From dc7f49dda77624aadfd91e8ffd638f8160855e64 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 17:19:02 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++ .github/workflows/build.yml | 48 +++++++++---------- .github/workflows/deploy-micronaut-native.yml | 12 ++--- .github/workflows/deploy-quarkus-native.yml | 12 ++--- .../workflows/deploy-springboot-native.yml | 12 ++--- .github/workflows/deploy.yml | 18 +++---- .github/workflows/docs.yml | 8 ++-- 7 files changed, 66 insertions(+), 55 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2c48305 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7a5e061..0e487bb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,17 +21,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up Java - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3.14.2 with: distribution: 'microsoft' java-version: '17' cache: 'maven' - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ github.actor }} @@ -41,7 +41,7 @@ jobs: run: cd quarkus-app && ./mvnw package - name: Build and push Quarkus Java image to registry - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.QUARKUS_APP }}:latest @@ -52,10 +52,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up GraalVM - uses: graalvm/setup-graalvm@v1 + uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: version: 'latest' java-version: '17' @@ -63,7 +63,7 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ github.actor }} @@ -73,7 +73,7 @@ jobs: run: cd quarkus-app && ./mvnw -Pnative package -Dquarkus.native.container-build=true - name: Build quarkus-app native Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.QUARKUS_APP }}-native:latest @@ -84,17 +84,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up Java - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3.14.2 with: distribution: 'microsoft' java-version: '17' cache: 'maven' - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ github.actor }} @@ -104,7 +104,7 @@ jobs: run: cd micronaut-app && ./mvnw package - name: Build and push Micronaut Java image to registry - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.MICRONAUT_APP }}:latest @@ -115,10 +115,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up GraalVM - uses: graalvm/setup-graalvm@v1 + uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: version: 'latest' java-version: '17' @@ -126,7 +126,7 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ github.actor }} @@ -136,7 +136,7 @@ jobs: run: cd micronaut-app && ./mvnw package -Dpackaging=native-image - name: Build micronaut-app native Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.MICRONAUT_APP }}-native:latest @@ -147,17 +147,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up Java - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3.14.2 with: distribution: 'microsoft' java-version: '17' cache: 'maven' - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ github.actor }} @@ -171,7 +171,7 @@ jobs: jar -xf ../*.jar - name: Build and push Spring Boot Java image to registry - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.SPRING_APP }}:latest @@ -182,10 +182,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up GraalVM - uses: graalvm/setup-graalvm@v1 + uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: version: 'latest' java-version: '17' @@ -193,7 +193,7 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ github.actor }} @@ -204,7 +204,7 @@ jobs: cd springboot-app && ./mvnw -Pnative native:compile - name: Build springboot-app native Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.SPRING_APP }}-native:latest diff --git a/.github/workflows/deploy-micronaut-native.yml b/.github/workflows/deploy-micronaut-native.yml index 2c152f3..6f773df 100644 --- a/.github/workflows/deploy-micronaut-native.yml +++ b/.github/workflows/deploy-micronaut-native.yml @@ -19,15 +19,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 - - uses: graalvm/setup-graalvm@v1 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: version: 'latest' java-version: '17' components: 'native-image' github-token: ${{ secrets.GITHUB_TOKEN }} - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ secrets.REGISTRY_USERNAME }} @@ -36,18 +36,18 @@ jobs: run: | cd micronaut-app && ./mvnw package -Dpackaging=native-image - name: Build micronaut-app native Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/micronaut-app-native:${{ github.sha }} file: ./micronaut-app/src/main/docker/Dockerfile.native context: ./micronaut-app/ - name: Azure Login - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Deploy micronaut-app native Docker image to Azure Container Apps - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | az config set extension.use_dynamic_install=yes_without_prompt diff --git a/.github/workflows/deploy-quarkus-native.yml b/.github/workflows/deploy-quarkus-native.yml index e8f2a6f..53d9994 100644 --- a/.github/workflows/deploy-quarkus-native.yml +++ b/.github/workflows/deploy-quarkus-native.yml @@ -19,15 +19,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 - - uses: graalvm/setup-graalvm@v1 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: version: 'latest' java-version: '17' components: 'native-image' github-token: ${{ secrets.GITHUB_TOKEN }} - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ secrets.REGISTRY_USERNAME }} @@ -36,18 +36,18 @@ jobs: run: | cd quarkus-app && ./mvnw -Pnative package -Dquarkus.native.container-build=true - name: Build quarkus-app native Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/quarkus-app-native:${{ github.sha }} file: ./quarkus-app/src/main/docker/Dockerfile.native context: ./quarkus-app/ - name: Azure Login - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Deploy quarkus-app native Docker image to Azure Container Apps - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | az config set extension.use_dynamic_install=yes_without_prompt diff --git a/.github/workflows/deploy-springboot-native.yml b/.github/workflows/deploy-springboot-native.yml index 62dbfd2..ad76818 100644 --- a/.github/workflows/deploy-springboot-native.yml +++ b/.github/workflows/deploy-springboot-native.yml @@ -19,15 +19,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 - - uses: graalvm/setup-graalvm@v1 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: version: 'latest' java-version: '17' components: 'native-image' github-token: ${{ secrets.GITHUB_TOKEN }} - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ secrets.REGISTRY_USERNAME }} @@ -36,18 +36,18 @@ jobs: run: | cd springboot-app && ./mvnw -Pnative native:compile - name: Build springboot-app native Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/springboot-app-native:${{ github.sha }} file: ./springboot-app/src/main/docker/Dockerfile.native context: ./springboot-app/ - name: Azure Login - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Deploy springboot-app native Docker image to Azure Container Apps - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | az config set extension.use_dynamic_install=yes_without_prompt diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index ee397dc..85ecef0 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -41,20 +41,20 @@ jobs: # part of the job. steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Set up Java - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3.14.2 with: distribution: 'microsoft' java-version: '17' cache: 'maven' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 - name: Log in to container registry - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: registry: ${{ env.REGISTRY_URL }} username: ${{ secrets.REGISTRY_USERNAME }} @@ -75,7 +75,7 @@ jobs: # tag::adocPush[] - name: Build and push Quarkus Java image to registry - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.QUARKUS_APP }}:${{ github.sha }} @@ -83,7 +83,7 @@ jobs: context: ./quarkus-app/ - name: Build and push Micronaut Java image to registry - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.MICRONAUT_APP }}:${{ github.sha }} @@ -91,7 +91,7 @@ jobs: context: ./micronaut-app/ - name: Build and push Spring Boot Java image to registry - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: push: true tags: ${{ env.REGISTRY_URL }}/${{ env.PROJECT }}/${{ env.SPRING_APP }}:${{ github.sha }} @@ -110,13 +110,13 @@ jobs: steps: # Log in to Azure to be able to deploy our apps - name: Azure Login - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} # Use the Azure CLI to deploy our apps - name: Deploy to Azure Container Apps - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | az config set extension.use_dynamic_install=yes_without_prompt diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 903f6d8..673efcb 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -23,15 +23,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Setup Node.js - uses: actions/setup-node@v1 + uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: 18 - name: Set up Java - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3.14.2 with: distribution: 'microsoft' java-version: '17' @@ -47,7 +47,7 @@ jobs: npx -y @moaw/cli@latest convert src/docs/asciidoc/index.adoc -a src/docs/asciidoc/attributes.json -d target/generated-docs/workshop.md - name: Deploy to GitHub Pages - uses: peaceiris/actions-gh-pages@v3 + uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3 if: ${{ github.ref == 'refs/heads/main' }} with: github_token: ${{ secrets.GITHUB_TOKEN }}