Skip to content

VLN-1461: remediate unpinned-github-actions #801

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
picatz wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −11
Open

VLN-1461: remediate unpinned-github-actions #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,13 @@ jobs:
name: ci
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

@yuandrew yuandrew Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't checkout be v7 now?

This comment was marked as low quality.

Sign in to view

@picatz picatz Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ignore comment above (generated by Camper); the v7 checkout campaign is distinct from the "pinning" campaign. The pinning campaign aims to just pin what's actually in use right now, and the v7 bump is a fast follow up / separate PR.

@yuandrew yuandrew Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds good, thanks

- uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
with:
go-version: '^1.21'
- uses: arduino/setup-protoc@v2
- uses: arduino/setup-protoc@a8b67ba40b37d35169e222f3bb352603327985b6 # v2.1.0
- name: 'Setup jq'
uses: dcarbone/install-jq-action@v2
uses: dcarbone/install-jq-action@8867ddb4788346d7c22b72ea2e2ffe4d514c7bcb # v2.1.0
- run: make ci-build
- name: Fail if the repo is dirty
run: |
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/create-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,15 +34,15 @@ jobs:
api_go_commit_sha: ${{ steps.pin_commits.outputs.api_go_commit_sha }}
steps:
- name: Checkout api
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: ${{ github.event.inputs.branch }}
fetch-depth: 0
fetch-tags: true
path: api

- name: Checkout api-go
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
repository: temporalio/api-go
ref: ${{ github.event.inputs.branch }}
Expand Down Expand Up @@ -107,14 +107,14 @@ jobs:
steps:
- name: Generate token
id: generate_token
uses: actions/create-github-app-token@v1
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
with:
app-id: ${{ secrets.TEMPORAL_CICD_APP_ID }}
private-key: ${{ secrets.TEMPORAL_CICD_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: ${{ needs.prepare-inputs.outputs.api_commit_sha }}
token: ${{ steps.generate_token.outputs.token }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/push-to-buf.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repo
uses: actions/checkout@v4
- uses: bufbuild/buf-action@v1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
with:
version: 1.49.0
token: ${{ secrets.BUF_TEMPORALIO_TOKEN }}
2 changes: 1 addition & 1 deletion .github/workflows/trigger-api-go-update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
steps:
- name: Generate token
id: generate_token
uses: actions/create-github-app-token@v1
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
with:
app-id: ${{ secrets.TEMPORAL_CICD_APP_ID }}
private-key: ${{ secrets.TEMPORAL_CICD_PRIVATE_KEY }}
Expand Down
Loading