From ff9ce0fea8399b46580a1e521f4065b000d9baf5 Mon Sep 17 00:00:00 2001 From: jogerj <30559735+jogerj@users.noreply.github.com> Date: Sat, 5 Sep 2026 01:58:08 +0200 Subject: [PATCH] ci: pin GitHub Actions to commit SHAs and add Dependabot Pin every action reference to the full commit SHA that its current tag already resolves to, with the version kept in a trailing comment. No action changes version as a result of this commit -- the pins are byte-equivalent to what the floating tags point at today. Version bumps are left to Dependabot so they arrive as reviewable PRs. Add .github/dependabot.yml for the github-actions ecosystem: weekly on Monday, minor/patch grouped into a single PR (majors always get their own), "ci" commit prefix. tibdex/github-app-token is ignored -- 7c776462 switched deploy.yml to actions/create-github-app-token@v2 and 5c2520c4 reverted it three days later, so that pin is deliberate. --- .github/dependabot.yml | 16 ++++++++++++++++ .github/workflows/check.yml | 6 +++--- .github/workflows/deploy.yml | 10 +++++----- .github/workflows/update.yml | 10 +++++----- .github/workflows/validate_issue.yml | 6 +++--- .github/workflows/validate_label.yml | 4 ++-- 6 files changed, 34 insertions(+), 18 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..d47e57c290 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + groups: + actions-minor-patch: + update-types: ["minor", "patch"] + commit-message: + prefix: "ci" + ignore: + # Deliberately held at v1.8.2: 7c776462 switched deploy.yml to + # actions/create-github-app-token@v2, 5c2520c4 reverted it three days later. + - dependency-name: "tibdex/github-app-token" diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index ab080487a5..bae03f0f22 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -9,8 +9,8 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22.12.0' cache: 'npm' @@ -29,7 +29,7 @@ jobs: if: steps.files.outputs.any_changed == 'true' run: npm install - name: check if files are crlf - uses: kforeverisback/check-crlf-extended@v2 + uses: kforeverisback/check-crlf-extended@bb2dea99a7da756525ede285d33811e5552d3ceb # v2 continue-on-error: false with: directory: ./data diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 8b8d9c993e..13aa7b01e7 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -10,21 +10,21 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: tibdex/github-app-token@v1.8.2 + - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2 if: ${{ !env.ACT }} id: create-app-token with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 if: ${{ env.ACT }} with: token: ${{ github.token }} - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 if: ${{ !env.ACT }} with: token: ${{ steps.create-app-token.outputs.token }} - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22.12.0' cache: 'npm' @@ -32,7 +32,7 @@ jobs: run: npm install - name: export data to ./api run: npm run db:export - - uses: JamesIves/github-pages-deploy-action@4.1.1 + - uses: JamesIves/github-pages-deploy-action@164583b9e44b4fc5910e78feb607ea7c98d3c7b9 # 4.1.1 if: ${{ !env.ACT && github.ref == 'refs/heads/master' }} with: repository-name: iptv-org/api diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml index af3a04b822..089acc81f4 100644 --- a/.github/workflows/update.yml +++ b/.github/workflows/update.yml @@ -9,21 +9,21 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/create-github-app-token@v2 + - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 if: ${{ !env.ACT }} id: create-app-token with: app-id: ${{ secrets.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 if: ${{ env.ACT }} with: token: ${{ github.token }} - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 if: ${{ !env.ACT }} with: token: ${{ steps.create-app-token.outputs.token }} - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22.12.0' cache: 'npm' @@ -37,7 +37,7 @@ jobs: - name: validate changes run: npm run db:validate - name: check if files are crlf - uses: kforeverisback/check-crlf-extended@v2 + uses: kforeverisback/check-crlf-extended@bb2dea99a7da756525ede285d33811e5552d3ceb # v2 continue-on-error: false with: directory: ./data diff --git a/.github/workflows/validate_issue.yml b/.github/workflows/validate_issue.yml index be9abb40fa..05e05e5e47 100644 --- a/.github/workflows/validate_issue.yml +++ b/.github/workflows/validate_issue.yml @@ -17,9 +17,9 @@ jobs: contains(join(github.event.issue.labels.*.name, ','), 'blocklist:') steps: - name: Checkout repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/create-github-app-token@v2 + - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 if: ${{ !env.ACT }} id: create-app-token with: @@ -27,7 +27,7 @@ jobs: private-key: ${{ secrets.APP_PRIVATE_KEY }} - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 cache: 'npm' diff --git a/.github/workflows/validate_label.yml b/.github/workflows/validate_label.yml index 853242139e..917701c872 100644 --- a/.github/workflows/validate_label.yml +++ b/.github/workflows/validate_label.yml @@ -12,9 +12,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/create-github-app-token@v2 + - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 if: ${{ !env.ACT }} id: create-app-token with: