Skip to content

security: Pin Github Actions #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hhvrc merged 1 commit into from
May 6, 2026
Merged

security: Pin Github Actions #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions .github/workflows/build-module-base.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Check host dependency list is in sync
run: bash scripts/sync-host-deps.sh
Expand All @@ -34,15 +34,15 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
uses: actions/setup-dotnet@v5
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
dotnet-version: ${{ env.DOTNET_VERSION }}

- name: Cache NuGet packages
uses: actions/cache@v5
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.nuget/packages
key: module-base-nuget
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
run: dotnet build ModuleBase/ModuleBase.csproj -c Release -o ./publish/ModuleBase -p:PackageVersion=${{ steps.version.outputs.package_version }}

- name: Upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenShock Desktop Module Base
path: ./publish/ModuleBase/**
Expand All @@ -87,7 +87,7 @@ jobs:

steps:
- name: Download artifacts
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: OpenShock Desktop Module Base
path: ./packages
Expand All @@ -105,18 +105,18 @@ jobs:

steps:
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
uses: actions/setup-dotnet@v5
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
dotnet-version: ${{ env.DOTNET_VERSION }}

- name: Download artifacts
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: OpenShock Desktop Module Base
path: ./packages

- name: Login to NuGet.org with trusted publishing
uses: NuGet/login@v1
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
id: nuget-login
with:
user: ${{ secrets.NUGET_USER }}
Expand Down
34 changes: 17 additions & 17 deletions .github/workflows/ci-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,18 +43,18 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
uses: actions/setup-dotnet@v5
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
dotnet-version: ${{ env.DOTNET_VERSION }}

- name: Install maui workload for windows
run: dotnet workload install maui-windows

- name: Cache NuGet packages
uses: actions/cache@v5
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.nuget/packages
key: windows-maui-nuget
Expand All @@ -65,7 +65,7 @@ jobs:
run: dotnet publish Desktop/Desktop.csproj -c Release-Windows -o ./publish/Windows-Maui

- name: Upload OpenShock Desktop Windows artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenShock Desktop Windows MAUI
path: publish/Windows-Maui/*
Expand All @@ -79,13 +79,13 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
sparse-checkout: |
Installer

- name: Download artifacts
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: OpenShock Desktop Windows MAUI
path: publish/
Expand All @@ -94,13 +94,13 @@ jobs:
run: choco install nsis -y

- name: Create nsis installer
uses: joncloud/makensis-action@publish
uses: joncloud/makensis-action@971ef20f43e4f9f3af2c7f276cb7348d033da1cd # v5.0
with:
script-file: ${{ github.workspace }}/Installer/installer.nsi
additional-plugin-paths: ${{ github.workspace }}/Installer/Plugins

- name: Upload OpenShock Desktop Windows Setup
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenShock_Desktop_Setup
path: Installer/OpenShock_Desktop_Setup.exe
Expand All @@ -114,21 +114,21 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

- name: Log in to Container Registry
uses: docker/login-action@v4
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v6
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/desktop
flavor: |
Expand All @@ -144,7 +144,7 @@ jobs:
type=semver,pattern={{major}}.{{minor}}.{{patch}}

- name: Build and push
uses: docker/build-push-action@v7
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
file: Dockerfile
Expand All @@ -163,15 +163,15 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
uses: actions/setup-dotnet@v5
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
dotnet-version: ${{ env.DOTNET_VERSION }}

- name: Cache NuGet packages
uses: actions/cache@v5
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.nuget/packages
key: linux-photino-nuget
Expand All @@ -182,7 +182,7 @@ jobs:
run: dotnet publish Desktop/Desktop.csproj -c Release-Photino -o ./publish/Photino-Linux

- name: Upload OpenShock Desktop Photino Linux artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenShock Desktop Photino Linux
path: publish/Photino-Linux/*
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/ci-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
steps:
- name: Find latest tag
id: latest-tag
uses: oprypin/find-latest-tag@v1
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
continue-on-error: true
with:
repository: ${{ github.repository }}
Expand All @@ -36,7 +36,7 @@ jobs:
steps:
- name: Find latest RC tag
id: latest-rc
uses: oprypin/find-latest-tag@v1
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
continue-on-error: true
with:
repository: ${{ github.repository }}
Expand Down Expand Up @@ -68,19 +68,19 @@ jobs:
contents: write
steps:
- name: Download Windows installer
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: OpenShock_Desktop_Setup
path: artifacts/

- name: Download Linux Photino
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: OpenShock Desktop Photino Linux
path: artifacts/photino-linux/

- name: Download Module Base
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: OpenShock Desktop Module Base
path: artifacts/module-base/
Expand All @@ -91,7 +91,7 @@ jobs:
cd artifacts/module-base && zip -r ../OpenShock.Desktop.Module.Base.zip . && cd ../..

- name: Create draft release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
Comment thread
hhvrc marked this conversation as resolved.
with:
tag_name: ${{ github.ref_name }}
name: ${{ github.ref_name }}
Expand Down
Loading