From 29ec641b9e4e86495e6335fefcb60eb451c41d90 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20K=C3=B6ssler?= Date: Fri, 21 Aug 2026 16:00:34 +0200 Subject: [PATCH] Update, pin and harden GH actions --- .github/workflows/benchmark.yml | 35 +++++++++++++++++----------- .github/workflows/end2end.yml | 10 ++++---- .github/workflows/lint.yml | 6 +++-- .github/workflows/publish.yml | 8 +++++-- .github/workflows/qa-tests.yml | 8 ++++--- .github/workflows/smoke-test-ffi.yml | 6 +++-- .github/workflows/test-publish.yml | 9 +++++-- .github/workflows/unit-test.yml | 8 ++++--- 8 files changed, 58 insertions(+), 32 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index a4b067f1f..338ee8122 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -11,13 +11,16 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Start databases - working-directory: ./sample-apps/databases + working-directory: ./sample-apps/databases run: docker compose up --build -d - name: Set up Python 3.9 - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.9 - name: Setup safe-chain @@ -46,12 +49,14 @@ jobs: python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"] steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Start databases - working-directory: ./sample-apps/databases + working-directory: ./sample-apps/databases run: docker compose up --build -d - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Install dependencies & build @@ -63,7 +68,7 @@ jobs: run: nohup make runBenchmark & nohup make runZenDisabled & - name: Check app health (max 3 attempts) - uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 with: timeout_minutes: 5 max_attempts: 3 @@ -72,9 +77,9 @@ jobs: cd ./sample-apps/flask-mysql && make health-check - name: Install K6 - uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1 + uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1 - name: Run flask-mysql k6 Benchmark (max 3 attempts) - uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 with: timeout_minutes: 20 max_attempts: 3 @@ -94,12 +99,14 @@ jobs: python-version: "3.14" steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Start databases - working-directory: ./sample-apps/databases + working-directory: ./sample-apps/databases run: docker compose up --build -d - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Install dependencies & build @@ -111,7 +118,7 @@ jobs: run: nohup make runBenchmark & nohup make runZenDisabled & - name: Check app health (max 3 attempts) - uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 with: timeout_minutes: 5 max_attempts: 3 @@ -124,7 +131,7 @@ jobs: sudo apt-get update sudo apt-get install -y wrk - name: Run benchmarks (max 3 attempts) - uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 with: timeout_minutes: 20 max_attempts: 3 diff --git a/.github/workflows/end2end.yml b/.github/workflows/end2end.yml index 627db816c..62df2b8d4 100644 --- a/.github/workflows/end2end.yml +++ b/.github/workflows/end2end.yml @@ -7,13 +7,15 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install poetry run: pip install poetry - name: Build run: make build - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: pkg-build path: ./ @@ -46,7 +48,7 @@ jobs: - name: Install packages run: sudo apt update && sudo apt install python3-dev libmysqlclient-dev - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: pkg-build @@ -59,7 +61,7 @@ jobs: docker run --name mock_core -d -p 5000:5000 mock_core - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Setup safe-chain diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 05fff4e38..6d88d5e38 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -9,10 +9,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.14' - name: Setup safe-chain diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 88b225638..ddaec2383 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -11,7 +11,9 @@ jobs: name: Linting and running tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Start databases working-directory: ./sample-apps/databases run: docker compose up --build -d @@ -54,7 +56,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install poetry run: pip install poetry - name: Set the version for this release diff --git a/.github/workflows/qa-tests.yml b/.github/workflows/qa-tests.yml index 83098483c..765c741dd 100644 --- a/.github/workflows/qa-tests.yml +++ b/.github/workflows/qa-tests.yml @@ -11,20 +11,22 @@ jobs: timeout-minutes: 30 steps: - name: Checkout firewall-python - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: firewall-python + persist-credentials: false - name: Checkout zen-demo-python - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Aikido-demo-apps/zen-demo-python path: zen-demo-python ref: qa-test submodules: true + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.14" - name: Setup safe-chain diff --git a/.github/workflows/smoke-test-ffi.yml b/.github/workflows/smoke-test-ffi.yml index 266ee1000..08a90c4b8 100644 --- a/.github/workflows/smoke-test-ffi.yml +++ b/.github/workflows/smoke-test-ffi.yml @@ -18,10 +18,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.14 diff --git a/.github/workflows/test-publish.yml b/.github/workflows/test-publish.yml index 7ffbaa888..b619b106d 100644 --- a/.github/workflows/test-publish.yml +++ b/.github/workflows/test-publish.yml @@ -12,7 +12,10 @@ jobs: name: Linting and running tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Start databases working-directory: ./sample-apps/databases run: docker compose up --build -d @@ -55,7 +58,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install poetry run: pip install poetry - name: Set the version for this release diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index e6b95499b..aea828031 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -15,7 +15,9 @@ jobs: python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"] steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Start databases working-directory: ./sample-apps/databases @@ -29,7 +31,7 @@ jobs: docker run --name mock_core -d -p 5050:5000 mock_core - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Setup safe-chain @@ -44,7 +46,7 @@ jobs: make cov - name: Upload coverage report to Codecov - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: fail_ci_if_error: true files: ./coverage.xml