From 43fd2a7bfacece9166b3e1b1350aaba9a2edd6d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Thu, 20 Aug 2026 13:06:32 +0200 Subject: [PATCH] ci: pin third-party actions to commit SHAs Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs. --- .github/workflows/check.yml | 8 ++++---- .github/workflows/publish-to-npm.yaml | 8 ++++---- .github/workflows/release.yaml | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 9471f1c..9af2aa7 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -18,9 +18,9 @@ jobs: node-version: [20, 22, 24] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} - name: Install pnpm and dependencies @@ -35,9 +35,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js 24 - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 24 - name: Install pnpm and dependencies diff --git a/.github/workflows/publish-to-npm.yaml b/.github/workflows/publish-to-npm.yaml index 0daad36..4d08d7f 100644 --- a/.github/workflows/publish-to-npm.yaml +++ b/.github/workflows/publish-to-npm.yaml @@ -37,14 +37,14 @@ jobs: name: Publish to NPM (${{ inputs.dist-tag }}) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ inputs.ref }} token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} fetch-depth: 0 - name: Use Node.js 24 - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24 registry-url: 'https://registry.npmjs.org' @@ -54,7 +54,7 @@ jobs: - name: Publish to NPM (@latest) if: inputs.dist-tag == 'latest' - uses: nick-fields/retry@v3 + uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2 with: timeout_minutes: 10 max_attempts: 5 @@ -63,7 +63,7 @@ jobs: - name: Publish to NPM (@next) if: inputs.dist-tag == 'next' - uses: nick-fields/retry@v3 + uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2 with: timeout_minutes: 10 max_attempts: 5 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2565985..e87f68d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -29,10 +29,10 @@ jobs: node-version: [20, 22, 24] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node-version }} @@ -50,13 +50,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} fetch-depth: 0 - name: Use Node.js 24 - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24