Merge pull request #77 from fac/devp/pin-action-shas

Pin GitHub Actions to specific commit SHAs

Author: DuncSmith

.github/workflows/check-pinned-actions.yml

@@ -0,0 +1,11 @@
+name: Check actions have their versions pinned
+
+on:
+  push:
+    paths:
+      - '.github/workflows/*.yml'
+      - '.github/workflows/*.yaml'
+
+jobs:
+  pinact:
+    uses: fac/shared-workflows/.github/workflows/check_pinned_actions.yml@main

.github/workflows/release_gem.yml

@@ -16,8 +16,8 @@ jobs:
 
     steps:
     # Build the gem package
-    - uses: actions/checkout@v6
-    - uses: ruby/setup-ruby@v1.308.0
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0
       with:
         bundler-cache: true
 
@@ -27,4 +27,4 @@ jobs:
 
     # Release
     - name: Release to RubyGems.org
-      uses: rubygems/release-gem@v1
+      uses: rubygems/release-gem@f0d7faff26625599a847d40d9fa28ace24c2aacc # v1

.github/workflows/tests.yml

@@ -8,9 +8,9 @@ jobs:
     name: Run tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1.308.0
+      uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1.308.0
       with:
         bundler-cache: true
     - name: Run tests and rubocop

.pinact.yaml

@@ -0,0 +1,4 @@
+version: 3
+ignore_actions:
+  - name: fac/.*
+    ref: ^main$