From 0c87abbae4c740aa01e1a3f3a9cc0f571e1c8b85 Mon Sep 17 00:00:00 2001 From: Carlos Pereira Date: Thu, 27 Aug 2026 16:08:13 +0200 Subject: [PATCH] fix(security): Pin GitHub Actions to digests --- .../workflows/java-maven-build-push-container-gcr.yml | 10 +++++----- .../java-maven-skaffold-build-push-docker.yml | 8 ++++---- .github/workflows/java-maven-skaffold-build.yml | 6 +++--- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/java-maven-build-push-container-gcr.yml b/.github/workflows/java-maven-build-push-container-gcr.yml index 845c9c63..058bf628 100644 --- a/.github/workflows/java-maven-build-push-container-gcr.yml +++ b/.github/workflows/java-maven-build-push-container-gcr.yml @@ -28,26 +28,26 @@ jobs: # run: # working-directory: ${{ inputs.repositoryFolder }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 - name: Set up JDK ${{ inputs.javaVersion }} - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3 with: java-version: ${{ inputs.javaVersion }} distribution: "temurin" cache: "maven" - id: auth name: Authenticate to Google Cloud - uses: google-github-actions/auth@v1 + uses: google-github-actions/auth@3a3c4c57d294ef65efaaee4ff17b22fa88dd3c69 # v1 with: credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS_CICD_INSO_AKERBP }} - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v1.1.1 + uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b # v1.1.1 - name: Setup artifactory auth run: gcloud auth configure-docker europe-docker.pkg.dev # (1) - name: Build image with Skaffold - uses: hiberbee/github-action-skaffold@1.27.0 + uses: hiberbee/github-action-skaffold@e3f5dd5659610cb792c6cf32daaa797ea6d89842 # 1.27.0 with: skaffold-version: 2.1.0 working-directory: ${{ inputs.repositoryFolder }} diff --git a/.github/workflows/java-maven-skaffold-build-push-docker.yml b/.github/workflows/java-maven-skaffold-build-push-docker.yml index 062bd490..ea9f80a7 100644 --- a/.github/workflows/java-maven-skaffold-build-push-docker.yml +++ b/.github/workflows/java-maven-skaffold-build-push-docker.yml @@ -20,20 +20,20 @@ jobs: # run: # working-directory: ${{ inputs.repositoryFolder }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 - name: Set up JDK ${{ inputs.javaVersion }} - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3 with: java-version: ${{ inputs.javaVersion }} distribution: "temurin" cache: "maven" - name: Login to Docker Hub - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Build image with Skaffold - uses: hiberbee/github-action-skaffold@1.27.0 + uses: hiberbee/github-action-skaffold@e3f5dd5659610cb792c6cf32daaa797ea6d89842 # 1.27.0 with: skaffold-version: 2.1.0 working-directory: ${{ inputs.repositoryFolder }} diff --git a/.github/workflows/java-maven-skaffold-build.yml b/.github/workflows/java-maven-skaffold-build.yml index 528e1bc9..2321983c 100644 --- a/.github/workflows/java-maven-skaffold-build.yml +++ b/.github/workflows/java-maven-skaffold-build.yml @@ -17,15 +17,15 @@ jobs: build-skaffold: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 - name: Set up JDK ${{ inputs.javaVersion }} - uses: actions/setup-java@v3 + uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3 with: java-version: ${{ inputs.javaVersion }} distribution: "temurin" cache: "maven" - name: Build image with Skaffold - uses: hiberbee/github-action-skaffold@1.27.0 + uses: hiberbee/github-action-skaffold@e3f5dd5659610cb792c6cf32daaa797ea6d89842 # 1.27.0 with: skaffold-version: 2.1.0 working-directory: ${{ inputs.repositoryFolder }}