From 94f57799d0d50020461850374afd4abc3c8e84e8 Mon Sep 17 00:00:00 2001 From: Alexander Brandes Date: Mon, 6 Mar 2023 13:51:53 +0100 Subject: [PATCH] Pin GH actions to SHA to avoid mutable refs (#2126) --- .../workflows/announce-release-on-discord.yml | 3 +-- .github/workflows/build-pr.yml | 8 +++----- .github/workflows/build.yml | 15 +++++++-------- .github/workflows/codeql.yml | 17 +++++------------ .github/workflows/release-drafter.yml | 6 ++---- .github/workflows/upload-release-assets.yml | 8 +++----- 6 files changed, 21 insertions(+), 36 deletions(-) diff --git a/.github/workflows/announce-release-on-discord.yml b/.github/workflows/announce-release-on-discord.yml index 78af47080..a37d1c443 100644 --- a/.github/workflows/announce-release-on-discord.yml +++ b/.github/workflows/announce-release-on-discord.yml @@ -4,7 +4,6 @@ on: workflows: ["Upload release assets"] types: - completed - jobs: send_announcement: runs-on: ubuntu-latest @@ -14,7 +13,7 @@ jobs: DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} DISCORD_USERNAME: FastAsyncWorldEdit Release DISCORD_AVATAR: https://raw.githubusercontent.com/IntellectualSites/Assets/main/plugins/FastAsyncWorldEdit/FastAsyncWorldEdit.png - uses: Ilshidur/action-discord@0.3.2 + uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # ratchet:Ilshidur/action-discord@0.3.2 with: args: | "<@&525015715300900875> <@&706463154804097105> <@&671372968462516240>" diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 597a64143..30871f791 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -1,19 +1,17 @@ name: Build PR - -on: [ pull_request ] - +on: [pull_request] jobs: build_pr: if: github.repository_owner == 'IntellectualSites' runs-on: ${{ matrix.os }} strategy: matrix: - os: [ ubuntu-latest, windows-latest, macos-latest ] + os: [ubuntu-latest, windows-latest, macos-latest] steps: - name: Checkout Repository uses: actions/checkout@v3 - name: Validate Gradle Wrapper - uses: gradle/wrapper-validation-action@v1 + uses: gradle/wrapper-validation-action@55e685c48d84285a5b0418cd094606e199cca3b6 # v1 - name: Setup Java uses: actions/setup-java@v3 with: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 444f5a958..54976a854 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,4 @@ name: Build - on: push: branches: @@ -11,8 +10,8 @@ jobs: steps: - name: Checkout Repository uses: actions/checkout@v3 - - name : Validate Gradle Wrapper - uses : gradle/wrapper-validation-action@v1 + - name: Validate Gradle Wrapper + uses: gradle/wrapper-validation-action@55e685c48d84285a5b0418cd094606e199cca3b6 # v1 - name: Setup Java uses: actions/setup-java@v3 with: @@ -45,7 +44,7 @@ jobs: ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_PASSWORD }} - name: Publish core javadoc if: ${{ runner.os == 'Linux' && env.STATUS == 'release' && github.event_name == 'push' && github.ref == 'refs/heads/main'}} - uses: cpina/github-action-push-to-another-repository@main + uses: cpina/github-action-push-to-another-repository@0a14457bb28b04dfa1652e0ffdfda866d2845c73 # main env: SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }} with: @@ -57,7 +56,7 @@ jobs: target-directory: worldedit-core - name: Publish bukkit javadoc if: ${{ runner.os == 'Linux' && env.STATUS == 'release' && github.event_name == 'push' && github.ref == 'refs/heads/main'}} - uses: cpina/github-action-push-to-another-repository@main + uses: cpina/github-action-push-to-another-repository@0a14457bb28b04dfa1652e0ffdfda866d2845c73 # main env: SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }} with: @@ -77,9 +76,9 @@ jobs: run: ./gradlew modrinth env: MODRINTH_TOKEN: ${{ secrets.MODRINTH_TOKEN }} - - name : Publish to CurseForge - if : ${{ runner.os == 'Linux' && env.STATUS == 'release' && github.event_name == 'push' && github.ref == 'refs/heads/main'}} - uses: itsmeow/curseforge-upload@v3 + - name: Publish to CurseForge + if: ${{ runner.os == 'Linux' && env.STATUS == 'release' && github.event_name == 'push' && github.ref == 'refs/heads/main'}} + uses: itsmeow/curseforge-upload@13f278adc4cc7b881555f87e6ea528387dd6492b # v3 with: file_path: worldedit-bukkit/build/libs/FastAsyncWorldEdit-Bukkit-${{ env.VERSION }}.jar # https://minecraft.curseforge.com/api/game/versions?token=redacted diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d5fa715d1..1f5f844a8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,10 +1,8 @@ name: "CodeQL" - on: pull_request: # The branches below must be a subset of the branches above - branches: [ main ] - + branches: [main] jobs: analyze: name: Analyze @@ -13,23 +11,18 @@ jobs: actions: read contents: read security-events: write - strategy: fail-fast: false matrix: - language: [ 'java' ] - + language: ['java'] steps: - name: Checkout repository uses: actions/checkout@v3 - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2 with: languages: ${{ matrix.language }} - - name: Autobuild - uses: github/codeql-action/autobuild@v2 - + uses: github/codeql-action/autobuild@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2 diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml index d5d529039..90248b436 100644 --- a/.github/workflows/release-drafter.yml +++ b/.github/workflows/release-drafter.yml @@ -1,14 +1,12 @@ name: draft release - on: push: branches: - main pull_request: - types: [ opened, reopened, synchronize ] + types: [opened, reopened, synchronize] pull_request_target: - types: [ opened, reopened, synchronize ] - + types: [opened, reopened, synchronize] jobs: update_release_draft: if: ${{ github.event_name != 'pull_request' || github.repository != github.event.pull_request.head.repo.full_name }} diff --git a/.github/workflows/upload-release-assets.yml b/.github/workflows/upload-release-assets.yml index 93587ed76..485919fc1 100644 --- a/.github/workflows/upload-release-assets.yml +++ b/.github/workflows/upload-release-assets.yml @@ -1,17 +1,15 @@ name: Upload release assets - on: release: types: [published] - jobs: upload_asset: runs-on: ubuntu-latest steps: - name: Checkout Repository uses: actions/checkout@v3 - - name : Validate Gradle Wrapper - uses : gradle/wrapper-validation-action@v1 + - name: Validate Gradle Wrapper + uses: gradle/wrapper-validation-action@55e685c48d84285a5b0418cd094606e199cca3b6 # v1 - name: Setup Java uses: actions/setup-java@v3 with: @@ -21,7 +19,7 @@ jobs: - name: Clean Build run: ./gradlew clean build --no-daemon - name: Upload Release Assets - uses: AButler/upload-release-assets@v2.0 + uses: AButler/upload-release-assets@ec6d3263266dc57eb6645b5f75e827987f7c217d # ratchet:AButler/upload-release-assets@v2.0 with: files: 'worldedit-bukkit/build/libs/FastAsyncWorldEdit-Bukkit-*.jar' repo-token: ${{ secrets.GITHUB_TOKEN }}