From 56dd342c253ea0a8363d83b904dbdb37d8168f67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:09:41 +0200 Subject: [PATCH 1/2] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/actions-checks.yaml | 4 ++-- .github/workflows/bump-openapi-version.yaml | 2 +- .github/workflows/docs-ui-tests.yaml | 8 ++++---- .github/workflows/docs.yaml | 10 +++++----- .github/workflows/lychee.yml | 6 +++--- .github/workflows/openapi-ci.yaml | 16 ++++++++-------- .github/workflows/publish-to-npm.yaml | 10 +++++----- .github/workflows/spell-check.yaml | 4 ++-- .github/workflows/test-academy.yml | 6 +++--- .github/workflows/test.yaml | 18 +++++++++--------- .github/workflows/vale.yaml | 6 +++--- 11 files changed, 45 insertions(+), 45 deletions(-) diff --git a/.github/workflows/actions-checks.yaml b/.github/workflows/actions-checks.yaml index 352343f103..5e5d9a84be 100644 --- a/.github/workflows/actions-checks.yaml +++ b/.github/workflows/actions-checks.yaml @@ -12,6 +12,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run actionlint - uses: rhysd/actionlint@v1.7.12 + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 diff --git a/.github/workflows/bump-openapi-version.yaml b/.github/workflows/bump-openapi-version.yaml index b012da3bbe..3d64434712 100644 --- a/.github/workflows/bump-openapi-version.yaml +++ b/.github/workflows/bump-openapi-version.yaml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} diff --git a/.github/workflows/docs-ui-tests.yaml b/.github/workflows/docs-ui-tests.yaml index c1015be886..8156138b26 100644 --- a/.github/workflows/docs-ui-tests.yaml +++ b/.github/workflows/docs-ui-tests.yaml @@ -25,10 +25,10 @@ jobs: contents: read issues: write # the failure step files a drift issue for maintainers steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -55,7 +55,7 @@ jobs: - name: Upload Playwright report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: playwright-report path: docs-tests/playwright-report/ @@ -63,7 +63,7 @@ jobs: - name: Upload drift report (issues.json) if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: drift-report path: docs-tests/output/ diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index e9d29f69d9..97e0a1809a 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -20,9 +20,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -37,15 +37,15 @@ jobs: SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }} - name: Set up GitHub Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload GitHub Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: ./build - name: Deploy artifact to GitHub Pages - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Invalidate CloudFront cache run: | diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml index 55736a46d8..12f606d17c 100644 --- a/.github/workflows/lychee.yml +++ b/.github/workflows/lychee.yml @@ -9,10 +9,10 @@ jobs: link-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -28,7 +28,7 @@ jobs: - name: Run Lychee Link Checker id: lychee - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 env: GITHUB_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} with: diff --git a/.github/workflows/openapi-ci.yaml b/.github/workflows/openapi-ci.yaml index fc02c93c87..a2fe0ff2a0 100644 --- a/.github/workflows/openapi-ci.yaml +++ b/.github/workflows/openapi-ci.yaml @@ -15,10 +15,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -36,10 +36,10 @@ jobs: needs: lint steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -49,7 +49,7 @@ jobs: run: pnpm openapi:build - name: Upload bundles - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: openapi-bundles path: | @@ -63,17 +63,17 @@ jobs: needs: [lint, build] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - uses: apify/actions/pnpm-install@v1.3.1 - name: Download bundles - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: openapi-bundles path: static/api/ diff --git a/.github/workflows/publish-to-npm.yaml b/.github/workflows/publish-to-npm.yaml index 54c54b5de5..d6a71d3ae6 100644 --- a/.github/workflows/publish-to-npm.yaml +++ b/.github/workflows/publish-to-npm.yaml @@ -21,18 +21,18 @@ jobs: outputs: theme_changed: ${{ steps.changed-theme-files.outputs.any_changed }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Check changes in theme id: changed-theme-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: since_last_remote_commit: "true" files: | @@ -43,12 +43,12 @@ jobs: if: ${{ needs.look_for_change.outputs.theme_changed == 'true' || github.event_name == 'workflow_dispatch' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/spell-check.yaml b/.github/workflows/spell-check.yaml index c755c4d4bd..620ed225f6 100644 --- a/.github/workflows/spell-check.yaml +++ b/.github/workflows/spell-check.yaml @@ -12,6 +12,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check spelling with typos - uses: crate-ci/typos@v1.44.0 + uses: crate-ci/typos@631208b7aac2daa8b707f55e7331f9112b0e062d # v1.44.0 diff --git a/.github/workflows/test-academy.yml b/.github/workflows/test-academy.yml index 88bd05d729..ef6d04fcb6 100644 --- a/.github/workflows/test-academy.yml +++ b/.github/workflows/test-academy.yml @@ -11,15 +11,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Setup Python - uses: astral-sh/setup-uv@v9.0.0 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - uses: apify/actions/pnpm-install@v1.3.1 diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 3d019c6ac0..b83e91d06c 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -237,18 +237,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: '**/*.{md,mdx}' files_ignore: '!sources/api/*.{md,mdx}' separator: "," - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -269,10 +269,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js 24 - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 @@ -289,11 +289,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Source code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get changed unoptimized image files in sources id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: | sources/**/*.{png,jpg,jpeg,gif,bmp,tif,tiff,avif} diff --git a/.github/workflows/vale.yaml b/.github/workflows/vale.yaml index db51acfaf1..7142155f63 100644 --- a/.github/workflows/vale.yaml +++ b/.github/workflows/vale.yaml @@ -7,13 +7,13 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: files: '**/*.{md,mdx}' files_ignore: | @@ -29,7 +29,7 @@ jobs: workflows/**/*.{md,mdx} separator: ',' - - uses: errata-ai/vale-action@reviewdog + - uses: errata-ai/vale-action@{"message":"Not # reviewdog if: steps.changed-files.outputs.any_changed == 'true' with: files: ${{ steps.changed-files.outputs.all_changed_files }} From 42dc15a92d09e475b5f0ea3a908e6e901ae685fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:19:16 +0200 Subject: [PATCH 2/2] ci: pin branch-referenced actions to commit SHAs --- .github/workflows/vale.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vale.yaml b/.github/workflows/vale.yaml index 7142155f63..0deae19cfd 100644 --- a/.github/workflows/vale.yaml +++ b/.github/workflows/vale.yaml @@ -29,7 +29,7 @@ jobs: workflows/**/*.{md,mdx} separator: ',' - - uses: errata-ai/vale-action@{"message":"Not # reviewdog + - uses: errata-ai/vale-action@518a9136acc6e6668ce7c00d367051e0941e87ff # reviewdog if: steps.changed-files.outputs.any_changed == 'true' with: files: ${{ steps.changed-files.outputs.all_changed_files }}