From 8c65a3072cc1a1549dda0a22bd5615451f0931f9 Mon Sep 17 00:00:00 2001 From: "Prekshith DJ (Persistent Systems Limited)" Date: Wed, 26 Aug 2026 17:22:58 +0530 Subject: [PATCH] pin GitHub Actions to commit SHAs --- .github/workflows/azd-template-validation.yml | 4 ++-- .github/workflows/azure-dev.yml | 6 +++--- .github/workflows/broken-links-checker.yml | 6 +++--- .github/workflows/build-docker.yml | 8 ++++---- .github/workflows/deploy.yml | 6 +++--- .github/workflows/job-cleanup-deployment.yml | 2 +- .github/workflows/job-deploy-linux.yml | 6 +++--- .github/workflows/job-deploy-windows.yml | 6 +++--- .github/workflows/job-deploy.yml | 4 ++-- .github/workflows/job-docker-build.yml | 10 +++++----- .github/workflows/pr-title-checker.yml | 2 +- .github/workflows/pylint.yml | 4 ++-- .../workflows/scheduled-Dependabot-PRs-Auto-Merge.yml | 2 +- .github/workflows/stale-bot.yml | 6 +++--- .github/workflows/telemetry-template-check.yml | 2 +- .github/workflows/test-automation-v2.yml | 8 ++++---- .github/workflows/test-automation.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- .github/workflows/validate-bicep-params.yml | 6 +++--- 19 files changed, 50 insertions(+), 50 deletions(-) diff --git a/.github/workflows/azd-template-validation.yml b/.github/workflows/azd-template-validation.yml index f623038c..6faac798 100644 --- a/.github/workflows/azd-template-validation.yml +++ b/.github/workflows/azd-template-validation.yml @@ -17,14 +17,14 @@ jobs: environment: production steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set timestamp run: echo "HHMM=$(date -u +'%H%M')" >> $GITHUB_ENV - name: Validate Azure Template id: validation - uses: microsoft/template-validation-action@v0.4.4 + uses: microsoft/template-validation-action@bae4895d0a8abd4f0d5aad68ae8647b3027f4c91 # v0.4.4 with: validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }} validateTests: ${{ vars.TEMPLATE_VALIDATE_TESTS }} diff --git a/.github/workflows/azure-dev.yml b/.github/workflows/azure-dev.yml index 5c11457e..ef4efc9f 100644 --- a/.github/workflows/azure-dev.yml +++ b/.github/workflows/azure-dev.yml @@ -22,7 +22,7 @@ jobs: AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }} steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set timestamp and env name run: | @@ -30,10 +30,10 @@ jobs: echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml index 05d502a8..1701ec3a 100644 --- a/.github/workflows/broken-links-checker.yml +++ b/.github/workflows/broken-links-checker.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 @@ -34,7 +34,7 @@ jobs: - name: Check Broken Links in Changed Markdown Files id: lychee-check-pr if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true' - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --no-progress --exclude ^https?:// @@ -47,7 +47,7 @@ jobs: - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger) id: lychee-check-manual if: github.event_name == 'workflow_dispatch' - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --no-progress --exclude ^https?:// diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 5ddba371..de29a9c4 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -23,11 +23,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure if: ${{ inputs.push }} - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -38,7 +38,7 @@ jobs: run: az acr login --name ${{ inputs.registry }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Get current date id: date @@ -61,7 +61,7 @@ jobs: - name: Build Docker Image and optionally push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: . file: ${{ inputs.dockerfile }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 009c2219..16d22ad0 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -30,10 +30,10 @@ jobs: WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -190,7 +190,7 @@ jobs: steps: - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-cleanup-deployment.yml b/.github/workflows/job-cleanup-deployment.yml index cd5a35af..43e3d91f 100644 --- a/.github/workflows/job-cleanup-deployment.yml +++ b/.github/workflows/job-cleanup-deployment.yml @@ -56,7 +56,7 @@ jobs: steps: - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-linux.yml b/.github/workflows/job-deploy-linux.yml index 56c620fb..c0eef4c4 100644 --- a/.github/workflows/job-deploy-linux.yml +++ b/.github/workflows/job-deploy-linux.yml @@ -53,7 +53,7 @@ jobs: WEBAPP_URL: ${{ steps.get_output_linux.outputs.WEBAPP_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate Workflow Input Parameters shell: bash @@ -217,10 +217,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-windows.yml b/.github/workflows/job-deploy-windows.yml index 7601bbd9..dbab576e 100644 --- a/.github/workflows/job-deploy-windows.yml +++ b/.github/workflows/job-deploy-windows.yml @@ -53,7 +53,7 @@ jobs: WEBAPP_URL: ${{ steps.get_output_windows.outputs.WEBAPP_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate Workflow Input Parameters shell: bash @@ -217,10 +217,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy.yml b/.github/workflows/job-deploy.yml index 08446e63..8de1517a 100644 --- a/.github/workflows/job-deploy.yml +++ b/.github/workflows/job-deploy.yml @@ -274,10 +274,10 @@ jobs: echo "Final EXP status: $EXP_ENABLED" - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-docker-build.yml b/.github/workflows/job-docker-build.yml index ec17062c..d4f5885a 100644 --- a/.github/workflows/job-docker-build.yml +++ b/.github/workflows/job-docker-build.yml @@ -22,7 +22,7 @@ jobs: IMAGE_TAG: ${{ steps.generate_docker_tag.outputs.IMAGE_TAG }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Generate Unique Docker Image Tag id: generate_docker_tag @@ -39,10 +39,10 @@ jobs: echo "Generated unique Docker tag: $UNIQUE_TAG" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -56,7 +56,7 @@ jobs: az acr login --name "$ACR_NAME" - name: Build and Push Cod Mod backend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: @@ -68,7 +68,7 @@ jobs: ${{ vars.ACR_TEST_LOGIN_SERVER }}/cmsabackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }} - name: Build and Push Cod Mod frontend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml index 842cf679..820363fd 100644 --- a/.github/workflows/pr-title-checker.yml +++ b/.github/workflows/pr-title-checker.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'merge_group' }} steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml index f9c4d858..a4e8e512 100644 --- a/.github/workflows/pylint.yml +++ b/.github/workflows/pylint.yml @@ -32,11 +32,11 @@ jobs: steps: # Step 1: Checkout code - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # Step 2: Set up Python environment - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml b/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml index e2950753..4bb09636 100644 --- a/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml +++ b/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Install GitHub CLI run: | diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml index ea2d288f..9abfe858 100644 --- a/.github/workflows/stale-bot.yml +++ b/.github/workflows/stale-bot.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Mark Stale Issues and PRs - uses: actions/stale@v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: stale-issue-message: "This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or it will be closed in 30 days." stale-pr-message: "This PR is stale because it has been open 180 days with no activity. Please update or it will be closed in 30 days." @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 # Fetch full history for accurate branch checks - name: Fetch All Branches @@ -75,7 +75,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload CSV Report of Inactive Branches - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: merged-branches-report path: merged_branches_report.csv diff --git a/.github/workflows/telemetry-template-check.yml b/.github/workflows/telemetry-template-check.yml index 75e827c7..27973d3b 100644 --- a/.github/workflows/telemetry-template-check.yml +++ b/.github/workflows/telemetry-template-check.yml @@ -14,7 +14,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Check for required metadata template line run: | diff --git a/.github/workflows/test-automation-v2.yml b/.github/workflows/test-automation-v2.yml index 653f81fb..118db920 100644 --- a/.github/workflows/test-automation-v2.yml +++ b/.github/workflows/test-automation-v2.yml @@ -34,15 +34,15 @@ jobs: TEST_REPORT_URL: ${{ steps.upload_report.outputs.artifact-url }} steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.13' - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -136,7 +136,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ !cancelled() }} with: name: test-report diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml index 28aa7ce6..235f9b5e 100644 --- a/.github/workflows/test-automation.yml +++ b/.github/workflows/test-automation.yml @@ -21,15 +21,15 @@ jobs: environment: production steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.13' - name: Azure CLI Login - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -82,7 +82,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ !cancelled() }} with: name: test-report diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3b0002df..4c891a4b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -81,10 +81,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.11' diff --git a/.github/workflows/validate-bicep-params.yml b/.github/workflows/validate-bicep-params.yml index 551e0064..c10274aa 100644 --- a/.github/workflows/validate-bicep-params.yml +++ b/.github/workflows/validate-bicep-params.yml @@ -23,10 +23,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.11' @@ -62,7 +62,7 @@ jobs: - name: Upload validation results if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: bicep-validation-results path: |