Merge pull request #499 from stackhpc/pin-actions

priteau · web-flow · commit 39be3efac2e0 · 2026-04-02T14:27:22.000+02:00
Pin actions to latest commit
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -20,7 +20,7 @@ runs:
       shell: bash
 
     # Install python dependencies for ansible server side
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: 3.11.x
         # Cache Python dependencies
diff --git a/.github/actions/slack-alert/action.yml b/.github/actions/slack-alert/action.yml
@@ -32,8 +32,9 @@ runs:
   using: composite
   steps:
     - name: Send message to Slack via Workflow Builder
-      uses: slackapi/slack-github-action@v1.26.0
+      uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
       with:
+        webhook-type: "incoming-webhook"  
         payload: |
           {
             "channel-id": "${{ env.SLACK_CHANNEL_ID }}",
diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml
@@ -13,12 +13,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Python version must be pinned because of issue with Ubuntu permissions
       # See https://github.com/actions/runner-images/issues/11499  
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12' 
 
diff --git a/.github/workflows/ansible-validations.yml b/.github/workflows/ansible-validations.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
diff --git a/.github/workflows/container-promote-old.yml b/.github/workflows/container-promote-old.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
diff --git a/.github/workflows/container-promote.yml b/.github/workflows/container-promote.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
@@ -35,7 +35,7 @@ jobs:
           vault-password-file: ${{ env.ANSIBLE_VAULT_PASSWORD_FILE }}
 
       - name: Clone StackHPC Kayobe configuration repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: stackhpc/stackhpc-kayobe-config
           ref: refs/heads/${{ github.event.inputs.kayobe_config_branch }}
diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml
@@ -29,7 +29,7 @@ jobs:
     name: Publish container repositories
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
diff --git a/.github/workflows/container-sync.yml b/.github/workflows/container-sync.yml
@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 720
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
@@ -7,8 +7,8 @@ jobs:
     name: Build documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.x
       - run: pip install -r docs-requirements.txt
diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml
@@ -9,8 +9,8 @@ jobs:
     name: Publish documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.x
       - run: pip install -r docs-requirements.txt
diff --git a/.github/workflows/package-promote.yml b/.github/workflows/package-promote.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
@@ -36,7 +36,7 @@ jobs:
           vault-password-file: ${{ env.ANSIBLE_VAULT_PASSWORD_FILE }}
 
       - name: Clone StackHPC Kayobe configuration repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: stackhpc/stackhpc-kayobe-config
           ref: refs/heads/${{ github.event.inputs.kayobe_config_branch }}
diff --git a/.github/workflows/package-sync-nightly.yml b/.github/workflows/package-sync-nightly.yml
@@ -16,14 +16,14 @@ jobs:
       matrix: ${{ steps.matrix-build.outputs.matrix }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install dependencies
         run: |
           sudo apt update
 
       - name: Install yq
-        uses: dcarbone/install-yq-action@v1.3.1
+        uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
 
       - name: Create sync matrix
         id: matrix-build
diff --git a/.github/workflows/package-sync-version-test-pulp.yml b/.github/workflows/package-sync-version-test-pulp.yml
@@ -27,7 +27,7 @@ jobs:
         run: exit 1
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
diff --git a/.github/workflows/package-sync.yml b/.github/workflows/package-sync.yml
@@ -44,7 +44,7 @@ jobs:
     if: inputs.sync_ark
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
@@ -53,7 +53,7 @@ jobs:
           vault-password-file: ${{ env.ANSIBLE_VAULT_PASSWORD_FILE }}
 
       - name: Sync and publish package repositories in Ark
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 360
           max_attempts: 2
@@ -90,7 +90,7 @@ jobs:
     if: inputs.sync_test
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
@@ -99,7 +99,7 @@ jobs:
           vault-password-file: ${{ env.ANSIBLE_VAULT_PASSWORD_FILE }}
 
       - name: Sync and publish package repositories in test
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 360
           max_attempts: 2
diff --git a/.github/workflows/package-update-kayobe.yml b/.github/workflows/package-update-kayobe.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Release Train & dependencies
         uses: ./.github/actions/setup
@@ -31,7 +31,7 @@ jobs:
           vault-password-file: ${{ env.ANSIBLE_VAULT_PASSWORD_FILE }}
 
       - name: Clone StackHPC Kayobe configuration repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: stackhpc/stackhpc-kayobe-config
           ref: refs/heads/${{ github.event.inputs.kayobe_config_branch }}
@@ -61,7 +61,7 @@ jobs:
       # For now, just create an artifact that the user can download.
       - name: Upload pulp-repo-versions.yml artifact
         if: ${{ steps.git-diff.outputs.changed == 'true' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: pulp-repo-versions.yml
           path: stackhpc-kayobe-config/etc/kayobe/pulp-repo-versions.yml
diff --git a/.github/workflows/source-repo-sync.yml b/.github/workflows/source-repo-sync.yml
@@ -22,7 +22,7 @@ jobs:
           git config --global user.email "22933334+stackhpc-ci@users.noreply.github.com" &&
           git config --global user.name "stackhpc-ci"
       - name: GitHub checkout 🛎
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: "false"
       - name: Run ansible playbook 📖
diff --git a/.github/workflows/terraform-github-import.yml b/.github/workflows/terraform-github-import.yml
@@ -19,13 +19,13 @@ jobs:
         working-directory: "./terraform/github/"
     steps:
       - name: GitHub Checkout 🛎
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Python 🐍
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10.4"
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
         with:
           cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
           terraform_wrapper: false
diff --git a/.github/workflows/terraform-github.yml b/.github/workflows/terraform-github.yml
@@ -22,9 +22,9 @@ jobs:
       run:
         working-directory: "./terraform/github/"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
         with:
           cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
 
@@ -51,7 +51,7 @@ jobs:
       - name: Install fs module
         run: npm install fs
 
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: github.event_name == 'pull_request'
         with:
           github-token: ${{ secrets.repository_configuration_token }}
