chore(ci): pin actions to sha for hardening

dj95 · Jun 11, 2024 · 21a077f · 21a077f
1 parent 8d524be
commit 21a077f
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 11 deletions.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -1,3 +1,4 @@
+---
 on: push
 name: Test & Lint
 
@@ -9,28 +10,28 @@ jobs:
   clippy_check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f  # stable
         with:
           toolchain: '1.76.0'
           target: wasm32-wasi
           components: clippy
 
       - name: Run Clippy
-        uses: clechasseur/rs-clippy-check@v3
+        uses: clechasseur/rs-clippy-check@6489db34e7d7a162364f8ee3d7ad2cd1060dc1d7  # v3
         with:
           args: --all-features --all-targets
 
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: jcbhmr/setup-wasmtime@v2
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4
+      - uses: jcbhmr/setup-wasmtime@960c367a99921eb0b02f5778fce9ae8f110bf0f0  # v2
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f  # stable
         with:
           toolchain: '1.76.0'
           target: wasm32-wasi

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -14,12 +14,12 @@ jobs:
       RUST_BACKTRACE: 1
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4
         with:
           fetch-tags: true
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f  # stable
         with:
           toolchain: '1.76.0'
           profile: minimal
@@ -30,7 +30,7 @@ jobs:
         run: cargo build --release
 
       - name: Generate a changelog
-        uses: orhun/git-cliff-action@v3
+        uses: orhun/git-cliff-action@5594a53dc7c8647d85bd3d4da4ca78d3aa3dca4c  # v3
         id: git-cliff
         with:
           config: cliff.toml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Create release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e  # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -51,7 +51,7 @@ jobs:
           prerelease: false
 
       - name: Upload wasm file to release
-        uses: actions/[email protected]
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5  # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: