Skip to content

Commit 728f3f1

Browse files
harshitasaoharshitasao
committed
fix: fixed the token-permission and pinned dependencies
Signed-off-by: harshitasao <harshitasao@gmail.com>
1 parent d68e707 commit 728f3f1

13 files changed

+113
-93
lines changed

‎.github/workflows/check-size.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2020
with:
2121
fetch-depth: 1
2222

2323
- name: Check large files
24-
uses: actionsdesk/lfs-warning@v3.2
24+
uses: actionsdesk/lfs-warning@e5f9a4c21f4bee104db7c0f23954dde59e5df909 # v3.2
2525
env:
2626
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2727
with:

‎.github/workflows/ci.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,22 @@ on:
1010
schedule:
1111
- cron: '0 4 * * *'
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
test:
1518
name: Test
1619
timeout-minutes: 60
1720
runs-on: ubuntu-latest
1821
steps:
1922
- name: Checkout code
20-
uses: actions/checkout@v4
23+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2124
with:
2225
submodules: recursive
2326

2427
- name: Install Go
25-
uses: actions/setup-go@v5
28+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
2629
with:
2730
go-version-file: go.mod
2831

@@ -41,7 +44,7 @@ jobs:
4144
sudo make test-coverage
4245
4346
- name: Upload coverage to Codecov
44-
uses: codecov/codecov-action@v4
47+
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
4548
with:
4649
token: ${{ secrets.CODECOV_TOKEN }}
4750
files: ./coverage.txt
@@ -54,31 +57,31 @@ jobs:
5457
needs: [test]
5558
steps:
5659
- name: Check out code
57-
uses: actions/checkout@v4
60+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
5861
with:
5962
submodules: recursive
6063

6164
- name: Setup Go
62-
uses: actions/setup-go@v5
65+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
6366
with:
6467
go-version-file: go.mod
6568

6669
- name: Setup QEMU
67-
uses: docker/setup-qemu-action@v3
70+
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
6871

6972
- name: Setup Docker Buildx
70-
uses: docker/setup-buildx-action@v3
73+
uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
7174

7275
- name: Cache Docker layers
73-
uses: actions/cache@v4
76+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
7477
with:
7578
path: /tmp/.buildx-cache
7679
key: ${{ runner.os }}-buildx-${{ github.sha }}
7780
restore-keys: |
7881
${{ runner.os }}-buildx-
7982
8083
- name: Build Scheduler Image
81-
uses: docker/build-push-action@v6
84+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
8285
with:
8386
context: .
8487
file: build/images/scheduler/Dockerfile
@@ -88,7 +91,7 @@ jobs:
8891
cache-to: type=local,dest=/tmp/.buildx-cache-new
8992

9093
- name: Build Manager Image
91-
uses: docker/build-push-action@v6
94+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
9295
with:
9396
context: .
9497
file: build/images/manager/Dockerfile
@@ -98,7 +101,7 @@ jobs:
98101
cache-to: type=local,dest=/tmp/.buildx-cache-new
99102

100103
- name: Build Dfdaemon Image
101-
uses: docker/build-push-action@v6
104+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
102105
with:
103106
context: .
104107
file: build/images/dfdaemon/Dockerfile

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ on:
1010
schedule:
1111
- cron: '0 4 * * *'
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
analyze:
1518
name: Analyze
@@ -22,15 +25,15 @@ jobs:
2225

2326
steps:
2427
- name: Checkout repository
25-
uses: actions/checkout@v4
28+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2629

2730
- name: Initialize CodeQL
28-
uses: github/codeql-action/init@v3
31+
uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
2932
with:
3033
languages: ${{ matrix.language }}
3134

3235
- name: Autobuild
33-
uses: github/codeql-action/autobuild@v3
36+
uses: github/codeql-action/autobuild@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
3437

3538
- name: Perform CodeQL Analysis
36-
uses: github/codeql-action/analyze@v3
39+
uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2

‎.github/workflows/compatibility-e2e-v1.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545
chart-name: seedPeer
4646
steps:
4747
- name: Free Disk Space (Ubuntu)
48-
uses: jlumbroso/free-disk-space@main
48+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
4949
with:
5050
tool-cache: false
5151
android: true
@@ -56,12 +56,12 @@ jobs:
5656
swap-storage: true
5757

5858
- name: Checkout code
59-
uses: actions/checkout@v4
59+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
6060
with:
6161
submodules: recursive
6262

6363
- name: Install Go
64-
uses: actions/setup-go@v5
64+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
6565
with:
6666
go-version-file: go.mod
6767

@@ -72,21 +72,21 @@ jobs:
7272
go mod vendor
7373
7474
- name: Setup buildx
75-
uses: docker/setup-buildx-action@v3
75+
uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
7676
id: buildx
7777
with:
7878
install: true
7979

8080
- name: Cache Docker layers
81-
uses: actions/cache@v4
81+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
8282
with:
8383
path: /tmp/.buildx-cache
8484
key: ${{ runner.os }}-buildx-${{ github.sha }}
8585
restore-keys: |
8686
${{ runner.os }}-buildx-
8787
8888
- name: Build Scheduler Image
89-
uses: docker/build-push-action@v6
89+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
9090
with:
9191
context: .
9292
file: build/images/scheduler/Dockerfile
@@ -97,7 +97,7 @@ jobs:
9797
cache-to: type=local,dest=/tmp/.buildx-cache-new
9898

9999
- name: Build Manager Image
100-
uses: docker/build-push-action@v6
100+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
101101
with:
102102
context: .
103103
file: build/images/manager/Dockerfile
@@ -108,7 +108,7 @@ jobs:
108108
cache-to: type=local,dest=/tmp/.buildx-cache-new
109109

110110
- name: Build Dfdaemon Image
111-
uses: docker/build-push-action@v6
111+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
112112
with:
113113
context: .
114114
file: build/images/dfdaemon/Dockerfile
@@ -119,7 +119,7 @@ jobs:
119119
cache-to: type=local,dest=/tmp/.buildx-cache-new
120120

121121
- name: Build No Content Length Image
122-
uses: docker/build-push-action@v6
122+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
123123
with:
124124
context: test/tools/no-content-length/
125125
file: test/tools/no-content-length/Dockerfile
@@ -130,7 +130,7 @@ jobs:
130130
cache-to: type=local,dest=/tmp/.buildx-cache-new
131131

132132
- name: Setup Kind
133-
uses: helm/kind-action@v1.10.0
133+
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
134134
with:
135135
version: ${{ env.KIND_VERSION }}
136136
config: ${{ env.KIND_CONFIG_PATH }}
@@ -171,14 +171,14 @@ jobs:
171171
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
172172
173173
- name: Upload coverage to Codecov
174-
uses: codecov/codecov-action@v4
174+
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
175175
with:
176176
token: ${{ secrets.CODECOV_TOKEN }}
177177
files: ./coverage.txt
178178
flags: ${{ matrix }}-compatibility-e2etests
179179

180180
- name: Upload Logs
181-
uses: actions/upload-artifact@v4
181+
uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
182182
if: always()
183183
with:
184184
name: ${{ matrix.module }}-compatibility-e2e-tests-logs

‎.github/workflows/compatibility-e2e-v2.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545

4646
steps:
4747
- name: Free Disk Space (Ubuntu)
48-
uses: jlumbroso/free-disk-space@main
48+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
4949
with:
5050
tool-cache: false
5151
android: true
@@ -56,13 +56,13 @@ jobs:
5656
swap-storage: true
5757

5858
- name: Checkout code
59-
uses: actions/checkout@v4
59+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
6060
with:
6161
submodules: recursive
6262
fetch-depth: 0
6363

6464
- name: Install Go
65-
uses: actions/setup-go@v5
65+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
6666
with:
6767
go-version-file: go.mod
6868

@@ -72,13 +72,13 @@ jobs:
7272
mkdir -p /tmp/artifact
7373
7474
- name: Setup buildx
75-
uses: docker/setup-buildx-action@v3
75+
uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
7676
id: buildx
7777
with:
7878
install: true
7979

8080
- name: Cache Docker layers
81-
uses: actions/cache@v4
81+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
8282
with:
8383
path: /tmp/.buildx-cache
8484
key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -95,7 +95,7 @@ jobs:
9595
docker tag dragonflyoss/dfinit:$CLIENT_TAG dragonflyoss/dfinit:latest
9696
9797
- name: Build Scheduler Image
98-
uses: docker/build-push-action@v6
98+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
9999
with:
100100
context: .
101101
file: build/images/scheduler/Dockerfile
@@ -106,7 +106,7 @@ jobs:
106106
cache-to: type=local,dest=/tmp/.buildx-cache-new
107107

108108
- name: Build Manager Image
109-
uses: docker/build-push-action@v6
109+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
110110
with:
111111
context: .
112112
file: build/images/manager/Dockerfile
@@ -117,7 +117,7 @@ jobs:
117117
cache-to: type=local,dest=/tmp/.buildx-cache-new
118118

119119
- name: Setup Kind
120-
uses: helm/kind-action@v1.10.0
120+
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
121121
with:
122122
version: ${{ env.KIND_VERSION }}
123123
config: ${{ env.KIND_CONFIG_PATH }}
@@ -147,14 +147,14 @@ jobs:
147147
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
148148
149149
- name: Upload coverage to Codecov
150-
uses: codecov/codecov-action@v4
150+
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
151151
with:
152152
token: ${{ secrets.CODECOV_TOKEN }}
153153
files: ./coverage.txt
154154
flags: e2etests
155155

156156
- name: Upload Logs
157-
uses: actions/upload-artifact@v4
157+
uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
158158
if: always()
159159
with:
160160
name: ${{ matrix.module }}-e2e-tests-logs

‎.github/workflows/cr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: ChatGPT Code Review
18-
uses: anc95/ChatGPT-CodeReview@main
18+
uses: anc95/ChatGPT-CodeReview@8c74515780ea4f00def44ce7c17cfe6b5500602a # main
1919
env:
2020
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2121
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

‎.github/workflows/docker.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
tags:
88
- v*
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
push_image_to_registry:
1215
name: Push Image
@@ -26,7 +29,7 @@ jobs:
2629
timeout-minutes: 120
2730
steps:
2831
- name: Check out code
29-
uses: actions/checkout@v4
32+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
3033
with:
3134
submodules: recursive
3235

@@ -50,35 +53,35 @@ jobs:
5053
echo IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
5154
5255
- name: Setup QEMU
53-
uses: docker/setup-qemu-action@v3
56+
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
5457

5558
- name: Setup Docker Buildx
56-
uses: docker/setup-buildx-action@v3
59+
uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
5760

5861
- name: Cache Docker layers
59-
uses: actions/cache@v4
62+
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
6063
with:
6164
path: /tmp/.buildx-cache
6265
key: ${{ runner.os }}-buildx-${{ github.sha }}
6366
restore-keys: |
6467
${{ runner.os }}-buildx-
6568
6669
- name: Login Docker Hub
67-
uses: docker/login-action@v3
70+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
6871
with:
6972
registry: docker.io
7073
username: ${{ secrets.DOCKER_USERNAME }}
7174
password: ${{ secrets.DOCKER_PASSWORD }}
7275

7376
- name: Login to GitHub Container Registry
74-
uses: docker/login-action@v3
77+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
7578
with:
7679
registry: ghcr.io
7780
username: ${{ github.repository_owner }}
7881
password: ${{ secrets.GITHUB_TOKEN }}
7982

8083
- name: Push to Registry
81-
uses: docker/build-push-action@v6
84+
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
8285
with:
8386
context: .
8487
platforms: ${{ matrix.platforms }}

0 commit comments

Comments
 (0)