From 031539eaf4eb146bc62eb302c4c98b3444b01349 Mon Sep 17 00:00:00 2001 From: Fred Bricon Date: Tue, 24 Jan 2023 19:08:01 +0100 Subject: [PATCH 1/2] Pin 3rd-party actions to SHA1 in .github/workflows/ci-workflow.yml --- .github/workflows/ci-workflow.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml index e7e3f94e..2236f02b 100644 --- a/.github/workflows/ci-workflow.yml +++ b/.github/workflows/ci-workflow.yml @@ -43,11 +43,11 @@ jobs: # Run tests - name: Run Test - uses: GabrielBB/xvfb-action@v1.0 + uses: GabrielBB/xvfb-action@fe2609f8182a9ed5aee7d53ff3ed04098a904df2 #v1.0 with: run: npm test --silent # Upload coverage to codecov.io - name: Codecov - uses: codecov/codecov-action@v1.0.12 + uses: codecov/codecov-action@07127fde53bc3ccd346d47ab2f14c390161ad108 #v1.0.12 if: runner.os == 'Linux' From 4e7fd6c252314cef8ab70d739355d1f917b22016 Mon Sep 17 00:00:00 2001 From: Fred Bricon Date: Tue, 24 Jan 2023 19:08:03 +0100 Subject: [PATCH 2/2] Pin 3rd-party actions to SHA1 in .github/workflows/codeql-analysis.yml --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 16961092..8c22b7f4 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -43,7 +43,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@231aa2c8a89117b126725a0e11897209b7118144 #v1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -54,7 +54,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@231aa2c8a89117b126725a0e11897209b7118144 #v1 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -68,4 +68,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@231aa2c8a89117b126725a0e11897209b7118144 #v1