Skip to content

Commit e150bb5

Browse files
jerrypnzclaude
jerrypnz
and
claude
authored
Pin GitHub Actions to commit SHAs for supply chain security (#830)
Replace mutable tag references with immutable commit SHAs to prevent supply chain attacks via compromised GitHub Actions. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent d430576 commit e150bb5

File tree

3 files changed

+32
-32
lines changed

3 files changed

+32
-32
lines changed

‎.github/workflows/continuous-deployment-workflow.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,48 +9,48 @@ jobs:
99
name: Test
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/checkout@v5
12+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
1313

1414
- run: git config --global --add safe.directory /__w/re-frame/re-frame
1515

1616
- name: Setup java
17-
uses: actions/setup-java@v3
17+
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
1818
with:
1919
distribution: 'temurin'
2020
java-version: '24'
2121

2222
- name: Install clojure tools
23-
uses: DeLaGuardo/setup-clojure@12.5
23+
uses: DeLaGuardo/setup-clojure@bc7570e912b028bbcc22f457adec7fdf98e2f4ed # 12.5
2424
with:
2525
cli: 'latest'
2626
bb: 'latest'
2727

2828
- name: Maven cache
2929
id: maven-cache
30-
uses: actions/cache@v4
30+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
3131
with:
3232
path: ~/.m2/repository
3333
key: ${{ runner.os }}-maven-${{ hashFiles('**/project.clj', '.github/workflows/**') }}
3434
restore-keys: |
3535
${{ runner.os }}-maven-
3636
3737
- name: npm cache
38-
uses: actions/cache@v4
38+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
3939
with:
4040
path: ~/.npm
4141
key: ${{ runner.os }}-npm-${{ hashFiles('project.clj') }}-${{ hashFiles('**/deps.cljs') }}
4242
restore-keys: |
4343
${{ runner.os }}-npm-
4444
4545
- name: shadow-cljs compiler cache
46-
uses: actions/cache@v4
46+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
4747
with:
4848
path: .shadow-cljs
4949
key: ${{ runner.os }}-shadow-cljs-${{ github.sha }}
5050
restore-keys: |
5151
${{ runner.os }}-shadow-cljs-
5252
53-
- uses: browser-actions/setup-chrome@v1
53+
- uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1
5454
id: setup-chrome
5555
with:
5656
chrome-version: 811961
@@ -70,7 +70,7 @@ jobs:
7070
- run: bb test :chrome-path '"${{ steps.setup-chrome.outputs.chrome-path }}"'
7171

7272
- name: Slack notification
73-
uses: homoluctus/slatify@v2.0.1
73+
uses: homoluctus/slatify@61c6b12d2ae226db04062ff9b43d9679e2d53236 # v2.0.1
7474
if: failure() || cancelled()
7575
with:
7676
type: ${{ job.status }}
@@ -91,29 +91,29 @@ jobs:
9191
username: ${{ github.actor }}
9292
password: ${{ secrets.GITHUB_TOKEN }}
9393
steps:
94-
- uses: actions/checkout@v5
94+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
9595
with:
9696
fetch-depth: 0
9797

9898
- run: git config --global --add safe.directory /__w/re-frame/re-frame
9999

100100
- name: Maven cache
101101
id: maven-cache
102-
uses: actions/cache@v4
102+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
103103
with:
104104
path: ~/.m2/repository
105105
key: ${{ runner.os }}-maven-${{ hashFiles('**/project.clj', '.github/workflows/**') }}
106106
restore-keys: |
107107
${{ runner.os }}-maven-
108108
109109
- name: Setup java
110-
uses: actions/setup-java@v3
110+
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
111111
with:
112112
distribution: 'temurin'
113113
java-version: '24'
114114

115115
- name: Install clojure tools
116-
uses: DeLaGuardo/setup-clojure@12.5
116+
uses: DeLaGuardo/setup-clojure@bc7570e912b028bbcc22f457adec7fdf98e2f4ed # 12.5
117117
with:
118118
cli: 'latest'
119119
bb: 'latest'
@@ -134,7 +134,7 @@ jobs:
134134
# IMPORTANT: The release year is hard-coded and must be updated in this file once per year for the moment.
135135
# Unfortunately I could not find a way to inject the year using the GitHub Actions ${{ expr }} syntax.
136136
- name: Create GitHub Release
137-
uses: actions/create-release@v1
137+
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
138138
env:
139139
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
140140
with:
@@ -146,7 +146,7 @@ jobs:
146146
prerelease: false
147147

148148
- name: Slack notification
149-
uses: homoluctus/slatify@v2.0.1
149+
uses: homoluctus/slatify@61c6b12d2ae226db04062ff9b43d9679e2d53236 # v2.0.1
150150
if: always()
151151
with:
152152
type: ${{ job.status }}

‎.github/workflows/continuous-integration-workflow.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,47 +18,47 @@ jobs:
1818
name: Test
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v5
21+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
2222
- run: git config --global --add safe.directory /__w/re-frame/re-frame
2323

2424
- name: Maven cache
2525
id: maven-cache
26-
uses: actions/cache@v4
26+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
2727
with:
2828
path: ~/.m2/repository
2929
key: ${{ runner.os }}-maven-${{ hashFiles('**/project.clj', '.github/workflows/**') }}
3030
restore-keys: |
3131
${{ runner.os }}-maven-
3232
3333
- name: npm cache
34-
uses: actions/cache@v4
34+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
3535
with:
3636
path: ~/.npm
3737
key: ${{ runner.os }}-npm-${{ hashFiles('project.clj') }}-${{ hashFiles('**/deps.cljs') }}
3838
restore-keys: |
3939
${{ runner.os }}-npm-
4040
4141
- name: shadow-cljs compiler cache
42-
uses: actions/cache@v4
42+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
4343
with:
4444
path: .shadow-cljs
4545
key: ${{ runner.os }}-shadow-cljs-${{ github.sha }}
4646
restore-keys: |
4747
${{ runner.os }}-shadow-cljs-
4848
49-
- uses: browser-actions/setup-chrome@v1
49+
- uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1
5050
id: setup-chrome
5151
with:
5252
chrome-version: 811961
5353

5454
- name: Setup java
55-
uses: actions/setup-java@v3
55+
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
5656
with:
5757
distribution: 'temurin'
5858
java-version: '24'
5959

6060
- name: Install clojure tools
61-
uses: DeLaGuardo/setup-clojure@12.5
61+
uses: DeLaGuardo/setup-clojure@bc7570e912b028bbcc22f457adec7fdf98e2f4ed # 12.5
6262
with:
6363
cli: 'latest'
6464
bb: 'latest'
@@ -81,7 +81,7 @@ jobs:
8181
run: curl -fsSL https://raw.githubusercontent.com/cljdoc/cljdoc/master/script/verify-cljdoc-edn | bash -s docs/cljdoc.edn
8282

8383
- name: Slack notification
84-
uses: homoluctus/slatify@v2.0.1
84+
uses: homoluctus/slatify@61c6b12d2ae226db04062ff9b43d9679e2d53236 # v2.0.1
8585
if: failure() || cancelled()
8686
with:
8787
type: ${{ job.status }}

‎.github/workflows/docs-workflow.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,27 +16,27 @@ jobs:
1616
runs-on: ubuntu-24.04
1717
steps:
1818
- name: Checkout Current Branch
19-
uses: actions/checkout@v5
19+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
2020

2121
- run: git config --global --add safe.directory /__w/re-frame/re-frame
2222

2323
- name: Maven cache
2424
id: maven-cache
25-
uses: actions/cache@v4
25+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
2626
with:
2727
path: ~/.m2/repository
2828
key: ${{ runner.os }}-maven-${{ hashFiles('project.clj', '.github/workflows/**') }}
2929
restore-keys: |
3030
${{ runner.os }}-maven-
3131
3232
- name: Setup java
33-
uses: actions/setup-java@v3
33+
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
3434
with:
3535
distribution: 'temurin'
3636
java-version: '24'
3737

3838
- name: Install clojure tools
39-
uses: DeLaGuardo/setup-clojure@12.5
39+
uses: DeLaGuardo/setup-clojure@bc7570e912b028bbcc22f457adec7fdf98e2f4ed # 12.5
4040
with:
4141
cli: 'latest'
4242
bb: 'latest'
@@ -56,7 +56,7 @@ jobs:
5656
tar Jcf re-frame-docs-app.tar.xz js
5757
5858
- name: Upload re-frame-docs App Artifact
59-
uses: actions/upload-artifact@v4
59+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
6060
with:
6161
name: re-frame-docs-app
6262
path: docs/re-frame-docs-app.tar.xz
@@ -70,12 +70,12 @@ jobs:
7070
image: "squidfunk/mkdocs-material:5.5.9"
7171
steps:
7272
- name: Checkout Current Branch
73-
uses: actions/checkout@v4
73+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
7474

7575
- run: git config --global --add safe.directory /__w/re-frame/re-frame
7676

7777
- name: Download re-frame-docs App Artifact
78-
uses: actions/download-artifact@v4
78+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
7979
with:
8080
name: re-frame-docs-app
8181
path: docs
@@ -94,7 +94,7 @@ jobs:
9494
run: tar zcf mkdocs.tar.gz site/
9595

9696
- name: Upload MkDocs Artifact
97-
uses: actions/upload-artifact@v4
97+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
9898
with:
9999
name: mkdocs
100100
path: mkdocs.tar.gz
@@ -105,13 +105,13 @@ jobs:
105105
runs-on: ubuntu-24.04
106106
steps:
107107
- name: Checkout GitHub Pages Branch
108-
uses: actions/checkout@v5
108+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
109109
with:
110110
ref: "gh-pages"
111111
path: "gh-pages"
112112

113113
- name: Download MkDocs Artifact
114-
uses: actions/download-artifact@v4
114+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
115115
with:
116116
name: mkdocs
117117

0 commit comments

Comments
 (0)