From b2e10f21dc09e5470c026f5497ec58204b7fc83f Mon Sep 17 00:00:00 2001 From: Niklas Zender Date: Tue, 26 May 2026 11:06:36 +0200 Subject: [PATCH 1/2] chore: update GitHub Action pins Pin listed workflow actions to current upstream default-branch SHAs. --- .github/workflows/docker.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index cfb165e..b91ac5d 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -85,10 +85,10 @@ jobs: uses: actions/checkout@v4 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@7f9aaaffa50b7aa9d8d6f147ed9a1be21f255d98 - name: Setup Docker buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 - name: Download artifact if: ${{ inputs.artifact_name != '' }} @@ -99,7 +99,7 @@ jobs: - name: Log into registry ${{ inputs.registry }} if: inputs.push - uses: docker/login-action@v3 + uses: docker/login-action@2ff7bc63ffa51414f77e9cbeea0d3297c1672d2e with: registry: ${{ inputs.registry }} username: ${{ inputs.registry_user }} @@ -107,14 +107,14 @@ jobs: - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 with: images: ${{ inputs.registry }}/${{ inputs.image_name }} tags: ${{ inputs.tags }} - name: Build and push Docker image id: build - uses: docker/build-push-action@v5 + uses: docker/build-push-action@9e8d01178c767b734d2fef9a000ac2a2137f483f with: context: . push: ${{ inputs.push }} @@ -171,17 +171,17 @@ jobs: merge-multiple: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 with: images: ${{ inputs.registry }}/${{ inputs.image_name }} tags: ${{ inputs.tags }} - name: Log into registry ${{ inputs.registry }} - uses: docker/login-action@v3 + uses: docker/login-action@2ff7bc63ffa51414f77e9cbeea0d3297c1672d2e with: registry: ${{ inputs.registry }} username: ${{ inputs.registry_user }} From 8ab6d29fd20c6e466b0ea59f099b5cd46065defc Mon Sep 17 00:00:00 2001 From: Niklas Zender Date: Tue, 26 May 2026 11:34:27 +0200 Subject: [PATCH 2/2] chore: update GitHub Action pins Pin all external workflow actions to current upstream default-branch SHAs. --- .github/workflows/ansible-lint.yml | 2 +- .github/workflows/ansible-test.yml | 4 ++-- .github/workflows/authenticate-commits.yml | 2 +- .github/workflows/black.yml | 4 ++-- .github/workflows/docker.yml | 8 ++++---- .github/workflows/rust.yml | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml index 68e28ee..4c340e0 100644 --- a/.github/workflows/ansible-lint.yml +++ b/.github/workflows/ansible-lint.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 with: submodules: recursive path: "ansible_collections/${{ inputs.collection }}" diff --git a/.github/workflows/ansible-test.yml b/.github/workflows/ansible-test.yml index 17d52ee..5b44e57 100644 --- a/.github/workflows/ansible-test.yml +++ b/.github/workflows/ansible-test.yml @@ -36,7 +36,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 with: submodules: recursive path: "ansible_collections/${{ inputs.collection }}" @@ -65,7 +65,7 @@ jobs: ansible-test coverage xml - name: Upload test artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: ansible-test-${{ env.TESTING_PATH }}-${{ matrix.ansible_version }}-${{ matrix.python_version }} path: "ansible_collections/${{ inputs.collection }}/tests/output/" diff --git a/.github/workflows/authenticate-commits.yml b/.github/workflows/authenticate-commits.yml index 89587e7..314b756 100644 --- a/.github/workflows/authenticate-commits.yml +++ b/.github/workflows/authenticate-commits.yml @@ -14,4 +14,4 @@ jobs: steps: - name: Authenticating commits - uses: sequoia-pgp/authenticate-commits@v1 + uses: sequoia-pgp/authenticate-commits@7880c1fe9a32b85ba665e02fb827054a83627a04 diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml index ba5254b..0c642f9 100644 --- a/.github/workflows/black.yml +++ b/.github/workflows/black.yml @@ -20,12 +20,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 with: submodules: recursive path: "ansible_collections/${{ inputs.collection }}" - name: Run Black - uses: famedly/black@stable + uses: famedly/black@6af7d1109693c4ad3af08ecbc34649c232b47a6d with: options: "--check --verbose" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index b91ac5d..b79e3c5 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -82,7 +82,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 - name: Set up QEMU uses: docker/setup-qemu-action@7f9aaaffa50b7aa9d8d6f147ed9a1be21f255d98 @@ -92,7 +92,7 @@ jobs: - name: Download artifact if: ${{ inputs.artifact_name != '' }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317 with: name: ${{inputs.artifact_name}} path: ${{inputs.artifact_path}} @@ -144,7 +144,7 @@ jobs: touch "/tmp/digests/${digest#sha256:}" - name: Upload digest - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: digests-${{ steps.clean_registry.outputs.clean_registry }}-${{ inputs.image_name }}-${{ steps.tag.outputs.tags }}-${{ matrix.platform }} path: /tmp/digests/* @@ -164,7 +164,7 @@ jobs: echo "clean_registry=$(echo '${{ inputs.registry }}' | sed 's/\//-/g')" >> $GITHUB_OUTPUT - name: Download digests - uses: actions/download-artifact@v4 + uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317 with: path: /tmp/digests pattern: digests-${{ steps.clean_registry.outputs.clean_registry }}-${{ inputs.image_name }}-${{ needs.docker.outputs.tags }}-* diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 59d82b2..f7aa7e3 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 - name: Install additional dependencies if: inputs.extra_build_dependencies != '' @@ -25,7 +25,7 @@ jobs: sudo apt install -y ${{ inputs.extra_build_dependencies }} - name: Prepare login for private repos - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main + uses: famedly/backend-build-workflows/.github/actions/rust-prepare@fcc2ec82a725d5c4c9c6a8f19e8df101c178dcb6 with: gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY}}