From 33f0928c55054d61d7671ab272cb8ac28ad16098 Mon Sep 17 00:00:00 2001 From: Ed Morley <501702+edmorley@users.noreply.github.com> Date: Mon, 17 Mar 2025 11:18:45 +0000 Subject: [PATCH] Pin SHA of third-party GitHub Actions The full-version Git tags used by Actions are mutable (as seen in recent events in the wider GitHub Actions community), so pinning third-party Actions to a SHA is recommended: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions The version tag has been added after the pin as a comment (as a readability aid) in a format that Dependabot will keep up to date: https://github.com/dependabot/dependabot-core/issues/4691 I've also enabled Dependabot grouping for GitHub Actions updates to reduce PR noise. GUS-W-18051077. --- .github/dependabot.yml | 5 +++++ .github/workflows/ci.yml | 8 ++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6a8f51e..ef5f04e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,3 +21,8 @@ updates: - "dependencies" - "github actions" - "skip changelog" + groups: + github-actions: + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f2d1963..90f3ebd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - name: Update Rust toolchain run: rustup update - name: Rust Cache - uses: Swatinem/rust-cache@v2.7.7 + uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7 - name: Clippy run: cargo clippy --all-targets --locked -- --deny warnings - name: rustfmt @@ -36,7 +36,7 @@ jobs: - name: Update Rust toolchain run: rustup update - name: Rust Cache - uses: Swatinem/rust-cache@v2.7.7 + uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7 - name: Run unit tests run: cargo test --locked @@ -52,9 +52,9 @@ jobs: - name: Install Rust linux-musl target run: rustup target add x86_64-unknown-linux-musl - name: Rust Cache - uses: Swatinem/rust-cache@v2.7.7 + uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7 - name: Install Pack CLI - uses: buildpacks/github-actions/setup-pack@v5.8.8 + uses: buildpacks/github-actions/setup-pack@0f05ba41fb74d56ab4cb27485f538a8d65b4122e # v5.8.9 - name: Run integration tests # Runs only tests annotated with the `ignore` attribute (which in this repo, are the integration tests). run: cargo test --locked -- --ignored