From d26a47f3a82395b9a1af0166f455e469e89fbb0c Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Wed, 20 May 2026 02:02:11 +0200 Subject: [PATCH 1/4] sec(ci): pin all GitHub Actions to commit SHAs (#415) Replace all `uses: org/action@tag` refs across every workflow file with `uses: org/action@ # tag` pins. Several workflows referenced non-existent future versions (v5/v6/v7 for actions still on v4); these are corrected to the actual latest released tag while being SHA-pinned. Closes #415 --- .github/workflows/aws_sanity.yml | 8 +-- .github/workflows/azure_sanity.yml | 8 +-- .github/workflows/ci.yml | 62 +++++++++---------- .github/workflows/cleanup-staging.yml | 24 +++---- .github/workflows/database-migration.yml | 16 ++--- .github/workflows/deploy-all.yml | 2 +- .github/workflows/deploy-aws-fargate.yml | 10 +-- .github/workflows/deploy-aws-lambda.yml | 10 +-- .github/workflows/deploy-azure.yml | 12 ++-- .github/workflows/deploy-gcp.yml | 12 ++-- .github/workflows/destroy-fargate-dev.yml | 6 +- .github/workflows/frontend-build-sentinel.yml | 4 +- .github/workflows/frontend-build.yml | 4 +- .github/workflows/pre-commit.yml | 16 ++--- .github/workflows/rollback.yml | 34 +++++----- 15 files changed, 114 insertions(+), 114 deletions(-) diff --git a/.github/workflows/aws_sanity.yml b/.github/workflows/aws_sanity.yml index 4805c498f..2b02a5db5 100644 --- a/.github/workflows/aws_sanity.yml +++ b/.github/workflows/aws_sanity.yml @@ -35,17 +35,17 @@ jobs: - name: Checkout if: steps.precheck.outputs.should_run == 'true' - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Setup Go if: steps.precheck.outputs.should_run == 'true' - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod - name: Configure AWS credentials via OIDC (read-only role) if: steps.precheck.outputs.should_run == 'true' - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ secrets.AWS_CICD_READONLY_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} @@ -67,7 +67,7 @@ jobs: - name: Upload report artifact if: always() && steps.precheck.outputs.should_run == 'true' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: aws-sanity-report path: ${{ env.REPORT_PATH }} diff --git a/.github/workflows/azure_sanity.yml b/.github/workflows/azure_sanity.yml index b387a0fcf..873f9cf20 100644 --- a/.github/workflows/azure_sanity.yml +++ b/.github/workflows/azure_sanity.yml @@ -34,17 +34,17 @@ jobs: - name: Checkout if: steps.precheck.outputs.should_run == 'true' - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Setup Go if: steps.precheck.outputs.should_run == 'true' - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod - name: Azure Login (OIDC) if: steps.precheck.outputs.should_run == 'true' - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -66,7 +66,7 @@ jobs: - name: Upload report artifact if: always() && steps.precheck.outputs.should_run == 'true' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: azure-sanity-report path: ${{ env.REPORT_PATH }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 12f5bcff2..9746efcb8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,16 +34,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ env.GO_VERSION }} cache: true - name: Run golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2 with: version: v2.10.1 args: --timeout=5m @@ -74,10 +74,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ env.GO_VERSION }} cache: true @@ -92,7 +92,7 @@ jobs: go test -v -race -short -coverprofile=coverage.out -covermode=atomic ./... - name: Upload coverage to Codecov - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4 with: files: ./coverage.out flags: unittests @@ -104,7 +104,7 @@ jobs: go tool cover -html=coverage.out -o coverage.html - name: Upload coverage artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: coverage-report path: | @@ -142,10 +142,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ env.GO_VERSION }} cache: true @@ -180,7 +180,7 @@ jobs: go test -v -race -tags=integration -coverprofile=coverage-integration.out ./... - name: Upload integration coverage - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: integration-coverage path: coverage-integration.out @@ -192,13 +192,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 - name: Build Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0 with: context: . push: false @@ -225,10 +225,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: 1.6.0 @@ -271,10 +271,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ env.GO_VERSION }} @@ -301,17 +301,17 @@ jobs: fi - name: Run gosec Security Scanner - uses: securego/gosec@v2.22.4 + uses: securego/gosec@15d5c61e866bc2e2e8389376a31f1e5e09bde7d8 # v2.22.9 with: args: '-fmt sarif -out gosec-results.sarif ./...' - name: Upload gosec results to GitHub Security - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: sarif_file: gosec-results.sarif - name: Run Trivy vulnerability scanner (filesystem) - uses: aquasecurity/trivy-action@0.30.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: 'fs' scan-ref: '.' @@ -320,12 +320,12 @@ jobs: severity: 'CRITICAL,HIGH' - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: sarif_file: 'trivy-results.sarif' - name: Run tfsec (Terraform Security) - uses: aquasecurity/tfsec-action@v1.0.0 + uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3 with: working_directory: terraform/ soft_fail: true @@ -338,15 +338,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ env.GO_VERSION }} - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/golang@0.4.0 + uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 continue-on-error: true env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} @@ -363,10 +363,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 - name: Build test image run: | @@ -394,15 +394,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Setup Infracost - uses: infracost/actions/setup@v4 + uses: infracost/actions/setup@d51fc54d23c9ad90f984b884257bd96dc2625067 # v4.1.0 with: api-key: ${{ secrets.INFRACOST_API_KEY }} - name: Checkout base branch - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: '${{ github.event.pull_request.base.ref }}' @@ -413,7 +413,7 @@ jobs: --out-file=/tmp/infracost-base.json - name: Checkout PR branch - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Generate Infracost diff run: | diff --git a/.github/workflows/cleanup-staging.yml b/.github/workflows/cleanup-staging.yml index 5e74c68f5..4cd7f89d9 100644 --- a/.github/workflows/cleanup-staging.yml +++ b/.github/workflows/cleanup-staging.yml @@ -53,18 +53,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: feat/multicloud-web-frontend - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -115,18 +115,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: feat/multicloud-web-frontend - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -180,19 +180,19 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: feat/multicloud-web-frontend - name: Azure Login - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -244,18 +244,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: feat/multicloud-web-frontend - name: Authenticate to GCP - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} diff --git a/.github/workflows/database-migration.yml b/.github/workflows/database-migration.yml index 75e3fe8d0..d8f60fa0f 100644 --- a/.github/workflows/database-migration.yml +++ b/.github/workflows/database-migration.yml @@ -77,7 +77,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Safety checks id: check @@ -141,7 +141,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install golang-migrate run: | @@ -149,7 +149,7 @@ jobs: sudo mv migrate /usr/local/bin/ - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} @@ -212,7 +212,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install golang-migrate run: | @@ -220,13 +220,13 @@ jobs: sudo mv migrate /usr/local/bin/ - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1 - name: Get database endpoint from Terraform id: get-endpoint @@ -273,7 +273,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install golang-migrate run: | @@ -281,7 +281,7 @@ jobs: sudo mv migrate /usr/local/bin/ - name: Azure Login - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} diff --git a/.github/workflows/deploy-all.yml b/.github/workflows/deploy-all.yml index 364db9c74..d11d470bf 100644 --- a/.github/workflows/deploy-all.yml +++ b/.github/workflows/deploy-all.yml @@ -245,7 +245,7 @@ jobs: # Optional: Send notification to Slack, Discord, email, etc. # - name: Send notification # if: always() - # uses: slackapi/slack-github-action@v2 + # uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1 # with: # method: chat.postMessage # token: ${{ secrets.SLACK_BOT_TOKEN }} diff --git a/.github/workflows/deploy-aws-fargate.yml b/.github/workflows/deploy-aws-fargate.yml index 9fbb798ba..8b2a6c069 100644 --- a/.github/workflows/deploy-aws-fargate.yml +++ b/.github/workflows/deploy-aws-fargate.yml @@ -87,16 +87,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -168,7 +168,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: deployment-info-fargate-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -252,7 +252,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@v7 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: deployment-info-fargate-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/deploy-aws-lambda.yml b/.github/workflows/deploy-aws-lambda.yml index 535b0a98c..2cfbf124c 100644 --- a/.github/workflows/deploy-aws-lambda.yml +++ b/.github/workflows/deploy-aws-lambda.yml @@ -120,16 +120,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -215,7 +215,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: deployment-info-lambda-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -313,7 +313,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@v7 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: deployment-info-lambda-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/deploy-azure.yml b/.github/workflows/deploy-azure.yml index 44fb67149..67d55c487 100644 --- a/.github/workflows/deploy-azure.yml +++ b/.github/workflows/deploy-azure.yml @@ -88,17 +88,17 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -242,7 +242,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: deployment-info-azure-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -257,7 +257,7 @@ jobs: steps: - name: Azure Login - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -344,7 +344,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@v7 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: deployment-info-azure-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/deploy-gcp.yml b/.github/workflows/deploy-gcp.yml index 93ff455ac..b7c0d9190 100644 --- a/.github/workflows/deploy-gcp.yml +++ b/.github/workflows/deploy-gcp.yml @@ -79,19 +79,19 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1 - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -158,7 +158,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: deployment-info-gcp-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -238,7 +238,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@v7 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: deployment-info-gcp-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/destroy-fargate-dev.yml b/.github/workflows/destroy-fargate-dev.yml index a73adbd43..a55511881 100644 --- a/.github/workflows/destroy-fargate-dev.yml +++ b/.github/workflows/destroy-fargate-dev.yml @@ -42,16 +42,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} diff --git a/.github/workflows/frontend-build-sentinel.yml b/.github/workflows/frontend-build-sentinel.yml index c5df30e55..2eb90cd73 100644 --- a/.github/workflows/frontend-build-sentinel.yml +++ b/.github/workflows/frontend-build-sentinel.yml @@ -39,10 +39,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: "24" cache: "npm" diff --git a/.github/workflows/frontend-build.yml b/.github/workflows/frontend-build.yml index 2a92e2404..3b92e4216 100644 --- a/.github/workflows/frontend-build.yml +++ b/.github/workflows/frontend-build.yml @@ -45,10 +45,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: "24" cache: "npm" diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 34953e5be..7dc4d9ca2 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -16,20 +16,20 @@ jobs: timeout-minutes: 15 steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.13" - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: "1.25.4" - name: Set up Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: "24" # Cache the npm download cache keyed on the frontend lockfile. @@ -49,7 +49,7 @@ jobs: # `.github/workflows/ci.yml` so both workflows resolve to the same # Terraform binary; otherwise a behavioural drift between the two # could pass one and fail the other. - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: "1.10.5" terraform_wrapper: false @@ -78,7 +78,7 @@ jobs: # is worth the extra `if`). - name: Cache Go-installed tools (gosec, gocyclo) id: cache-go-tools - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/go/bin key: go-tools-${{ runner.os }}-gosec-v2.22.4-gocyclo-v0.6.0 @@ -143,7 +143,7 @@ jobs: # Saves ~30-60s per cache-hit run; safe because pre-commit verifies # env integrity on use. - name: Cache pre-commit environments - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.cache/pre-commit key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }} @@ -157,7 +157,7 @@ jobs: # step covers the latter. Keyed on go.sum so a dep upgrade still # invalidates the cache and gets clean builds. - name: Cache Go build cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.cache/go-build key: go-build-${{ runner.os }}-${{ hashFiles('**/go.sum') }} diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml index c9400f621..90c0b1fc3 100644 --- a/.github/workflows/rollback.yml +++ b/.github/workflows/rollback.yml @@ -52,7 +52,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Validate inputs id: check @@ -116,7 +116,7 @@ jobs: steps: - name: Configure credentials (AWS) if: startsWith(inputs.cloud, 'aws') - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} @@ -141,7 +141,7 @@ jobs: - name: Configure credentials (GCP) if: inputs.cloud == 'gcp' - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} @@ -156,7 +156,7 @@ jobs: - name: Configure credentials (Azure) if: inputs.cloud == 'azure' - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -190,16 +190,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -243,16 +243,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -283,16 +283,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v3 + uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -323,15 +323,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Azure Login - uses: azure/login@v3 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Setup Terraform - uses: hashicorp/setup-terraform@v4 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: ${{ env.TF_VERSION }} @@ -426,7 +426,7 @@ jobs: cat rollback-record.json - name: Upload rollback record - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: rollback-record-${{ github.run_id }} path: rollback-record.json From b944712995305c6ffdbdc5b4f4c6e43d33abd5f8 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Wed, 20 May 2026 10:06:37 +0200 Subject: [PATCH 2/4] fix(ci): disable credential persistence on all checkout steps All 11 actions/checkout uses defaulted to persist-credentials: true, leaving the GitHub token in git config after checkout. None of these jobs need persisted credentials for authenticated git operations. Set persist-credentials: false on every step to reduce the token exposure window. Fixes CodeRabbit finding (artipacked) on PR #536. --- .github/workflows/ci.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9746efcb8..96a81644a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,6 +35,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 @@ -75,6 +77,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 @@ -143,6 +147,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 @@ -193,6 +199,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 @@ -226,6 +234,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Setup Terraform uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 @@ -272,6 +282,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 @@ -339,6 +351,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 @@ -364,6 +378,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 @@ -395,6 +411,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Setup Infracost uses: infracost/actions/setup@d51fc54d23c9ad90f984b884257bd96dc2625067 # v4.1.0 @@ -404,6 +422,7 @@ jobs: - name: Checkout base branch uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: + persist-credentials: false ref: '${{ github.event.pull_request.base.ref }}' - name: Generate Infracost cost estimate baseline @@ -414,6 +433,8 @@ jobs: - name: Checkout PR branch uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Generate Infracost diff run: | From ff6229aa15653b073d70c57d8611113c4293a8d2 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 22 May 2026 15:06:46 +0200 Subject: [PATCH 3/4] fix(ci): disable credential persistence in rollback and database-migration All 5 actions/checkout steps in rollback.yml and all 4 in database-migration.yml defaulted to persist-credentials: true, leaving the GitHub token in git config for the remainder of each job. Neither workflow has any step that performs authenticated git operations after checkout (cloud auth is done via dedicated aws-actions/configure-aws-credentials, google-github-actions/auth, and azure/login actions). Setting persist-credentials: false on every checkout step closes the token exposure window. Fixes remaining CodeRabbit artipacked findings on PR #536 (nitpick comments on rollback.yml and database-migration.yml). --- .github/workflows/database-migration.yml | 8 ++++++++ .github/workflows/rollback.yml | 10 ++++++++++ 2 files changed, 18 insertions(+) diff --git a/.github/workflows/database-migration.yml b/.github/workflows/database-migration.yml index d8f60fa0f..a8aa9ebbe 100644 --- a/.github/workflows/database-migration.yml +++ b/.github/workflows/database-migration.yml @@ -78,6 +78,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Safety checks id: check @@ -142,6 +144,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Install golang-migrate run: | @@ -213,6 +217,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Install golang-migrate run: | @@ -274,6 +280,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Install golang-migrate run: | diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml index 90c0b1fc3..e4f518857 100644 --- a/.github/workflows/rollback.yml +++ b/.github/workflows/rollback.yml @@ -53,6 +53,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Validate inputs id: check @@ -191,6 +193,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 @@ -244,6 +248,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 @@ -284,6 +290,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Authenticate to Google Cloud uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 @@ -324,6 +332,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Azure Login uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 From 3380eec969547a76411f4ff75a95a8a5b05e971b Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 22 May 2026 17:22:06 +0200 Subject: [PATCH 4/4] fix(ci): pin actions to latest SHA of the in-use major, not a downgraded major The previous SHA-pin commit resolved each action to a commit in an older major version than the workflows were using (e.g. checkout pinned to v4.3.1 while the branch used v5, configure-aws-credentials pinned to v4.3.1 while the branch used v6, etc.). This corrects every pin to the latest release within the same major that the base branch (feat/multicloud-web-frontend) was already on. No logic changes; SHA + version comment only. Actions corrected (old major -> correct major): actions/checkout v4.3.1 -> v5.0.1 (34 occurrences) actions/download-artifact v4.3.0 -> v7.0.0 (4 occurrences) actions/upload-artifact v4.6.2 -> v6.0.0 (9 occurrences) actions/setup-go v5.6.0 -> v6.4.0 (8 occurrences) actions/setup-node v4.4.0 -> v6.4.0 (3 occurrences) actions/setup-python v5.6.0 -> v6.2.0 (1 occurrence) aws-actions/configure-aws-credentials v4.3.1 -> v6.1.1 (10 occurrences; standardises ALL to v6.1.1) azure/login v2.3.0 -> v3.0.0 (7 occurrences) docker/build-push-action v6.9.0 -> v7.2.0 (1 occurrence) docker/setup-buildx-action v3.9.0 -> v4.0.0 (2 occurrences) google-github-actions/auth v2.1.9 -> v3.0.0 (5 occurrences) google-github-actions/setup-gcloud v2.2.1 -> v3.0.1 (2 occurrences) hashicorp/setup-terraform v3.1.2 -> v4.0.1 (15 occurrences) codecov/codecov-action v5.5.4 -> v6.0.1 (1 occurrence) golangci/golangci-lint-action v6.5.2 -> v9.2.1 (1 occurrence) snyk/actions/golang v1.0.0 -> 0.4.0 (1 occurrence; base was on 0.x) securego/gosec v2.22.9 -> v2.26.1 (1 occurrence; updated to latest v2) github/codeql-action v4.35.5 -> v4.36.0 (2 occurrences; updated to latest v4) All 23 SHAs independently verified against their tags via GitHub API. No float tags remain. YAML validates on all 15 files. --- .github/workflows/aws_sanity.yml | 8 +-- .github/workflows/azure_sanity.yml | 8 +-- .github/workflows/ci.yml | 56 +++++++++---------- .github/workflows/cleanup-staging.yml | 24 ++++---- .github/workflows/database-migration.yml | 16 +++--- .github/workflows/deploy-aws-fargate.yml | 10 ++-- .github/workflows/deploy-aws-lambda.yml | 10 ++-- .github/workflows/deploy-azure.yml | 12 ++-- .github/workflows/deploy-gcp.yml | 12 ++-- .github/workflows/destroy-fargate-dev.yml | 6 +- .github/workflows/frontend-build-sentinel.yml | 4 +- .github/workflows/frontend-build.yml | 4 +- .github/workflows/pre-commit.yml | 10 ++-- .github/workflows/rollback.yml | 34 +++++------ 14 files changed, 107 insertions(+), 107 deletions(-) diff --git a/.github/workflows/aws_sanity.yml b/.github/workflows/aws_sanity.yml index 2b02a5db5..51d59b7b9 100644 --- a/.github/workflows/aws_sanity.yml +++ b/.github/workflows/aws_sanity.yml @@ -35,17 +35,17 @@ jobs: - name: Checkout if: steps.precheck.outputs.should_run == 'true' - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Setup Go if: steps.precheck.outputs.should_run == 'true' - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: go.mod - name: Configure AWS credentials via OIDC (read-only role) if: steps.precheck.outputs.should_run == 'true' - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ secrets.AWS_CICD_READONLY_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} @@ -67,7 +67,7 @@ jobs: - name: Upload report artifact if: always() && steps.precheck.outputs.should_run == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: aws-sanity-report path: ${{ env.REPORT_PATH }} diff --git a/.github/workflows/azure_sanity.yml b/.github/workflows/azure_sanity.yml index 873f9cf20..6d76f6ae0 100644 --- a/.github/workflows/azure_sanity.yml +++ b/.github/workflows/azure_sanity.yml @@ -34,17 +34,17 @@ jobs: - name: Checkout if: steps.precheck.outputs.should_run == 'true' - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Setup Go if: steps.precheck.outputs.should_run == 'true' - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: go.mod - name: Azure Login (OIDC) if: steps.precheck.outputs.should_run == 'true' - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -66,7 +66,7 @@ jobs: - name: Upload report artifact if: always() && steps.precheck.outputs.should_run == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: azure-sanity-report path: ${{ env.REPORT_PATH }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 96a81644a..e15a4e06b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,18 +34,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ env.GO_VERSION }} cache: true - name: Run golangci-lint - uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 with: version: v2.10.1 args: --timeout=5m @@ -76,12 +76,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ env.GO_VERSION }} cache: true @@ -96,7 +96,7 @@ jobs: go test -v -race -short -coverprofile=coverage.out -covermode=atomic ./... - name: Upload coverage to Codecov - uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: files: ./coverage.out flags: unittests @@ -108,7 +108,7 @@ jobs: go tool cover -html=coverage.out -o coverage.html - name: Upload coverage artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: coverage-report path: | @@ -146,12 +146,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ env.GO_VERSION }} cache: true @@ -186,7 +186,7 @@ jobs: go test -v -race -tags=integration -coverprofile=coverage-integration.out ./... - name: Upload integration coverage - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: integration-coverage path: coverage-integration.out @@ -198,15 +198,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Build Docker image - uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0 + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 with: context: . push: false @@ -233,12 +233,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: 1.6.0 @@ -281,12 +281,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ env.GO_VERSION }} @@ -313,12 +313,12 @@ jobs: fi - name: Run gosec Security Scanner - uses: securego/gosec@15d5c61e866bc2e2e8389376a31f1e5e09bde7d8 # v2.22.9 + uses: securego/gosec@4a3bd8af174872c778439083ded7adbf3747e770 # v2.26.1 with: args: '-fmt sarif -out gosec-results.sarif ./...' - name: Upload gosec results to GitHub Security - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 with: sarif_file: gosec-results.sarif @@ -332,7 +332,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 with: sarif_file: 'trivy-results.sarif' @@ -350,17 +350,17 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: ${{ env.GO_VERSION }} - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 + uses: snyk/actions/golang@b98d498629f1c368650224d6d212bf7dfa89e4bf # 0.4.0 continue-on-error: true env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} @@ -377,12 +377,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Build test image run: | @@ -410,7 +410,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false @@ -420,7 +420,7 @@ jobs: api-key: ${{ secrets.INFRACOST_API_KEY }} - name: Checkout base branch - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false ref: '${{ github.event.pull_request.base.ref }}' @@ -432,7 +432,7 @@ jobs: --out-file=/tmp/infracost-base.json - name: Checkout PR branch - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false diff --git a/.github/workflows/cleanup-staging.yml b/.github/workflows/cleanup-staging.yml index 4cd7f89d9..1cfb8eeac 100644 --- a/.github/workflows/cleanup-staging.yml +++ b/.github/workflows/cleanup-staging.yml @@ -53,18 +53,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: feat/multicloud-web-frontend - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -115,18 +115,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: feat/multicloud-web-frontend - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -180,19 +180,19 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: feat/multicloud-web-frontend - name: Azure Login - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -244,18 +244,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: feat/multicloud-web-frontend - name: Authenticate to GCP - uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} diff --git a/.github/workflows/database-migration.yml b/.github/workflows/database-migration.yml index a8aa9ebbe..bea84d547 100644 --- a/.github/workflows/database-migration.yml +++ b/.github/workflows/database-migration.yml @@ -77,7 +77,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false @@ -143,7 +143,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false @@ -153,7 +153,7 @@ jobs: sudo mv migrate /usr/local/bin/ - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} @@ -216,7 +216,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false @@ -226,13 +226,13 @@ jobs: sudo mv migrate /usr/local/bin/ - name: Authenticate to Google Cloud - uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 - name: Get database endpoint from Terraform id: get-endpoint @@ -279,7 +279,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false @@ -289,7 +289,7 @@ jobs: sudo mv migrate /usr/local/bin/ - name: Azure Login - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} diff --git a/.github/workflows/deploy-aws-fargate.yml b/.github/workflows/deploy-aws-fargate.yml index 8b2a6c069..64e34c251 100644 --- a/.github/workflows/deploy-aws-fargate.yml +++ b/.github/workflows/deploy-aws-fargate.yml @@ -87,16 +87,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -168,7 +168,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: deployment-info-fargate-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -252,7 +252,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: deployment-info-fargate-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/deploy-aws-lambda.yml b/.github/workflows/deploy-aws-lambda.yml index 2cfbf124c..5bae86fa7 100644 --- a/.github/workflows/deploy-aws-lambda.yml +++ b/.github/workflows/deploy-aws-lambda.yml @@ -120,16 +120,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -215,7 +215,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: deployment-info-lambda-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -313,7 +313,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: deployment-info-lambda-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/deploy-azure.yml b/.github/workflows/deploy-azure.yml index 67d55c487..5988cdbc3 100644 --- a/.github/workflows/deploy-azure.yml +++ b/.github/workflows/deploy-azure.yml @@ -88,17 +88,17 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Azure Login - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -242,7 +242,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: deployment-info-azure-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -257,7 +257,7 @@ jobs: steps: - name: Azure Login - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -344,7 +344,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: deployment-info-azure-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/deploy-gcp.yml b/.github/workflows/deploy-gcp.yml index b7c0d9190..a262be467 100644 --- a/.github/workflows/deploy-gcp.yml +++ b/.github/workflows/deploy-gcp.yml @@ -79,19 +79,19 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Authenticate to Google Cloud - uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -158,7 +158,7 @@ jobs: cat deployment-info.json - name: Upload deployment info - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: deployment-info-gcp-${{ needs.prepare.outputs.environment }} path: deployment-info.json @@ -238,7 +238,7 @@ jobs: steps: - name: Download deployment info - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: deployment-info-gcp-${{ needs.prepare.outputs.environment }} continue-on-error: true diff --git a/.github/workflows/destroy-fargate-dev.yml b/.github/workflows/destroy-fargate-dev.yml index a55511881..58581a40a 100644 --- a/.github/workflows/destroy-fargate-dev.yml +++ b/.github/workflows/destroy-fargate-dev.yml @@ -42,16 +42,16 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} diff --git a/.github/workflows/frontend-build-sentinel.yml b/.github/workflows/frontend-build-sentinel.yml index 2eb90cd73..6b98bb69d 100644 --- a/.github/workflows/frontend-build-sentinel.yml +++ b/.github/workflows/frontend-build-sentinel.yml @@ -39,10 +39,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24" cache: "npm" diff --git a/.github/workflows/frontend-build.yml b/.github/workflows/frontend-build.yml index 3b92e4216..f6e11588d 100644 --- a/.github/workflows/frontend-build.yml +++ b/.github/workflows/frontend-build.yml @@ -45,10 +45,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24" cache: "npm" diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 7dc4d9ca2..654554bec 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -16,20 +16,20 @@ jobs: timeout-minutes: 15 steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: "1.25.4" - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24" # Cache the npm download cache keyed on the frontend lockfile. @@ -49,7 +49,7 @@ jobs: # `.github/workflows/ci.yml` so both workflows resolve to the same # Terraform binary; otherwise a behavioural drift between the two # could pass one and fail the other. - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: "1.10.5" terraform_wrapper: false diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml index e4f518857..84beb5959 100644 --- a/.github/workflows/rollback.yml +++ b/.github/workflows/rollback.yml @@ -52,7 +52,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false @@ -118,7 +118,7 @@ jobs: steps: - name: Configure credentials (AWS) if: startsWith(inputs.cloud, 'aws') - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} @@ -143,7 +143,7 @@ jobs: - name: Configure credentials (GCP) if: inputs.cloud == 'gcp' - uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} @@ -158,7 +158,7 @@ jobs: - name: Configure credentials (Azure) if: inputs.cloud == 'azure' - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} @@ -192,18 +192,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -247,18 +247,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1 with: role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} aws-region: ${{ vars.AWS_REGION || 'us-east-1' }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -289,18 +289,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Authenticate to Google Cloud - uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -331,17 +331,17 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: persist-credentials: false - name: Azure Login - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Setup Terraform - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: ${{ env.TF_VERSION }} @@ -436,7 +436,7 @@ jobs: cat rollback-record.json - name: Upload rollback record - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: rollback-record-${{ github.run_id }} path: rollback-record.json