From be7b27d4616927ca1c8a6d8c93a0c43ce6dd2ba9 Mon Sep 17 00:00:00 2001 From: JL Mitra Date: Wed, 1 Apr 2026 15:10:18 -0700 Subject: [PATCH] SECENG-7706 [security] Pin versions of GitHub Actions to full commit hash This PR pins versions of GitHub Actions to full commit hash via automated scripts. In general, this PR doesn't change the behavior of the workflows, so you can merge this safely. This pull request was created by [multi-gitter](https://github.com/lindell/multi-gitter). Please merge this pull request by 2026-04-10. For any questions, please ask in the Slack channel #help-security. --- .github/workflows/codeql-analysis.yml | 8 ++++---- .github/workflows/deploy-docs.yml | 6 +++--- .github/workflows/jira-issue-create.yml | 2 +- .github/workflows/lint.yml | 6 +++--- .github/workflows/publish-github-packages.yml | 6 +++--- .github/workflows/release.yml | 10 +++++----- .github/workflows/test.yml | 6 +++--- 7 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 7dd895c6..b09189e1 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -37,11 +37,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@231aa2c8a89117b126725a0e11897209b7118144 # v1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -52,7 +52,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@231aa2c8a89117b126725a0e11897209b7118144 # v1 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -66,4 +66,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@231aa2c8a89117b126725a0e11897209b7118144 # v1 diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index 24ddab1b..2e9f4677 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -21,16 +21,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v1 + uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1 - name: node_modules cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: '**/node_modules' key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }} - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 16.x diff --git a/.github/workflows/jira-issue-create.yml b/.github/workflows/jira-issue-create.yml index 47624b55..0ab40df0 100644 --- a/.github/workflows/jira-issue-create.yml +++ b/.github/workflows/jira-issue-create.yml @@ -11,7 +11,7 @@ on: jobs: call-workflow-passing-data: - uses: amplitude/Amplitude-TypeScript/.github/workflows/jira-issue-create-template.yml@main + uses: amplitude/Amplitude-TypeScript/.github/workflows/jira-issue-create-template.yml@8dadabbe62161729e3aa83c0d664e106b748c8cc # @amplitude/plugin-session-replay-react-native@0.4.9 with: label: 'JS' subcomponent: "dx_javascript_sdk" diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 61a0e7ab..9cc8a365 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -9,16 +9,16 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: node_modules cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: '**/node_modules' key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }} - name: Use Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 22.x diff --git a/.github/workflows/publish-github-packages.yml b/.github/workflows/publish-github-packages.yml index ee076370..54c4a39b 100644 --- a/.github/workflows/publish-github-packages.yml +++ b/.github/workflows/publish-github-packages.yml @@ -36,10 +36,10 @@ jobs: node-version: [ 16.x ] steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: ${{ matrix.node-version }} cache: 'yarn' @@ -57,7 +57,7 @@ jobs: run: yarn test - name: Set registry url - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: registry-url: 'https://npm.pkg.github.com' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b7ac5702..408d6910 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,24 +56,24 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v2 + uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2 with: role-to-assume: arn:aws:iam::358203115967:role/github-actions-role aws-region: us-west-2 - name: node_modules cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: '**/node_modules' key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }} - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2 with: python-version: '3.8.x' @@ -81,7 +81,7 @@ jobs: run: pip install boto3==1.14.63 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f14d59d5..f6e5c384 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,16 +21,16 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: node_modules cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: '**/node_modules' key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }} - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: ${{ matrix.node-version }}