diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 109f058..4131a59 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@6c3b1c91e8873ae0c705b0709f957c7a6a5eaf10 + - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd with: disable-sudo: true egress-policy: block @@ -24,17 +24,17 @@ jobs: raw.githubusercontent.com:443 - name: Checkout repo - uses: actions/checkout@8459bc0c7e3759cdf591f513d9f141a95fef0a8f + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: Setup Go - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 + uses: actions/setup-go@4ab57d7ea2fd0c9948210b2e0784e280674e7144 with: go-version-file: ./go.mod # Linting - name: Linting - uses: golangci/golangci-lint-action@692c9c9dba385536b59da68da5aef1775a6f94ea + uses: golangci/golangci-lint-action@031a2fcd4afedd71ec636137da88172250868de4 with: version: latest args: --config=./.github/.golangci.yml ./... @@ -48,7 +48,7 @@ jobs: matrix: go: [ '1.22', '1.21' ] steps: - - uses: step-security/harden-runner@6c3b1c91e8873ae0c705b0709f957c7a6a5eaf10 + - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd with: disable-sudo: true egress-policy: block @@ -59,11 +59,11 @@ jobs: sum.golang.org:443 - name: Checkout repo - uses: actions/checkout@8459bc0c7e3759cdf591f513d9f141a95fef0a8f + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: Setup Go - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 + uses: actions/setup-go@4ab57d7ea2fd0c9948210b2e0784e280674e7144 with: go-version: ${{ matrix.go }} @@ -75,7 +75,7 @@ jobs: name: Analyze runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@6c3b1c91e8873ae0c705b0709f957c7a6a5eaf10 + - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd with: disable-sudo: true egress-policy: block @@ -92,11 +92,11 @@ jobs: storage.googleapis.com:443 - name: Checkout repo - uses: actions/checkout@8459bc0c7e3759cdf591f513d9f141a95fef0a8f + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: Setup Go - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 + uses: actions/setup-go@4ab57d7ea2fd0c9948210b2e0784e280674e7144 with: go-version-file: ./go.mod @@ -106,7 +106,7 @@ jobs: # Codecov - name: Codecov - uses: codecov/codecov-action@1290bddc8851afa46a03b9a73dd9979a415d4c4f + uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -114,7 +114,7 @@ jobs: # Sonar - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@6bbd64e0cb2194e04addb429d669a9ee873eeeef + uses: SonarSource/sonarcloud-github-action@e44258b109568baa0df60ed515909fc6c72cba92 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6ebbc46..e9413cb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,22 +26,22 @@ jobs: fail-fast: false steps: - - uses: step-security/harden-runner@6c3b1c91e8873ae0c705b0709f957c7a6a5eaf10 + - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd with: disable-sudo: true egress-policy: audit - name: Checkout repository - uses: actions/checkout@27135e314dd1818f797af1db9dae03a9f045786b + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@231aa2c8a89117b126725a0e11897209b7118144 + uses: github/codeql-action/init@3990b56b853b2d9e468e2b6db750095ecd790cf1 with: languages: go - name: Autobuild - uses: github/codeql-action/autobuild@231aa2c8a89117b126725a0e11897209b7118144 + uses: github/codeql-action/autobuild@3990b56b853b2d9e468e2b6db750095ecd790cf1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@231aa2c8a89117b126725a0e11897209b7118144 + uses: github/codeql-action/analyze@3990b56b853b2d9e468e2b6db750095ecd790cf1 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index b7c346f..58b1dea 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -22,7 +22,7 @@ jobs: id-token: write steps: - - uses: step-security/harden-runner@6c3b1c91e8873ae0c705b0709f957c7a6a5eaf10 + - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd with: disable-sudo: true egress-policy: block @@ -38,12 +38,12 @@ jobs: www.bestpractices.dev:443 - name: "Checkout code" - uses: actions/checkout@8459bc0c7e3759cdf591f513d9f141a95fef0a8f + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@fad9a3cc533bb069b1f01f272f1f630895cd690a + uses: ossf/scorecard-action@0a8153a7e8d76932ff5903ccdbed894237ef223d with: results_file: results.sarif results_format: sarif @@ -69,6 +69,6 @@ jobs: # required for Code scanning alerts - name: "Upload SARIF results to code scanning" - uses: github/codeql-action/upload-sarif@4ebadbc7468649cf79b138f45e20d999351f6ed0 + uses: github/codeql-action/upload-sarif@3990b56b853b2d9e468e2b6db750095ecd790cf1 with: sarif_file: results.sarif diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index 354fb91..4d7e931 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -17,7 +17,7 @@ jobs: name: Snyk runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@6c3b1c91e8873ae0c705b0709f957c7a6a5eaf10 + - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd with: disable-sudo: true egress-policy: block @@ -26,9 +26,9 @@ jobs: github.com:443 proxy.golang.org:443 - - uses: actions/checkout@8459bc0c7e3759cdf591f513d9f141a95fef0a8f + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/golang@8349f9043a8b7f0f3ee8885bf28f0b388d2446e8 + uses: snyk/actions/golang@d406fd286b663eb8c6f8adcced4f7bcd199c0a3f env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} with: