From 1fc45f15d87adb836dff6b7b1bbea84b39a95f3a Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Wed, 27 May 2026 14:26:47 +0200 Subject: [PATCH 1/2] Pin reusable workflow actions to full commit SHAs (#3397) * Pin reusable workflow actions to full commit SHAs datadog-api-spec enforces a policy requiring all actions to be pinned to full commit SHAs; tag references like @v3/@v4 are rejected at job setup, causing all test jobs to fail. * Pin post-status-check action in test.yml to full commit SHA Co-Authored-By: Claude Sonnet 4.6 --------- Co-authored-by: Claude Sonnet 4.6 --- .github/workflows/reusable-examples.yml | 4 ++-- .github/workflows/reusable-integration-test.yml | 10 +++++----- .github/workflows/reusable-pre-commit.yml | 6 +++--- .github/workflows/reusable-ruby-test.yml | 4 ++-- .github/workflows/test.yml | 2 +- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/reusable-examples.yml b/.github/workflows/reusable-examples.yml index 06583ec96f16..b8605a3dbb3a 100644 --- a/.github/workflows/reusable-examples.yml +++ b/.github/workflows/reusable-examples.yml @@ -25,12 +25,12 @@ jobs: env: DD_PROFILING_NO_EXTENSION: true steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-ruby ref: ${{ inputs.target-branch || github.ref }} - name: Set up Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0 with: ruby-version: "2.7" bundler-cache: true diff --git a/.github/workflows/reusable-integration-test.yml b/.github/workflows/reusable-integration-test.yml index 8def622fdecf..33abfa194518 100644 --- a/.github/workflows/reusable-integration-test.yml +++ b/.github/workflows/reusable-integration-test.yml @@ -94,13 +94,13 @@ jobs: scope: DataDog/datadog-api-spec policy: datadog-api-client-ruby.reusable-integration-test.post-status - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-ruby ref: ${{ inputs.target-branch || github.ref }} - name: Post pending status check if: github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call') - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: ${{ inputs.target-repo || 'datadog-api-spec' }} @@ -111,7 +111,7 @@ jobs: sudo apt-get -y install zstd echo "ZSTANDARD_LIBRARY=$(find /usr/lib -iname libzstd.so.1)" >> $GITHUB_ENV - name: Set up Ruby 3.2 - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0 with: ruby-version: "3.2" bundler-cache: true @@ -134,7 +134,7 @@ jobs: SLEEP_AFTER_REQUEST: ${{ secrets.SLEEP_AFTER_REQUEST || vars.SLEEP_AFTER_REQUEST }} - name: Post failure status check if: failure() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call') - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: ${{ inputs.target-repo || 'datadog-api-spec' }} @@ -142,7 +142,7 @@ jobs: context: ${{ inputs.status-context || 'integration' }} - name: Post success status check if: "!failure() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call')" - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: ${{ inputs.target-repo || 'datadog-api-spec' }} diff --git a/.github/workflows/reusable-pre-commit.yml b/.github/workflows/reusable-pre-commit.yml index 9f82a77f5409..b9af4c172ada 100644 --- a/.github/workflows/reusable-pre-commit.yml +++ b/.github/workflows/reusable-pre-commit.yml @@ -32,20 +32,20 @@ jobs: with: scope: DataDog/datadog-api-client-ruby policy: self.github.pre-commit.pull-requests - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 repository: DataDog/datadog-api-client-ruby ref: ${{ inputs.target-branch || github.event.pull_request.head.sha || github.ref }} token: ${{ inputs.enable-commit-changes && steps.get_token.outputs.token || github.token }} - - uses: actions/setup-python@v4 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.11' - name: Install pre-commit run: python -m pip install pre-commit - name: set PY run: echo "PY=$(python -c 'import platform;print(platform.python_version())')" >> $GITHUB_ENV - - uses: actions/cache@v3 + - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ~/.cache/pre-commit key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }} diff --git a/.github/workflows/reusable-ruby-test.yml b/.github/workflows/reusable-ruby-test.yml index 0e9a0b557035..be95f5eb0b47 100644 --- a/.github/workflows/reusable-ruby-test.yml +++ b/.github/workflows/reusable-ruby-test.yml @@ -46,12 +46,12 @@ jobs: DD_ENV: prod DD_API_KEY: ${{ secrets.DD_API_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-ruby ref: ${{ inputs.target-branch || github.ref }} - name: Set up Ruby ${{ matrix.ruby-version }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0 with: ruby-version: ${{ matrix.ruby-version }} bundler-cache: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 1d0ed308fac0..dbddd602155f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -75,7 +75,7 @@ jobs: scope: DataDog/datadog-api-spec policy: datadog-api-client-ruby.test.post-status - name: Post status check - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: datadog-api-spec From 32ed184e7d8bbe87d3d7679c22638331d7ae5dd5 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Wed, 27 May 2026 17:40:28 +0200 Subject: [PATCH 2/2] Pin all remaining workflow actions to full commit SHAs (#3398) Co-authored-by: Claude Sonnet 4.6 --- .github/workflows/approved_status.yml | 2 +- .github/workflows/codeql-analysis.yml | 8 ++++---- .github/workflows/docs.yml | 12 ++++++------ .github/workflows/labeler.yml | 2 +- .github/workflows/stale.yml | 2 +- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/approved_status.yml b/.github/workflows/approved_status.yml index d50dd40b2d26..86897ca8fc09 100644 --- a/.github/workflows/approved_status.yml +++ b/.github/workflows/approved_status.yml @@ -32,7 +32,7 @@ jobs: scope: DataDog/datadog-api-spec policy: datadog-api-client-ruby.approved_status.post-review-status - name: Post PR review status check - uses: DataDog/github-actions/post-review-status@v2 + uses: DataDog/github-actions/post-review-status@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: datadog-api-spec diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 10aa601c2529..0c5648ed0aa8 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,11 +29,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -47,7 +47,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # v2 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 4cfc089a3c1e..c5859a9ebd8f 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -18,13 +18,13 @@ jobs: DD_PROFILING_NO_EXTENSION: true steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: # Fetch all history for applying timestamps to every page fetch-depth: 0 - name: Set up Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@eaecf785f6a34567a6d97f686bbb7bccc1ac1e5c # v1.237.0 with: ruby-version: "2.7" bundler-cache: true @@ -32,7 +32,7 @@ jobs: cache-version: ${{ secrets.CACHE_VERSION }} - name: Cache yardoc - uses: actions/cache@v3 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: | .yardoc @@ -48,7 +48,7 @@ jobs: - name: Compress docs run: tar czf doc.tar.gz doc - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: documentation path: doc.tar.gz @@ -61,7 +61,7 @@ jobs: - build steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: documentation path: doc @@ -69,7 +69,7 @@ jobs: - name: Uncompress docs run: tar xzf doc/doc.tar.gz && rm doc/doc.tar.gz - - uses: peaceiris/actions-gh-pages@v3 + - uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: ./doc diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index fc9bdfac0cbb..a5144ba18a49 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -11,6 +11,6 @@ jobs: triage: runs-on: ubuntu-latest steps: - - uses: DataDog/labeler@glob-all + - uses: DataDog/labeler@5170395583c7f7ec92989fd24faffc5b6154b866 # glob-all with: repo-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index a4e130ab2f86..e0bb5d11dcb0 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -16,7 +16,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: >-