From 43df939f1e4a742301bd63e14968e8be51fd2793 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 14:33:36 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/actions/cocoapods/action.yml | 2 +- .github/actions/setup-toolchain/action.yml | 12 ++++---- .github/dependabot.yml | 11 ++++++++ .github/workflows/build.yml | 32 +++++++++++----------- .github/workflows/codeql.yml | 8 +++--- .github/workflows/rnx-build.yml | 20 +++++++------- 6 files changed, 48 insertions(+), 37 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actions/cocoapods/action.yml b/.github/actions/cocoapods/action.yml index fecaa1824..0bf085e20 100644 --- a/.github/actions/cocoapods/action.yml +++ b/.github/actions/cocoapods/action.yml @@ -20,7 +20,7 @@ runs: shell: bash - name: Cache /${{ inputs.working-directory }}/${{ inputs.project-directory }}/Pods if: ${{ steps.find-lockfile.outputs.path }} - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ inputs.working-directory }}/${{ inputs.project-directory }}/Pods key: ${{ runner.os }}-pods-${{ hashFiles(steps.find-lockfile.outputs.path) }} diff --git a/.github/actions/setup-toolchain/action.yml b/.github/actions/setup-toolchain/action.yml index 8b095e662..99a28b793 100644 --- a/.github/actions/setup-toolchain/action.yml +++ b/.github/actions/setup-toolchain/action.yml @@ -54,13 +54,13 @@ runs: shell: bash - name: Set up JDK if: ${{ inputs.platform == 'android' || inputs.platform == 'node' }} - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: temurin java-version: ${{ inputs.java-version }} - name: Set up Gradle if: ${{ inputs.platform == 'android' || inputs.platform == 'node' }} - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 with: gradle-version: wrapper gradle-home-cache-excludes: | @@ -68,16 +68,16 @@ runs: jdks - name: Set up MSBuild if: ${{ inputs.platform == 'windows' }} - uses: microsoft/setup-msbuild@v3 + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0 - name: Set up Ruby if: ${{ runner.os != 'Windows' }} - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: "3.3.11" bundler: Gemfile.lock bundler-cache: true - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} cache: ${{ inputs.cache-npm-dependencies }} @@ -98,7 +98,7 @@ runs: shell: bash - name: Cache /.ccache if: ${{ steps.setup-ccache.outputs.cache-key }} - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: .ccache key: ${{ runner.os }}-${{ inputs.cache-key-prefix }}-ccache-${{ steps.setup-ccache.outputs.cache-key }}-1 diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 72a226032..f65e7e7fd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -25,7 +25,7 @@ jobs: if: ${{ github.event_name == 'pull_request' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -45,7 +45,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -164,7 +164,7 @@ jobs: runs-on: macos-26 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -219,7 +219,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -265,7 +265,7 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up toolchain @@ -314,7 +314,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up toolchain @@ -351,7 +351,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -406,7 +406,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -448,7 +448,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -498,7 +498,7 @@ jobs: if: false # visionOS temporarily disabled until releases are resumed steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -541,7 +541,7 @@ jobs: configuration: [Debug, Release] steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -589,7 +589,7 @@ jobs: working-directory: packages/example-windows - name: Upload build logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows-msbuild.binlog path: packages/example-windows/windows/*.binlog @@ -609,7 +609,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -640,7 +640,7 @@ jobs: working-directory: template-example - name: Upload build logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows-template-msbuild.binlog path: template-example/windows/*.binlog @@ -665,7 +665,7 @@ jobs: if: ${{ github.event_name != 'schedule' }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 @@ -701,7 +701,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Label - uses: actions/labeler@v7 + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} sync-labels: true diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d07bfa581..1e9c74cb6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,14 +23,14 @@ jobs: language: ["javascript", "ruby"] steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/rnx-build.yml b/.github/workflows/rnx-build.yml index 90841fed3..8a9c90f25 100644 --- a/.github/workflows/rnx-build.yml +++ b/.github/workflows/rnx-build.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up toolchain uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@trunk with: @@ -44,13 +44,13 @@ jobs: - name: Install npm dependencies run: ${{ github.event.inputs.packageManager }} install - name: Build Android app - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 with: gradle-version: wrapper arguments: --no-daemon clean assembleDebug build-root-directory: ${{ github.event.inputs.projectRoot }}/android - name: Upload build artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: android-artifact path: ${{ github.event.inputs.projectRoot }}/android/app/build/outputs/apk/debug/app-debug.apk @@ -68,7 +68,7 @@ jobs: XCARCHIVE_FILE: app.xcarchive steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up toolchain uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@trunk with: @@ -110,7 +110,7 @@ jobs: fi working-directory: ${{ github.event.inputs.projectRoot }}/ios - name: Upload build artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ios-artifact path: ${{ github.event.inputs.projectRoot }}/ios/${{ steps.prepare-build-artifact.outputs.filename }} @@ -123,7 +123,7 @@ jobs: runs-on: macos-14 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up toolchain uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@trunk with: @@ -145,7 +145,7 @@ jobs: npx --prefix . rnx-build-apple archive macos-artifact.tar "${app}" working-directory: ${{ github.event.inputs.projectRoot }}/macos - name: Upload build artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: macos-artifact path: ${{ github.event.inputs.projectRoot }}/macos/macos-artifact.tar @@ -158,7 +158,7 @@ jobs: runs-on: windows-2022 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up toolchain uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@trunk with: @@ -188,7 +188,7 @@ jobs: shell: bash working-directory: ${{ github.event.inputs.projectRoot }}/windows - name: Upload build artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows-artifact path: ${{ github.event.inputs.projectRoot }}/windows/AppPackages/${{ steps.prepare-build-artifact.outputs.app-name }} @@ -202,7 +202,7 @@ jobs: if: ${{ github.event.inputs.distribution != 'local' && !cancelled() && !failure() }} # `success()` excludes skipped jobs steps: - name: Download build artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ github.event.inputs.platform }}-artifact - name: Display structure of build artifact