED_INTEGRATION_TESTS=SlowTest" >> $GITHUB_ENV - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: 21 - run: java -version - name: Setup Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '^1.17.7' - run: go version - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '4.0.6' bundler-cache: true @@ -130,11 +134,11 @@ jobs: POSTGRES_USER: postgres POSTGRES_DATABASE: pgadapter - name: Auth - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: ${{ secrets.JSON_SERVICE_ACCOUNT_CREDENTIALS }} - name: Setup GCloud - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 with: project_id: ${{ secrets.GCP_PROJECT_ID }} - name: Run integration tests @@ -145,7 +149,7 @@ jobs: POSTGRES_USER: postgres POSTGRES_DATABASE: pgadapter - name: Upload coverage to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: directory: ./target/site/jacoco-merged-test-coverage-report fail_ci_if_error: false @@ -155,7 +159,7 @@ jobs: verbose: true - id: create-issue-on-failure if: "${{ failure() && (github.event.schedule=='52 4 * * *' || github.event.schedule=='14 3 * * *' || inputs.endpoint != '')}}" - uses: JasonEtco/create-an-issue@v2 + uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ENDPOINT: ${{ env.GOOGLE_CLOUD_ENDPOINT }} diff --git a/.github/workflows/samples.yaml b/.github/workflows/samples.yaml index 61a5ba2cc0..849cfc8f73 100644 --- a/.github/workflows/samples.yaml +++ b/.github/workflows/samples.yaml @@ -5,13 +5,15 @@ on: pull_request: workflow_dispatch: name: samples +permissions: + contents: read jobs: java-samples: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: 17 @@ -30,8 +32,8 @@ jobs: go-samples: runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v7 - - uses: actions/setup-go@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.26.5' - run: go version @@ -48,8 +50,8 @@ jobs: python-samples: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - run: python --version @@ -78,8 +80,8 @@ jobs: nodejs-samples: runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - run: node --version @@ -116,8 +118,8 @@ jobs: ruby-samples: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '4.0.6' bundler-cache: true @@ -130,8 +132,8 @@ jobs: dotnet-samples: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-dotnet@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '8.0.x' - name: Run npgsql Sample tests @@ -140,8 +142,8 @@ jobs: php-samples: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.3' tools: composer diff --git a/.github/workflows/snippets.yaml b/.github/workflows/snippets.yaml index bbbe9e1263..0985acff66 100644 --- a/.github/workflows/snippets.yaml +++ b/.github/workflows/snippets.yaml @@ -5,11 +5,13 @@ on: pull_request: workflow_dispatch: name: snippets +permissions: + contents: read jobs: psql-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Install postgresql-client-17" run: | sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list' @@ -22,9 +24,9 @@ jobs: java-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: 17 @@ -34,8 +36,8 @@ jobs: go-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-go@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.26.x' - name: Run Go snippets @@ -44,8 +46,8 @@ jobs: python-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - run: python --version @@ -59,8 +61,8 @@ jobs: nodejs-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - run: node --version @@ -72,8 +74,8 @@ jobs: dotnet-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-dotnet@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '8.0.x' - run: node --version @@ -83,8 +85,8 @@ jobs: php-snippets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.4' tools: composer diff --git a/.github/workflows/units.yaml b/.github/workflows/units.yaml index d3d15d2259..cc8892abdc 100644 --- a/.github/workflows/units.yaml +++ b/.github/workflows/units.yaml @@ -1,6 +1,8 @@ on: pull_request: name: units +permissions: + contents: read jobs: ubuntu: runs-on: ubuntu-latest @@ -11,29 +13,29 @@ jobs: matrix: java: [8, 11, 21] steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: ${{matrix.java}} - run: java -version - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.26.5' - run: go version - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - run: python --version - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.3' tools: composer - run: php --version - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '4.0.6' bundler-cache: true @@ -47,8 +49,8 @@ jobs: matrix: java: [8, 17] steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: ${{matrix.java}} @@ -65,36 +67,36 @@ jobs: matrix: java: [8, 17] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: install coreutils run: brew install coreutils - name: install postgresql run: brew install postgresql - - uses: actions/setup-java@v5 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: zulu java-version: ${{matrix.java}} - run: java -version - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.26.5' - run: go version - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - run: python --version - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.3' tools: composer - run: php --version - - uses: actions/setup-dotnet@v6 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '6.0.x' - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '4.0.6' bundler-cache: true