tools: use hashes instead of tags for external actions (#43284) · nodejs/node@f598fe1 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 633
• Pull requests 755
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit f598fe1

Browse filesBrowse the repository at this point in the historyBrowse files

aduh95

authored and

danielleadams

committed

tools: use hashes instead of tags for external actions (#43284)

Using tags is a security risk, as they can be updated to point to anything else. Refs: nodejs/corepack#117 (comment) PR-URL: #43284 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

1 parent f3188c1 commit f598fe1
Copy full SHA for f598fe1

7 files changed

+17-7Lines changed: 17 additions & 7 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• .github/workflows
  • authors.yml
  • find-inactive-collaborators.yml
  • find-inactive-tsc.yml
  • license-builder.yml
  • linters.yml
  • notify-force-push.yml
  • tools.yml

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎.github/workflows/authors.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/authors.yml

+3-1Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -16,7 +16,9 @@ jobs:
16	16	fetch-depth: '0' # This is required to actually get all the authors
17	17	persist-credentials: false
18	18	- run: tools/update-authors.mjs # Run the AUTHORS tool
19		- - uses: gr2m/create-or-update-pull-request-action@v1 # Create a PR or update the Action's existing PR
	19	+ - uses: gr2m/create-or-update-pull-request-action@466b1b84c3291c6c69bc56377a6de54a1f4a297c
	20	+ # Creates a PR or update the Action's existing PR, or
	21	+ # no-op if the base branch is already up-to-date.
20	22	env:
21	23	GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
22	24	with:

Collapse file

‎.github/workflows/find-inactive-collaborators.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/find-inactive-collaborators.yml

+3-1Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -30,7 +30,9 @@ jobs:
30	30	run: tools/find-inactive-collaborators.mjs
31	31
32	32	- name: Open pull request
33		- uses: gr2m/create-or-update-pull-request-action@v1
	33	+ - uses: gr2m/create-or-update-pull-request-action@466b1b84c3291c6c69bc56377a6de54a1f4a297c
	34	+ # Creates a PR or update the Action's existing PR, or
	35	+ # no-op if the base branch is already up-to-date.
34	36	env:
35	37	GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
36	38	with:

Collapse file

‎.github/workflows/find-inactive-tsc.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/find-inactive-tsc.yml

+3-1Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -39,7 +39,9 @@ jobs:
39	39	run: tools/find-inactive-tsc.mjs >> $GITHUB_ENV
40	40
41	41	- name: Open pull request
42		- uses: gr2m/create-or-update-pull-request-action@v1
	42	+ - uses: gr2m/create-or-update-pull-request-action@466b1b84c3291c6c69bc56377a6de54a1f4a297c
	43	+ # Creates a PR or update the Action's existing PR, or
	44	+ # no-op if the base branch is already up-to-date.
43	45	env:
44	46	GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
45	47	with:

Collapse file

‎.github/workflows/license-builder.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/license-builder.yml

+3-1Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -15,7 +15,9 @@ jobs:
15	15	with:
16	16	persist-credentials: false
17	17	- run: ./tools/license-builder.sh # Run the license builder tool
18		- - uses: gr2m/create-or-update-pull-request-action@v1.x # Create a PR or update the Action's existing PR
	18	+ - uses: gr2m/create-or-update-pull-request-action@466b1b84c3291c6c69bc56377a6de54a1f4a297c
	19	+ # Creates a PR or update the Action's existing PR, or
	20	+ # no-op if the base branch is already up-to-date.
19	21	env:
20	22	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
21	23	with:

Collapse file

‎.github/workflows/linters.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/linters.yml

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -164,7 +164,7 @@ jobs:
164	164	- uses: actions/checkout@v3
165	165	with:
166	166	persist-credentials: false
167		- - uses: mszostok/codeowners-validator@v0.6.0
	167	+ - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f
168	168	with:
169	169	checks: files,duppatterns
170	170	lint-pr-url:

Collapse file

‎.github/workflows/notify-force-push.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/notify-force-push.yml

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -12,7 +12,7 @@ jobs:
12	12	runs-on: ubuntu-latest
13	13	steps:
14	14	- name: Slack Notification
15		- uses: rtCamp/action-slack-notify@master
	15	+ uses: rtCamp/action-slack-notify@12e36fc18b0689399306c2e0b3e0f2978b7f1ee7
16	16	env:
17	17	SLACK_COLOR: '#DE512A'
18	18	SLACK_ICON: https://github.com/nodejs.png?size=48

Collapse file

‎.github/workflows/tools.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/tools.yml

+3-1Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -80,7 +80,9 @@ jobs:
80	80	with:
81	81	persist-credentials: false
82	82	- run: ${{ matrix.run }}
83		- - uses: gr2m/create-or-update-pull-request-action@v1 # Create a PR or update the Action's existing PR
	83	+ - uses: gr2m/create-or-update-pull-request-action@466b1b84c3291c6c69bc56377a6de54a1f4a297c
	84	+ # Creates a PR or update the Action's existing PR, or
	85	+ # no-op if the base branch is already up-to-date.
84	86	env:
85	87	GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
86	88	with:

0 commit comments

Comments

0 (0)