From b853825bd607f28110e5ff385419418a607c40e7 Mon Sep 17 00:00:00 2001 From: Will Da Silva Date: Sat, 15 Mar 2025 10:50:33 -0400 Subject: [PATCH] chore: pin GitHub Actions versions to commit hashes This will help prevent attacks such as [this one](https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/). Dependabot is able to update these versions automatically, and it will preserve the readable version comments. --- .github/workflows/cd_prod.yml | 12 ++++++------ .github/workflows/cd_staging.yml | 12 ++++++------ .github/workflows/ci.yml | 12 ++++++------ 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/cd_prod.yml b/.github/workflows/cd_prod.yml index a77a9d2..ec40eef 100644 --- a/.github/workflows/cd_prod.yml +++ b/.github/workflows/cd_prod.yml @@ -19,8 +19,8 @@ jobs: DBT_JOB_BRANCH: main steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv @@ -43,8 +43,8 @@ jobs: DBT_JOB_BRANCH: main steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv @@ -67,8 +67,8 @@ jobs: DBT_JOB_BRANCH: main steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv diff --git a/.github/workflows/cd_staging.yml b/.github/workflows/cd_staging.yml index b5d161d..ebfaf1e 100644 --- a/.github/workflows/cd_staging.yml +++ b/.github/workflows/cd_staging.yml @@ -19,8 +19,8 @@ jobs: DBT_JOB_BRANCH: staging steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv @@ -43,8 +43,8 @@ jobs: DBT_JOB_BRANCH: staging steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv @@ -67,8 +67,8 @@ jobs: DBT_JOB_BRANCH: staging steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 51de57a..4e0dcbe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,8 +19,8 @@ jobs: DBT_JOB_SCHEMA_OVERRIDE: dbt_jsdx__pr_${{ github.head_ref}} steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv @@ -44,8 +44,8 @@ jobs: DBT_JOB_SCHEMA_OVERRIDE: dbt_jsdx__pr_${{ github.head_ref}} steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv @@ -69,8 +69,8 @@ jobs: DBT_JOB_SCHEMA_OVERRIDE: dbt_jsdx__pr_${{ github.head_ref}} steps: - - uses: "actions/checkout@v4" - - uses: "actions/setup-python@v5" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" - name: Install uv