From c8f7d33947221869c62e50446b919f6ab3fc7862 Mon Sep 17 00:00:00 2001 From: kobihikri Date: Tue, 14 Jul 2026 15:24:27 +0300 Subject: [PATCH] ci: pin s3-upload-action to a full commit SHA benchmarks.yml, package.yml and docs-publish.yaml hand shallwefootball/s3-upload-action live AWS credentials (and package.yml's build-cli job also holds DigiCert code-signing secrets) via the mutable @master branch. Pin to the commit @master resolves to so the code that runs with those secrets is fixed. Behaviour unchanged. --- .github/workflows/benchmarks.yml | 4 ++-- .github/workflows/docs-publish.yaml | 2 +- .github/workflows/package.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 1a934842bfb..95dbd2030e1 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -132,7 +132,7 @@ jobs: # this will work for both PR and master - name: Upload criterion results to DO spaces - uses: shallwefootball/s3-upload-action@master + uses: shallwefootball/s3-upload-action@0d261a6f15b3b2e209dfebdecace4b100c04f95b # master with: aws_key_id: ${{ secrets.AWS_KEY_ID }} aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY}} @@ -308,7 +308,7 @@ jobs: # this will work for both PR and master - name: Upload callgrind results to DO spaces - uses: shallwefootball/s3-upload-action@master + uses: shallwefootball/s3-upload-action@0d261a6f15b3b2e209dfebdecace4b100c04f95b # master with: aws_key_id: ${{ secrets.AWS_KEY_ID }} aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY}} diff --git a/.github/workflows/docs-publish.yaml b/.github/workflows/docs-publish.yaml index 46771a92791..4cbf3b76a25 100644 --- a/.github/workflows/docs-publish.yaml +++ b/.github/workflows/docs-publish.yaml @@ -47,7 +47,7 @@ jobs: run: pnpm build - name: Publish docs to S3 - uses: shallwefootball/s3-upload-action@master + uses: shallwefootball/s3-upload-action@0d261a6f15b3b2e209dfebdecace4b100c04f95b # master with: aws_key_id: ${{ secrets.DOCS_AWS_KEY_ID }} aws_secret_access_key: ${{ secrets.DOCS_AWS_SECRET_ACCESS_KEY}} diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 9e3a92ee9bd..8263871133b 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -157,7 +157,7 @@ jobs: id: extract_branch - name: Upload to AWS S3 - uses: shallwefootball/s3-upload-action@master + uses: shallwefootball/s3-upload-action@0d261a6f15b3b2e209dfebdecace4b100c04f95b # master with: aws_key_id: ${{ secrets.AWS_KEY_ID }} aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY}}