Skip to content

DEVOPS-7261 - security: pin GitHub Actions to commit SHAs #2051

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abacchilb merged 1 commit into from
Mar 23, 2026
Merged

DEVOPS-7261 - security: pin GitHub Actions to commit SHAs #2051

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions .github/workflows/lbox-develop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@ jobs:
test-matrix: ${{ steps.matrix.outputs.test-matrix }}
package-matrix: ${{ steps.matrix.outputs.publish-matrix }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ github.head_ref }}
- uses: dorny/paths-filter@v3
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
id: filter
with:
list-files: 'json'
Expand All @@ -47,7 +47,7 @@ jobs:
group: lbox-staging-${{ matrix.python-version }}-${{ matrix.package }}
cancel-in-progress: false
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ github.head_ref }}
- uses: ./.github/actions/python-package-shared-setup
Expand Down Expand Up @@ -83,7 +83,7 @@ jobs:
# IMPORTANT: this permission is mandatory for trusted publishing
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ github.head_ref }}
- uses: ./.github/actions/python-package-shared-setup
Expand All @@ -100,7 +100,7 @@ jobs:
rye run toml set --toml-path pyproject.toml project.name ${{ matrix.package }}
rye build
- name: Publish package distributions to Test PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
with:
packages-dir: dist/
repository-url: https://test.pypi.org/legacy/
Expand All @@ -117,20 +117,20 @@ jobs:
# IMPORTANT: this permission is mandatory for trusted publishing
packages: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ github.head_ref }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
- name: Log in to the Container registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push (Develop)
if: github.event_name == 'push'
uses: docker/build-push-action@v5
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
with:
context: .
file: ./libs/${{ matrix.package }}/Dockerfile
Expand All @@ -149,7 +149,7 @@ jobs:
echo "ghcr.io/labelbox/${{ matrix.package }}:${{ github.sha }}" >> "$GITHUB_STEP_SUMMARY"
- name: Build and push (Pull Request)
if: github.event_name == 'pull_request'
uses: docker/build-push-action@v5
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
with:
context: .
file: ./libs/${{ matrix.package }}/Dockerfile
Expand Down
26 changes: 13 additions & 13 deletions .github/workflows/lbox-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,10 @@ jobs:
test-matrix: ${{ steps.matrix.outputs.test-matrix }}
package-matrix: ${{ steps.matrix.outputs.publish-matrix }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}
- uses: dorny/paths-filter@v3
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
id: filter
with:
base: ${{ inputs.prev_sdk_tag }}
Expand All @@ -52,11 +52,11 @@ jobs:
matrix:
include: ${{ fromJSON(needs.path-filter.outputs.package-matrix) }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}
- name: Install the latest version of rye
uses: eifinger/setup-rye@v2
uses: eifinger/setup-rye@787604a465b1696ad17eedf2f8101df9fc555c94 # v2
with:
version: ${{ vars.RYE_VERSION }}
enable-cache: true
Expand All @@ -73,7 +73,7 @@ jobs:
run: |
cd dist && echo "hashes_${{ matrix.package }}=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
echo "hashes_${{ matrix.package }}=$(sha256sum * | base64 -w0)"
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: build-${{ matrix.package }}
path: ./dist
Expand All @@ -83,7 +83,7 @@ jobs:
actions: read
contents: write
id-token: write # Needed to access the workflow's OIDC identity.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0
with:
base64-subjects: "${{ needs.build.outputs.hashes }}"
upload-assets: true
Expand All @@ -102,7 +102,7 @@ jobs:
group: lbox-staging-${{ matrix.python-version }}-${{ matrix.package }}
cancel-in-progress: false
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}
- uses: ./.github/actions/python-package-shared-setup
Expand Down Expand Up @@ -137,12 +137,12 @@ jobs:
# IMPORTANT: this permission is mandatory for trusted publishing
id-token: write
steps:
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: build-${{ matrix.package }}
path: ./artifact
- name: Publish package distributions to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
with:
packages-dir: artifact/
verbose: true
Expand All @@ -158,20 +158,20 @@ jobs:
# IMPORTANT: this permission is mandatory for trusted publishing
packages: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
# ref: ${{ inputs.tag }}
ref: ${{ inputs.tag }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
- name: Log in to the Container registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push
uses: docker/build-push-action@v5
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
id: build_container
with:
context: .
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/notebooks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
if: github.event.pull_request.merged == false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ github.head_ref }}
fetch-depth: 0
Expand All @@ -38,7 +38,7 @@ jobs:
git add examples/.
git commit -m ":art: Cleaned" || exit 0
- name: Push changes
uses: ad-m/github-push-action@master
uses: ad-m/github-push-action@4cc74773234f74829a8c21bc4d69dd4be9cfa599 # master
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
branch: ${{ github.head_ref }}
Expand All @@ -50,7 +50,7 @@ jobs:
outputs:
addedOrModified: ${{ steps.filter.outputs.addedOrModified }}
steps:
- uses: dorny/paths-filter@v3
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
id: filter
with:
filters: |
Expand All @@ -62,7 +62,7 @@ jobs:
if: ${{ needs.changes.outputs.addedOrModified == 'true' }} && github.event.pull_request.merged == false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ github.head_ref }}
fetch-depth: 0
Expand All @@ -80,7 +80,7 @@ jobs:
git add examples/.
git commit -m ":memo: README updated" || exit 0
- name: Push changes
uses: ad-m/github-push-action@master
uses: ad-m/github-push-action@4cc74773234f74829a8c21bc4d69dd4be9cfa599 # master
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
branch: ${{ github.head_ref }}
32 changes: 16 additions & 16 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,11 +43,11 @@ jobs:
outputs:
hashes: ${{ steps.hash.outputs.hashes }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}
- name: Install the latest version of rye
uses: eifinger/setup-rye@v2
uses: eifinger/setup-rye@787604a465b1696ad17eedf2f8101df9fc555c94 # v2
with:
version: ${{ vars.RYE_VERSION }}
enable-cache: true
Expand All @@ -63,7 +63,7 @@ jobs:
id: hash
run: |
cd dist && echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: build
path: ./dist
Expand All @@ -73,7 +73,7 @@ jobs:
actions: read
contents: write
id-token: write # Needed to access the workflow's OIDC identity.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0
with:
base64-subjects: "${{ needs.build.outputs.hashes }}"
upload-assets: true
Expand Down Expand Up @@ -102,11 +102,11 @@ jobs:
prod-key: PROD_LABELBOX_API_KEY_2
da-test-key: DA_GCP_LABELBOX_API_KEY
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}
- name: Install the latest version of rye
uses: eifinger/setup-rye@v2
uses: eifinger/setup-rye@787604a465b1696ad17eedf2f8101df9fc555c94 # v2
with:
version: ${{ vars.RYE_VERSION }}
enable-cache: true
Expand All @@ -115,7 +115,7 @@ jobs:
rye config --set-bool behavior.use-uv=true
- name: Python setup
run: rye pin ${{ matrix.python-version }}
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: build
path: ./dist
Expand Down Expand Up @@ -151,10 +151,10 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: build
path: ./artifact
Expand All @@ -176,12 +176,12 @@ jobs:
# IMPORTANT: this permission is mandatory for trusted publishing
id-token: write
steps:
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: build
path: ./artifact
- name: Publish package distributions to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
with:
packages-dir: artifact/
container-publish:
Expand All @@ -198,7 +198,7 @@ jobs:
env:
CONTAINER_IMAGE: "ghcr.io/${{ github.repository }}"
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ inputs.tag }}

Expand All @@ -207,17 +207,17 @@ jobs:
echo "CONTAINER_IMAGE=${CONTAINER_IMAGE,,}" >> ${GITHUB_ENV}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

- name: Log in to the Container registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push
uses: docker/build-push-action@v5
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
id: build_container
with:
context: .
Expand Down Expand Up @@ -246,7 +246,7 @@ jobs:
actions: read # for detecting the Github Actions environment.
id-token: write # for creating OIDC tokens for signing.
packages: write # for uploading attestations.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0
with:
image: ${{ needs. container-publish.outputs.image }}
digest: ${{ needs. container-publish.outputs.digest }}
Expand Down
Loading
Loading