From ee51d25cf6fe4ee2d15ce2ad9825ae74de9508ca Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 5 Sep 2026 21:19:44 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/tf-drift.yml | 10 +++++----- .github/workflows/tf-plan-apply.yml | 14 +++++++------- .github/workflows/tf-unit-tests.yml | 6 +++--- 4 files changed, 24 insertions(+), 15 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7602182..c325a14 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,12 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/tf-drift.yml b/.github/workflows/tf-drift.yml index 200b900..bbad3e2 100644 --- a/.github/workflows/tf-drift.yml +++ b/.github/workflows/tf-drift.yml @@ -30,11 +30,11 @@ jobs: steps: # Checkout the repository to the GitHub Actions runner - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Install the latest version of the Terraform CLI - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_wrapper: false @@ -61,7 +61,7 @@ jobs: # Save plan to artifacts - name: Publish Terraform Plan - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: tfplan path: tfplan @@ -93,7 +93,7 @@ jobs: # If changes are detected, create a new issue - name: Publish Drift Report if: steps.tf-plan.outputs.exitcode == 2 - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 env: SUMMARY: "${{ steps.tf-plan-string.outputs.summary }}" with: @@ -141,7 +141,7 @@ jobs: # If changes aren't detected, close any open drift issues - name: Publish Drift Report if: steps.tf-plan.outputs.exitcode == 0 - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/tf-plan-apply.yml b/.github/workflows/tf-plan-apply.yml index d0a9b83..e61a9b5 100644 --- a/.github/workflows/tf-plan-apply.yml +++ b/.github/workflows/tf-plan-apply.yml @@ -33,11 +33,11 @@ jobs: steps: # Checkout the repository to the GitHub Actions runner - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Install the latest version of the Terraform CLI - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_wrapper: false @@ -69,7 +69,7 @@ jobs: # Save plan to artifacts - name: Publish Terraform Plan - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: tfplan path: tfplan @@ -101,7 +101,7 @@ jobs: # If this is a PR post the changes - name: Push Terraform Output to PR if: github.ref != 'refs/heads/main' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 env: SUMMARY: "${{ steps.tf-plan-string.outputs.summary }}" with: @@ -125,11 +125,11 @@ jobs: steps: # Checkout the repository to the GitHub Actions runner - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc. - name: Terraform Init @@ -137,7 +137,7 @@ jobs: # Download saved plan from artifacts - name: Download Terraform Plan - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: tfplan diff --git a/.github/workflows/tf-unit-tests.yml b/.github/workflows/tf-unit-tests.yml index 67bfdd4..e1f3c69 100644 --- a/.github/workflows/tf-unit-tests.yml +++ b/.github/workflows/tf-unit-tests.yml @@ -16,11 +16,11 @@ jobs: steps: # Checkout the repository to the GitHub Actions runner - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc. - name: Terraform Init @@ -44,7 +44,7 @@ jobs: # Upload results to GitHub Advanced Security - name: Upload SARIF file if: success() || failure() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 with: sarif_file: results.sarif category: checkov