From d19544ce3cd46292f41effe005ffa00c95e92ca3 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Wed, 29 Jul 2026 15:00:16 +0200 Subject: [PATCH] Pin GitHub Actions versions Signed-off-by: Tom Wieczorek --- .github/actions/smoke-test-cache/action.yaml | 8 ++-- .github/workflows/actionlint.yml | 4 +- .github/workflows/codeql-analysis.yml | 10 ++--- .github/workflows/dco.yaml | 4 +- .github/workflows/dependabot-auto-approve.yml | 2 +- .github/workflows/go.yml | 8 ++-- .github/workflows/golangci-lint.yml | 6 +-- .github/workflows/gomod-lint.yml | 4 +- .github/workflows/release.yml | 14 +++---- .github/workflows/smoke.yml | 40 +++++++++---------- .github/workflows/update-latest-release.yml | 6 +-- 11 files changed, 53 insertions(+), 53 deletions(-) diff --git a/.github/actions/smoke-test-cache/action.yaml b/.github/actions/smoke-test-cache/action.yaml index 5a300987d..c89e0a9c2 100644 --- a/.github/actions/smoke-test-cache/action.yaml +++ b/.github/actions/smoke-test-cache/action.yaml @@ -4,19 +4,19 @@ runs: using: composite steps: - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod check-latest: true - name: Download compiled binary artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: k0sctl path: . - name: k0sctl cache - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 with: key: k0sctl-cache path: | @@ -24,7 +24,7 @@ runs: ~/.cache/k0sctl/k0s - name: kubectl cache - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 with: path: | smoke-test/kubectl diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index 5b5aab2b1..7cb554c8d 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -8,8 +8,8 @@ jobs: actionlint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: reviewdog/action-actionlint@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: reviewdog/action-actionlint@50842263c20a7c46bd0065b9e624d3c569db061e # v1.73.0 with: fail_on_error: true level: warning diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 9ed4e8d28..5aa19327a 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -38,19 +38,19 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Added as suggested in https://github.com/github/codeql-action/issues/1842 to bring in a newer go than exists # preinstalled on the runners - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -64,7 +64,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -77,4 +77,4 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml index 4ad7a5431..f1106d55c 100644 --- a/.github/workflows/dco.yaml +++ b/.github/workflows/dco.yaml @@ -18,10 +18,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout k0s - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/dependabot-auto-approve.yml b/.github/workflows/dependabot-auto-approve.yml index 357c69b65..9b90bea33 100644 --- a/.github/workflows/dependabot-auto-approve.yml +++ b/.github/workflows/dependabot-auto-approve.yml @@ -11,7 +11,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 93a71305a..d979c2ea5 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -16,10 +16,10 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true @@ -30,10 +30,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 6c9c37745..646b0bafb 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -10,16 +10,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code into the Go module directory - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true - name: Run golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: latest skip-cache: true diff --git a/.github/workflows/gomod-lint.yml b/.github/workflows/gomod-lint.yml index c2451d900..dbd18366d 100644 --- a/.github/workflows/gomod-lint.yml +++ b/.github/workflows/gomod-lint.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code into the Go module directory - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a0eb0935d..df01157b0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,30 +14,30 @@ jobs: packages: write # needed for ghcr access steps: - name: Check out code into the Go module directory - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Tag name id: tag-name run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT" - name: Login to GitHub Container Registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 with: driver: docker-container - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true @@ -49,7 +49,7 @@ jobs: run: make build-all - name: Create release and upload binaries - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 if: startsWith(github.ref, 'refs/tags/') with: files: | @@ -62,7 +62,7 @@ jobs: prerelease: ${{ contains(steps.tag-name.outputs.tag, '-') }} # v0.1.2-beta1, 1.2.3-rc1 - name: Build image and push to GitHub image registry - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 if: startsWith(github.ref, 'refs/tags/') with: builder: ${{ steps.buildx.outputs.name }} diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml index 7fb58ef35..109288c37 100644 --- a/.github/workflows/smoke.yml +++ b/.github/workflows/smoke.yml @@ -16,10 +16,10 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true @@ -28,7 +28,7 @@ jobs: run: make k0sctl - name: Stash the compiled binary for further testing - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: k0sctl path: k0sctl @@ -49,7 +49,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -68,7 +68,7 @@ jobs: steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -81,7 +81,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Build image @@ -102,7 +102,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -119,7 +119,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -137,7 +137,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests run: make smoke-files @@ -152,7 +152,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests run: make smoke-dynamic @@ -163,7 +163,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run OS override smoke test run: make smoke-os-override @@ -174,7 +174,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run k0sDownloadURL smoke test run: make smoke-downloadurl @@ -194,7 +194,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -215,7 +215,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -235,7 +235,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -255,7 +255,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -268,7 +268,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -286,7 +286,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -305,7 +305,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run smoke tests env: @@ -318,7 +318,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/smoke-test-cache - name: Run init smoke test run: make smoke-init diff --git a/.github/workflows/update-latest-release.yml b/.github/workflows/update-latest-release.yml index 097082bbc..0e3db4f24 100644 --- a/.github/workflows/update-latest-release.yml +++ b/.github/workflows/update-latest-release.yml @@ -20,13 +20,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod check-latest: true @@ -86,7 +86,7 @@ jobs: git push origin dev - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: dev name: Latest Development Build