diff --git a/.github/workflows/js-sdk-tests.yml b/.github/workflows/js-sdk-tests.yml index 2108c1f..9a19e23 100644 --- a/.github/workflows/js-sdk-tests.yml +++ b/.github/workflows/js-sdk-tests.yml @@ -19,10 +19,10 @@ jobs: name: Build and test SDK steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' @@ -30,13 +30,13 @@ jobs: prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: '${{ env.TOOL_VERSION_NODEJS }}' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index c5aace2..6998619 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -10,22 +10,22 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' uppercase: 'true' prefix: 'tool_version_' - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '${{ env.TOOL_VERSION_NODEJS }}' cache: pnpm @@ -39,12 +39,12 @@ jobs: run: pnpm install --frozen-lockfile - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: ${{ env.TOOL_VERSION_POETRY }} virtualenvs-create: true diff --git a/.github/workflows/publish_packages.yml b/.github/workflows/publish_packages.yml index 5f21ad7..8772a4f 100644 --- a/.github/workflows/publish_packages.yml +++ b/.github/workflows/publish_packages.yml @@ -15,19 +15,19 @@ jobs: name: Publish Desktop SDK runs-on: ubuntu-22.04 steps: - - uses: actions/create-github-app-token@v1 + - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 id: app-token with: app-id: ${{ vars.VERSION_BUMPER_APPID }} private-key: ${{ secrets.VERSION_BUMPER_SECRET }} - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: token: ${{ steps.app-token.outputs.token }} - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' @@ -35,24 +35,24 @@ jobs: prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: ${{ env.TOOL_VERSION_POETRY }} virtualenvs-create: true virtualenvs-in-project: true installer-parallel: true - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '${{ env.TOOL_VERSION_NODEJS }}' registry-url: 'https://registry.npmjs.org' @@ -77,7 +77,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Release new versions - uses: changesets/action@v1 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 with: publish: pnpm run publish createGithubReleases: true diff --git a/.github/workflows/python-sdk-tests.yml b/.github/workflows/python-sdk-tests.yml index 85f7650..11157fd 100644 --- a/.github/workflows/python-sdk-tests.yml +++ b/.github/workflows/python-sdk-tests.yml @@ -19,10 +19,10 @@ jobs: name: Build and test SDK steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' @@ -30,12 +30,12 @@ jobs: prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: ${{ env.TOOL_VERSION_POETRY }} virtualenvs-create: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 26a5399..ab6314b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,10 +19,10 @@ jobs: release: ${{ steps.version.outputs.release }} steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' @@ -30,13 +30,13 @@ jobs: prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '${{ env.TOOL_VERSION_NODEJS }}' registry-url: "https://registry.npmjs.org" @@ -67,10 +67,10 @@ jobs: python-sdk: ${{ steps.python.outputs.release }} steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' @@ -78,13 +78,13 @@ jobs: prefix: 'tool_version_' - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 id: pnpm-install with: version: ${{ env.TOOL_VERSION_PNPM }} - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '${{ env.TOOL_VERSION_NODEJS }}' registry-url: 'https://registry.npmjs.org' @@ -125,7 +125,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Release Failed - Slack Notification - uses: rtCamp/action-slack-notify@v2 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: '#ff0000' SLACK_MESSAGE: ':here-we-go-again: :bob-the-destroyer: We need :fix-parrot: ASAP :pray:' diff --git a/.github/workflows/template.yml b/.github/workflows/template.yml index 223fdb2..93d2eb9 100644 --- a/.github/workflows/template.yml +++ b/.github/workflows/template.yml @@ -21,10 +21,10 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Parse .tool-versions - uses: wistia/parse-tool-versions@v2.1.1 + uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1 id: tool-versions with: filename: '.tool-versions' @@ -32,12 +32,12 @@ jobs: prefix: 'tool_version_' - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '${{ env.TOOL_VERSION_PYTHON }}' - name: Install and configure Poetry - uses: snok/install-poetry@v1 + uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2 with: version: ${{ env.TOOL_VERSION_POETRY }} virtualenvs-create: true @@ -48,10 +48,10 @@ jobs: run: poetry install - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Log in to DockerHub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/validate-renovate-config.yaml b/.github/workflows/validate-renovate-config.yaml index 8378c56..74371d0 100644 --- a/.github/workflows/validate-renovate-config.yaml +++ b/.github/workflows/validate-renovate-config.yaml @@ -12,7 +12,7 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Validate Renovate config - uses: suzuki-shunsuke/github-action-renovate-config-validator@v2.1.0 + uses: suzuki-shunsuke/github-action-renovate-config-validator@ee9f69e1f683ed0d08225086482b34fc9abe9300 # v2.1.0 diff --git a/renovate.json5 b/renovate.json5 index 7682bd5..1e0185a 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -2,7 +2,12 @@ // list of all presets: https://docs.renovatebot.com/presets-default/ { $schema: 'https://docs.renovatebot.com/renovate-schema.json', - extends: ['config:recommended', ':automergeRequireAllStatusChecks'], + extends: [ + 'config:recommended', + ':automergeRequireAllStatusChecks', + // keep GitHub Actions pinned to commit SHAs (supply-chain hardening) + 'helpers:pinGitHubActionDigests', + ], dependencyDashboard: true, // let it fly for now, we've got a lot to catch up on // schedule: [