Skip to content

Commit e7f7a7c

Browse files
step-security-botstep-security-bot
authored
[StepSecurity] ci: Harden GitHub Actions (#1688)
Signed-off-by: StepSecurity Bot <[email protected]>
1 parent ac30e21 commit e7f7a7c

File tree

5 files changed

+36
-36
lines changed

5 files changed

+36
-36
lines changed

‎.github/workflows/build-sphinx.yml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141

4242
steps:
4343
- name: Cancel Previous Runs
44-
uses: styfle/[email protected]
44+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
4545
with:
4646
access_token: ${{ github.token }}
4747

@@ -52,7 +52,7 @@ jobs:
5252
echo "$GITHUB_CONTEXT"
5353
5454
- name: Free Disk Space (Ubuntu)
55-
uses: jlumbroso/[email protected]
55+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
5656
with:
5757
docker-images: false
5858

@@ -86,13 +86,13 @@ jobs:
8686
sudo apt-get install -y nvidia-cuda-toolkit clinfo
8787
8888
- name: Checkout repo
89-
uses: actions/[email protected]
89+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
9090
with:
9191
fetch-depth: 0
9292

9393
# https://github.com/marketplace/actions/setup-miniconda
9494
- name: Setup miniconda
95-
uses: conda-incubator/[email protected]
95+
uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
9696
with:
9797
auto-update-conda: true
9898
python-version: ${{ env.python-ver }}
@@ -135,7 +135,7 @@ jobs:
135135
136136
# https://github.com/marketplace/actions/doxygen-action
137137
- name: Build backend docs
138-
uses: mattnotmitt/[email protected]
138+
uses: mattnotmitt/doxygen-action@cbe72c8e402e8a3faa1f0b247ef90aa6c8e4ce74 # v1.9.8
139139
with:
140140
working-directory: 'dpnp/backend/doc'
141141

@@ -146,7 +146,7 @@ jobs:
146146
# The step is only used to build docs while pushing a PR to "master"
147147
- name: Deploy docs
148148
if: env.GH_EVENT_PUSH_UPSTREAM
149-
uses: peaceiris/[email protected]
149+
uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
150150
with:
151151
github_token: ${{ secrets.GITHUB_TOKEN }}
152152
publish_dir: ${{ env.PUBLISH_DIR }}
@@ -159,7 +159,7 @@ jobs:
159159
# The step is only used to build docs while pushing to PR branch
160160
- name: Publish pull-request docs
161161
if: env.GH_EVENT_OPEN_PR_UPSTREAM
162-
uses: peaceiris/[email protected]
162+
uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
163163
with:
164164
github_token: ${{ secrets.GITHUB_TOKEN }}
165165
publish_dir: ${{ env.PUBLISH_DIR }}
@@ -176,7 +176,7 @@ jobs:
176176
if: env.GH_EVENT_OPEN_PR_UPSTREAM
177177
env:
178178
PR_NUM: ${{ github.event.number }}
179-
uses: mshick/[email protected]
179+
uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
180180
with:
181181
message: |
182182
View rendered docs @ https://intelpython.github.io/dpnp/pull/${{ env.PR_NUM }}/index.html
@@ -199,7 +199,7 @@ jobs:
199199
runs-on: ubuntu-20.04
200200

201201
steps:
202-
- uses: actions/[email protected]
202+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
203203
with:
204204
fetch-depth: 0
205205

@@ -218,7 +218,7 @@ jobs:
218218
git push tokened_docs gh-pages
219219
220220
- name: Modify the comment with URL to official documentation
221-
uses: mshick/[email protected]
221+
uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
222222
with:
223223
find: |
224224
View rendered docs @.+

‎.github/workflows/conda-package.yml

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -74,17 +74,17 @@ jobs:
7474

7575
steps:
7676
- name: Cancel Previous Runs
77-
uses: styfle/[email protected]
77+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
7878
with:
7979
access_token: ${{ github.token }}
8080

8181
- name: Checkout DPNP repo
82-
uses: actions/[email protected]
82+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
8383
with:
8484
fetch-depth: 0
8585

8686
- name: Setup miniconda
87-
uses: conda-incubator/[email protected]
87+
uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
8888
with:
8989
auto-update-conda: true
9090
python-version: ${{ matrix.python }}
@@ -105,7 +105,7 @@ jobs:
105105
run: conda install conda-build=3.28.4
106106

107107
- name: Cache conda packages
108-
uses: actions/cache@v4
108+
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
109109
env:
110110
CACHE_NUMBER: 1 # Increase to reset cache
111111
with:
@@ -120,7 +120,7 @@ jobs:
120120
run: conda build --no-test --python ${{ matrix.python }} ${{ env.CHANNELS }} conda-recipe
121121

122122
- name: Upload artifact
123-
uses: actions/[email protected]
123+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
124124
with:
125125
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
126126
path: ${{ env.CONDA_BLD }}${{ env.PACKAGE_NAME }}-*.tar.bz2
@@ -153,7 +153,7 @@ jobs:
153153

154154
steps:
155155
- name: Download artifact
156-
uses: actions/[email protected]
156+
uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
157157
with:
158158
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
159159
path: ${{ env.pkg-path-in-channel }}
@@ -164,7 +164,7 @@ jobs:
164164
tar -xvf ${{ env.pkg-path-in-channel }}/${{ env.PACKAGE_NAME }}-*.tar.bz2 -C ${{ env.extracted-pkg-path }}
165165
166166
- name: Setup miniconda
167-
uses: conda-incubator/[email protected]
167+
uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
168168
with:
169169
auto-update-conda: true
170170
python-version: ${{ matrix.python }}
@@ -196,7 +196,7 @@ jobs:
196196
TEST_CHANNELS: '-c ${{ env.channel-path }} ${{ env.CHANNELS }}'
197197

198198
- name: Cache conda packages
199-
uses: actions/cache@v4
199+
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
200200
env:
201201
CACHE_NUMBER: 1 # Increase to reset cache
202202
with:
@@ -254,7 +254,7 @@ jobs:
254254

255255
steps:
256256
- name: Download artifact
257-
uses: actions/[email protected]
257+
uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
258258
with:
259259
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
260260
path: ${{ env.pkg-path-in-channel }}
@@ -274,7 +274,7 @@ jobs:
274274
dir ${{ env.extracted-pkg-path }}
275275
276276
- name: Setup miniconda
277-
uses: conda-incubator/[email protected]
277+
uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
278278
with:
279279
auto-update-conda: true
280280
python-version: ${{ matrix.python }}
@@ -320,7 +320,7 @@ jobs:
320320
run: more lockfile
321321

322322
- name: Cache conda packages
323-
uses: actions/cache@v4
323+
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
324324
env:
325325
CACHE_NUMBER: 1 # Increase to reset cache
326326
with:
@@ -388,12 +388,12 @@ jobs:
388388
389389
steps:
390390
- name: Download artifact
391-
uses: actions/[email protected]
391+
uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
392392
with:
393393
name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
394394

395395
- name: Setup miniconda
396-
uses: conda-incubator/[email protected]
396+
uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
397397
with:
398398
auto-update-conda: true
399399
python-version: ${{ matrix.python }}
@@ -416,7 +416,7 @@ jobs:
416416
run:
417417
shell: bash -el {0}
418418
steps:
419-
- uses: conda-incubator/[email protected]
419+
- uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
420420
with:
421421
run-post: false
422422
channel-priority: "disabled"
@@ -427,7 +427,7 @@ jobs:
427427
run: conda install anaconda-client
428428

429429
- name: Checkout repo
430-
uses: actions/[email protected]
430+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
431431
with:
432432
repository: IntelPython/devops-tools
433433
fetch-depth: 0

‎.github/workflows/generate_coverage.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,17 @@ jobs:
2525

2626
steps:
2727
- name: Cancel Previous Runs
28-
uses: styfle/[email protected]
28+
uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
2929
with:
3030
access_token: ${{ github.token }}
3131

3232
- name: Checkout repo
33-
uses: actions/[email protected]
33+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3434
with:
3535
fetch-depth: 0
3636

3737
- name: Setup miniconda
38-
uses: conda-incubator/[email protected]
38+
uses: conda-incubator/setup-miniconda@11b562958363ec5770fef326fe8ef0366f8cbf8a # v3.0.1
3939
with:
4040
auto-update-conda: true
4141
python-version: ${{ env.python-ver }}
@@ -60,7 +60,7 @@ jobs:
6060
6161
- name: Build dpnp with coverage
6262
id: build_coverage
63-
uses: nick-fields/[email protected]
63+
uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
6464
with:
6565
shell: bash
6666
timeout_minutes: 60

‎.github/workflows/openssf-scorecard.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,12 @@ jobs:
3333

3434
steps:
3535
- name: "Checkout code"
36-
uses: actions/[email protected]
36+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3737
with:
3838
persist-credentials: false
3939

4040
- name: "Run analysis"
41-
uses: ossf/[email protected]
41+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
4242
with:
4343
results_file: results.sarif
4444
results_format: sarif
@@ -60,14 +60,14 @@ jobs:
6060
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6161
# format to the repository Actions tab.
6262
- name: "Upload artifact"
63-
uses: actions/[email protected]
63+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
6464
with:
6565
name: SARIF file
6666
path: results.sarif
6767
retention-days: 14
6868

6969
# Upload the results to GitHub's code scanning dashboard.
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/[email protected]
71+
uses: github/codeql-action/upload-sarif@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
7272
with:
7373
sarif_file: results.sarif

‎.github/workflows/pre-commit.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ jobs:
1818
sudo ln -s /usr/bin/clang-format-12 /usr/bin/clang-format
1919
clang-format --version
2020
21-
- uses: actions/[email protected]
22-
- uses: actions/setup-python@v5
21+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
22+
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
2323
with:
2424
python-version: '3.11'
25-
- uses: pre-commit/[email protected]
25+
- uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0

0 commit comments

Comments
 (0)