Skip to content

Commit 99e74dd

Browse files
setchysetchy
committed
build: pin workflow digests
Signed-off-by: Adam Setch <[email protected]>
1 parent f5b5164 commit 99e74dd

File tree

8 files changed

+139
-44
lines changed

8 files changed

+139
-44
lines changed

‎.github/workflows/build.yml

+42-12
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,40 @@ name: Build
33
on:
44
workflow_call:
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
build-macos:
811
name: Build macOS (electron-builder)
912
runs-on: macos-latest
1013

1114
steps:
12-
- uses: actions/checkout@v4
13-
- uses: pnpm/action-setup@v3
14-
- uses: actions/setup-node@v4
15+
- name: Checkout
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
18+
- name: Setup pnpm
19+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
20+
21+
- name: Setup Node
22+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
1523
with:
1624
node-version-file: '.nvmrc'
1725
cache: 'pnpm'
26+
1827
- run: pnpm install
1928
- run: pnpm build
2029
- run: pnpm prepare:remove-source-maps
2130
- run: pnpm package:macos --publish=never -c.mac.identity=null
2231
env:
2332
CSC_LINK: ${{ secrets.mac_certs }}
2433
CSC_KEY_PASSWORD: ${{ secrets.mac_certs_password }}
34+
2535
- name: Clean up builds
2636
run: rm -rfv dist/mac-universal
27-
- uses: actions/upload-artifact@v4
37+
38+
- name: Upload artifacts
39+
uses: actions/[email protected]
2840
with:
2941
name: Gitify-dist-mac
3042
path: dist/
@@ -35,19 +47,28 @@ jobs:
3547
runs-on: windows-latest
3648

3749
steps:
38-
- uses: actions/checkout@v4
39-
- uses: pnpm/action-setup@v3
40-
- uses: actions/setup-node@v4
50+
- name: Checkout
51+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
52+
53+
- name: Setup pnpm
54+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
55+
56+
- name: Setup Node
57+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
4158
with:
4259
node-version-file: '.nvmrc'
4360
cache: 'pnpm'
61+
4462
- run: pnpm install
4563
- run: pnpm build
4664
- run: pnpm prepare:remove-source-maps
4765
- run: pnpm package:win --publish=never
66+
4867
- name: Clean up builds
4968
run: Remove-Item dist/win-unpacked -Recurse
50-
- uses: actions/upload-artifact@v4
69+
70+
- name: Upload artifacts
71+
uses: actions/[email protected]
5172
with:
5273
name: Gitify-dist-win
5374
path: dist
@@ -58,19 +79,28 @@ jobs:
5879
runs-on: ubuntu-latest
5980

6081
steps:
61-
- uses: actions/checkout@v4
62-
- uses: pnpm/action-setup@v3
63-
- uses: actions/setup-node@v4
82+
- name: Checkout
83+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
84+
85+
- name: Setup pnpm
86+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
87+
88+
- name: Setup Node
89+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
6490
with:
6591
node-version-file: '.nvmrc'
6692
cache: 'pnpm'
93+
6794
- run: pnpm install
6895
- run: pnpm build
6996
- run: pnpm prepare:remove-source-maps
7097
- run: pnpm package:linux --publish=never
98+
7199
- name: Clean up builds
72100
run: rm -rfv dist/linux-unpacked
73-
- uses: actions/upload-artifact@v4
101+
102+
- name: Upload artifacts
103+
uses: actions/[email protected]
74104
with:
75105
name: Gitify-dist-linux
76106
path: dist

‎.github/workflows/lint.yml

+12-3
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,27 @@ name: Lint
33
on:
44
workflow_call:
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
lint:
811
name: biomejs
912
runs-on: ubuntu-latest
1013

1114
steps:
12-
- uses: actions/checkout@v4
13-
- uses: pnpm/action-setup@v3
14-
- uses: actions/setup-node@v4
15+
- name: Checkout
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
18+
- name: Setup pnpm
19+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
20+
21+
- name: Setup Node
22+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
1523
with:
1624
node-version-file: '.nvmrc'
1725
cache: 'pnpm'
26+
1827
- run: pnpm install
1928
- run: pnpm lint:check
2029

‎.github/workflows/publish.yml

+36-12
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,18 @@ jobs:
1313
runs-on: macos-latest
1414

1515
steps:
16-
- uses: actions/checkout@v4
17-
- uses: pnpm/action-setup@v3
18-
- uses: actions/setup-node@v4
16+
- name: Checkout
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18+
19+
- name: Setup pnpm
20+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
21+
22+
- name: Setup Node
23+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
1924
with:
2025
node-version-file: '.nvmrc'
2126
cache: 'pnpm'
27+
2228
- run: pnpm install
2329
- run: pnpm build
2430
env:
@@ -34,7 +40,9 @@ jobs:
3440
CSC_KEY_PASSWORD: ${{ secrets.mac_certs_password }}
3541
GH_TOKEN: ${{ secrets.github_token }}
3642
NOTARIZE: true
37-
- uses: actions/upload-artifact@v4
43+
44+
- name: Upload artifacts
45+
uses: actions/[email protected]
3846
with:
3947
name: Gitify-release-mac
4048
path: dist/
@@ -45,12 +53,18 @@ jobs:
4553
runs-on: windows-latest
4654

4755
steps:
48-
- uses: actions/checkout@v4
49-
- uses: pnpm/action-setup@v3
50-
- uses: actions/setup-node@v4
56+
- name: Checkout
57+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58+
59+
- name: Setup pnpm
60+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
61+
62+
- name: Setup Node
63+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
5164
with:
5265
node-version-file: '.nvmrc'
5366
cache: 'pnpm'
67+
5468
- run: pnpm install
5569
- run: pnpm build
5670
env:
@@ -60,7 +74,9 @@ jobs:
6074
- run: pnpm package:win --publish onTagOrDraft
6175
env:
6276
GH_TOKEN: ${{ secrets.github_token }}
63-
- uses: actions/upload-artifact@v4
77+
78+
- name: Upload artifacts
79+
uses: actions/[email protected]
6480
with:
6581
name: Gitify-release-win
6682
path: dist/
@@ -71,12 +87,18 @@ jobs:
7187
runs-on: ubuntu-latest
7288

7389
steps:
74-
- uses: actions/checkout@v4
75-
- uses: pnpm/action-setup@v3
76-
- uses: actions/setup-node@v4
90+
- name: Checkout
91+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
92+
93+
- name: Setup pnpm
94+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
95+
96+
- name: Setup Node
97+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
7798
with:
7899
node-version-file: '.nvmrc'
79100
cache: 'pnpm'
101+
80102
- run: pnpm install
81103
- run: pnpm build
82104
env:
@@ -86,7 +108,9 @@ jobs:
86108
- run: pnpm package:linux --publish onTagOrDraft
87109
env:
88110
GH_TOKEN: ${{ secrets.github_token }}
89-
- uses: actions/upload-artifact@v4
111+
112+
- name: Upload artifacts
113+
uses: actions/[email protected]
90114
with:
91115
name: Gitify-release-linux
92116
path: dist/

‎.github/workflows/renovate.yml

+15-5
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,28 @@ on:
1010
paths:
1111
- renovate.json
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
renovate-config-validator:
1518
name: Config validation
1619
runs-on: ubuntu-latest
1720
steps:
18-
- uses: actions/checkout@v4
19-
- uses: actions/setup-node@v4
20-
with:
21-
node-version-file: .nvmrc
22-
- uses: pnpm/action-setup@v3
21+
- name: Checkout
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
24+
- name: Setup pnpm
25+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
2326
with:
2427
run_install: false
28+
29+
- name: Setup Node
30+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
31+
with:
32+
node-version-file: .nvmrc
33+
2534
- run: pnpm install --global renovate
35+
2636
- name: Validate Renovate config
2737
run: renovate-config-validator

‎.github/workflows/test.yml

+27-9
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,33 @@ name: Test
33
on:
44
workflow_call:
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
run-unit-tests:
811
name: Run Tests
912
runs-on: macos-latest
1013

1114
steps:
12-
- uses: actions/checkout@v4
13-
- uses: pnpm/action-setup@v3
14-
- uses: actions/setup-node@v4
15+
- name: Checkout
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
18+
- name: Setup pnpm
19+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
20+
21+
- name: Setup Node
22+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
1523
with:
1624
node-version-file: '.nvmrc'
1725
cache: 'pnpm'
26+
1827
- run: pnpm install
1928
- run: pnpm tsc --noEmit
2029
- run: pnpm test --coverage --runInBand --verbose
30+
2131
- name: Archive code coverage results
22-
uses: actions/upload-artifact@v4
32+
uses: actions/upload-artifact@v4.6.1
2333
with:
2434
name: code-coverage-report
2535
path: coverage/lcov.info
@@ -32,22 +42,30 @@ jobs:
3242
if: github.event.pull_request.head.repo.fork == false
3343

3444
steps:
35-
- uses: actions/checkout@v4
45+
- name: Checkout
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3647
with:
3748
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
38-
- uses: pnpm/action-setup@v3
39-
- uses: actions/setup-node@v4
49+
50+
- name: Setup pnpm
51+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
52+
53+
- name: Setup Node
54+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
4055
with:
4156
node-version-file: '.nvmrc'
4257
cache: 'pnpm'
58+
4359
- run: pnpm install
60+
4461
- name: Download a single artifact
45-
uses: actions/download-artifact@v4
62+
uses: actions/download-artifact@v4.1.8
4663
with:
4764
name: code-coverage-report
4865
path: coverage/
66+
4967
- name: SonarQube Cloud Scan
50-
uses: SonarSource/sonarqube-scan-action@v5
68+
uses: SonarSource/sonarqube-scan-action@v5.0.0
5169
env:
5270
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
5371
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎.github/workflows/triage.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
name: Validate PR title
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: actions/github-script@v7
24+
- uses: actions/github-script@v7.0.1
2525
with:
2626
script: |
2727
const title = context.payload.pull_request.title;
@@ -45,4 +45,4 @@ jobs:
4545
name: Auto-label PR
4646
runs-on: ubuntu-latest
4747
steps:
48-
- uses: fuxingloh/multi-labeler@v4
48+
- uses: fuxingloh/multi-labeler@v4.0.0

‎.github/workflows/website.yml

+3
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
- v*.*.*
77
workflow_dispatch: # For manually verify website deployment
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
redeploy-website:
1114
name: Deploy Website

‎renovate.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
":separateMultipleMajorReleases",
66
":enableVulnerabilityAlerts",
77
"schedule:weekly",
8-
"customManagers:biomeVersions"
8+
"customManagers:biomeVersions",
9+
"helpers:pinGitHubActionDigests"
910
],
1011
"labels": ["dependency"],
1112
"prConcurrentLimit": 5,

0 commit comments

Comments
 (0)