From 489d44b5f7b25bf2557a5f288a5c8559a72ffe7c Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 11:49:37 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/deploy.yml | 10 +++++----- .github/workflows/roll-next.yml | 10 +++++----- .github/workflows/roll-stable.yml | 14 +++++++------- .github/workflows/tests.yml | 4 ++-- 5 files changed, 30 insertions(+), 19 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..2c48305b7e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0c9436a626..e3a0824e93 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -18,17 +18,17 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 22 - name: Setup Pages id: pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - run: npm ci - run: npm run build - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: ./build @@ -42,4 +42,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/roll-next.yml b/.github/workflows/roll-next.yml index 7ecbdd739d..eea847310f 100644 --- a/.github/workflows/roll-next.yml +++ b/.github/workflows/roll-next.yml @@ -11,12 +11,12 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v5 - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: repository: 'microsoft/playwright' path: playwright - - uses: actions/setup-node@v5 + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 22 - name: Install dependencies @@ -47,13 +47,13 @@ jobs: git add . git commit -m "feat(roll): roll to ToT Playwright ($(date +"%d-%m-%y"))" git push origin $BRANCH_NAME --force - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token with: client-id: ${{ vars.PLAYWRIGHT_CLIENT_ID }} private-key: ${{ secrets.PLAYWRIGHT_PRIVATE_KEY }} - name: Create Pull Request - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 if: ${{ steps.prepare-branch.outputs.HAS_CHANGES == '1' }} with: github-token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/roll-stable.yml b/.github/workflows/roll-stable.yml index 2b38ad2364..f285bc51af 100644 --- a/.github/workflows/roll-stable.yml +++ b/.github/workflows/roll-stable.yml @@ -9,7 +9,7 @@ jobs: name: Build runs-on: ubuntu-24.04 steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 id: determine-version with: script: | @@ -25,13 +25,13 @@ jobs: }); return relevantBranches.pop().name.replace(/^release-/, ''); result-encoding: string - - uses: actions/checkout@v5 - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: repository: 'microsoft/playwright' path: playwright ref: 'release-${{ steps.determine-version.outputs.result }}' - - uses: actions/setup-node@v5 + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 22 - name: Install dependencies @@ -69,14 +69,14 @@ jobs: git add "**/versions.json" git commit -m "feat(roll): roll to $VERSION Playwright" git push origin $BRANCH_NAME --force - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token with: client-id: ${{ vars.PLAYWRIGHT_CLIENT_ID }} private-key: ${{ secrets.PLAYWRIGHT_PRIVATE_KEY }} - name: Check for existing Pull Request id: check-pr - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: github-token: ${{ steps.app-token.outputs.token }} script: | @@ -89,7 +89,7 @@ jobs: return pullRequests.length > 0 ? 'true' : 'false'; result-encoding: string - name: Create Pull Request - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 if: ${{ steps.prepare-branch.outputs.HAS_CHANGES == '1' && steps.check-pr.outputs.result == 'false' }} with: github-token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 43b92e4f0b..57280cb32f 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -20,14 +20,14 @@ jobs: image: mcr.microsoft.com/playwright:v1.59.0-noble options: --user 1001 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install dependencies run: npm ci - name: Build site run: npm run build - name: Run Playwright tests run: npx playwright test - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: playwright-report