Skip to content

Commit e7eba87

Browse files
PrekshithD-MicrosoftPrekshithD-Microsoft
committed
Pin GitHub Actions to commit SHAs
1 parent ee285e8 commit e7eba87

22 files changed

Lines changed: 64 additions & 64 deletions

‎.github/workflows/agnext-biab-02-containerimage.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,26 +16,26 @@ jobs:
1616
packages: write
1717
steps:
1818
- name: Checkout repository
19-
uses: actions/checkout@v6
19+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
2020
# - name: Download deps
2121
# run: |
2222
# curl -fsSL ${{ vars.AUTOGEN_WHL_URL }} -o agnext-biab-02/autogen_core-0.3.dev0-py3-none-any.whl
2323
- name: Log in to the Container registry
24-
uses: docker/login-action@v4
24+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
2525
with:
2626
registry: ${{ env.REGISTRY }}
2727
username: ${{ github.actor }}
2828
password: ${{ secrets.GITHUB_TOKEN }}
2929
- name: Extract metadata (tags, labels) for Docker
3030
id: meta
31-
uses: docker/metadata-action@v6
31+
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
3232
with:
3333
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
3434
tags: |
3535
type=ref,event=branch
3636
type=sha
3737
- name: Build and push Docker image
38-
uses: docker/build-push-action@v7
38+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
3939
with:
4040
context: agnext-biab-02/
4141
file: agnext-biab-02/Dockerfile

‎.github/workflows/azd-template-validation.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ jobs:
1515
name: azd template validation
1616
environment: production
1717
steps:
18-
- uses: actions/checkout@v6
18+
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
1919

2020
- name: Set timestamp
2121
run: echo "HHMM=$(date -u +'%H%M')" >> $GITHUB_ENV
2222

23-
- uses: microsoft/template-validation-action@v0.4.4
23+
- uses: microsoft/template-validation-action@bae4895d0a8abd4f0d5aad68ae8647b3027f4c91 # v0.4.4
2424
with:
2525
validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }}
2626
validateTests: ${{ vars.TEMPLATE_VALIDATE_TESTS }}

‎.github/workflows/azure-dev.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,18 @@ jobs:
2323
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
2424
steps:
2525
- name: Checkout Code
26-
uses: actions/checkout@v6
26+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
2727

2828
- name: Set timestamp and env name
2929
run: |
3030
HHMM=$(date -u +'%H%M')
3131
echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV
3232
3333
- name: Install azd
34-
uses: Azure/setup-azd@v2
34+
uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2
3535

3636
- name: Login to Azure
37-
uses: azure/login@v3
37+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
3838
with:
3939
client-id: ${{ secrets.AZURE_CLIENT_ID }}
4040
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/broken-links-checker.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Checkout Repo
19-
uses: actions/checkout@v6
19+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
2020
with:
2121
fetch-depth: 0
2222

@@ -34,7 +34,7 @@ jobs:
3434
- name: Check Broken Links in Changed Markdown Files
3535
id: lychee-check-pr
3636
if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true'
37-
uses: lycheeverse/lychee-action@v2.8.0
37+
uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
3838
with:
3939
args: >
4040
--verbose --no-progress --exclude ^https?://
@@ -47,7 +47,7 @@ jobs:
4747
- name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger)
4848
id: lychee-check-manual
4949
if: github.event_name == 'workflow_dispatch'
50-
uses: lycheeverse/lychee-action@v2.8.0
50+
uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
5151
with:
5252
args: >
5353
--verbose --no-progress --exclude ^https?://

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,11 @@ jobs:
7171
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
7272
steps:
7373
- name: Checkout repository
74-
uses: actions/checkout@v6
74+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
7575

7676
# Initializes the CodeQL tools for scanning.
7777
- name: Initialize CodeQL
78-
uses: github/codeql-action/init@v4
78+
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
7979
with:
8080
languages: ${{ matrix.language }}
8181
build-mode: ${{ matrix.build-mode }}
@@ -103,6 +103,6 @@ jobs:
103103
exit 1
104104
105105
- name: Perform CodeQL Analysis
106-
uses: github/codeql-action/analyze@v4
106+
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
107107
with:
108108
category: "/language:${{matrix.language}}"

‎.github/workflows/deploy-waf.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
GPT_5_4_MIN_CAPACITY: 1
2626
steps:
2727
- name: Checkout Code
28-
uses: actions/checkout@v6
28+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
2929

3030
- name: Login to Azure
31-
uses: azure/login@v3
31+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
3232
with:
3333
client-id: ${{ secrets.AZURE_CLIENT_ID }}
3434
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/deploy.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ jobs:
3333
CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
3434
steps:
3535
- name: Checkout Code
36-
uses: actions/checkout@v6
36+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
3737

3838
- name: Login to Azure
39-
uses: azure/login@v3
39+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
4040
with:
4141
client-id: ${{ secrets.AZURE_CLIENT_ID }}
4242
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -226,7 +226,7 @@ jobs:
226226
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
227227
steps:
228228
- name: Login to Azure
229-
uses: azure/login@v3
229+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
230230
with:
231231
client-id: ${{ secrets.AZURE_CLIENT_ID }}
232232
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/docker-build-and-push.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,14 @@ jobs:
5454

5555
steps:
5656
- name: Checkout repository
57-
uses: actions/checkout@v6
57+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
5858

5959
- name: Set up Docker Buildx
60-
uses: docker/setup-buildx-action@v4
60+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
6161

6262
- name: Login to Azure
6363
if: ${{ github.ref_name == 'main' || github.ref_name == 'dev'|| github.ref_name == 'demo-v4' || github.ref_name == 'hotfix' }}
64-
uses: azure/login@v3
64+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
6565
with:
6666
client-id: ${{ secrets.AZURE_CLIENT_ID }}
6767
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -103,7 +103,7 @@ jobs:
103103
echo "HISTORICAL_TAG=${{ env.TAG }}_${DATE_TAG}_${RUN_ID}" >> $GITHUB_ENV
104104
105105
- name: Build and optionally push Backend Docker image
106-
uses: docker/build-push-action@v7
106+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
107107
with:
108108
context: ./src/backend
109109
file: ./src/backend/Dockerfile
@@ -113,7 +113,7 @@ jobs:
113113
${{ steps.registry.outputs.ext_registry }}/macaebackend:${{ env.HISTORICAL_TAG }}
114114
115115
- name: Build and optionally push Frontend Docker image
116-
uses: docker/build-push-action@v7
116+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
117117
with:
118118
context: ./src/App
119119
file: ./src/App/Dockerfile
@@ -123,7 +123,7 @@ jobs:
123123
${{ steps.registry.outputs.ext_registry }}/macaefrontend:${{ env.HISTORICAL_TAG }}
124124
125125
- name: Build and optionally push MCP Docker image
126-
uses: docker/build-push-action@v7
126+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
127127
with:
128128
context: ./src/mcp_server
129129
file: ./src/mcp_server/Dockerfile

‎.github/workflows/job-cleanup-deployment.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
steps:
5757

5858
- name: Login to Azure
59-
uses: azure/login@v3
59+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
6060
with:
6161
client-id: ${{ secrets.AZURE_CLIENT_ID }}
6262
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/job-deploy-linux.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ jobs:
5858
MACAE_URL_API: ${{ steps.get_output_linux.outputs.BACKEND_URL }}
5959
steps:
6060
- name: Checkout Code
61-
uses: actions/checkout@v6
61+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
6262

6363
- name: Validate Workflow Input Parameters
6464
shell: bash
@@ -222,10 +222,10 @@ jobs:
222222
fi
223223
224224
- name: Install azd
225-
uses: Azure/setup-azd@v2
225+
uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2
226226

227227
- name: Login to Azure
228-
uses: azure/login@v3
228+
uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
229229
with:
230230
client-id: ${{ secrets.AZURE_CLIENT_ID }}
231231
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -331,7 +331,7 @@ jobs:
331331
echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
332332
333333
- name: Refresh Azure login # token expires for WAF deployments due to long deployment time
334-
uses: azure/login@v2
334+
uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
335335
with:
336336
client-id: ${{ secrets.AZURE_CLIENT_ID }}
337337
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

0 commit comments

Comments
 (0)