From 59bec5cf91d03d112131ed9948f72055b0cc1329 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 7 Oct 2026 17:24:57 -0400 Subject: [PATCH 1/4] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 + .github/workflows/build-git-installers.yml | 58 ++++++++--------- .github/workflows/check-style.yml | 2 +- .github/workflows/check-whitespace.yml | 2 +- .github/workflows/codeql.yml | 10 +-- .github/workflows/coverity.yml | 8 +-- .github/workflows/l10n.yml | 4 +- .github/workflows/main.yml | 64 +++++++++---------- .github/workflows/nano-server.yml | 4 +- .github/workflows/scalar-functional-tests.yml | 12 ++-- .github/workflows/vfs-functional-tests.yml | 12 ++-- 11 files changed, 90 insertions(+), 88 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 22d5376407abf1..453393a180dfa6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,3 +11,5 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/build-git-installers.yml b/.github/workflows/build-git-installers.yml index 1bfdb13484a42a..50a5589ee94b9e 100644 --- a/.github/workflows/build-git-installers.yml +++ b/.github/workflows/build-git-installers.yml @@ -41,7 +41,7 @@ jobs: echo "version=${GITHUB_REF#refs/tags/v}" >>$GITHUB_OUTPUT id: tag - name: Clone git - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Validate the tag identified with trigger run: | die () { @@ -97,7 +97,7 @@ jobs: git config --global user.name "$USER_NAME" && git config --global user.email "$USER_EMAIL" && echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 with: flavor: build-installers architecture: ${{ matrix.arch.name }} @@ -117,7 +117,7 @@ jobs: git fetch "https://github.com/${{github.repository}}" refs/tags/${tag_name}:refs/tags/${tag_name} && git reset --hard ${tag_name} - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -186,7 +186,7 @@ jobs: git commit -s -m "mingw-w64-git: new version ($version)" PKGBUILD && git bundle create "$b"/MINGW-packages.bundle origin/main..main) - name: Publish mingw-w64-${{matrix.arch.toolchain}}-git - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "${{ matrix.arch.artifact }}" path: artifacts @@ -217,11 +217,11 @@ jobs: runs-on: ${{ matrix.arch.runner }} steps: - name: Download ${{ matrix.arch.artifact }} - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ matrix.arch.artifact }} path: ${{ matrix.arch.artifact }} - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 with: flavor: build-installers architecture: ${{ matrix.arch.name }} @@ -230,7 +230,7 @@ jobs: run: | git clone --filter=blob:none --single-branch -b main https://github.com/git-for-windows/build-extra /usr/src/build-extra - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 if: env.DO_WIN_CODESIGN == 'true' with: client-id: ${{ secrets.AZURE_CLIENT_ID }} @@ -238,7 +238,7 @@ jobs: subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) if: env.DO_WIN_CODESIGN == 'true' - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: path: git - name: Download code signing secrets @@ -384,7 +384,7 @@ jobs: } exit $ret - name: Publish ${{matrix.type.name}}-${{matrix.arch.name}} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: win-${{matrix.type.name}}-${{matrix.arch.name}} path: artifacts @@ -399,7 +399,7 @@ jobs: environment: release steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: path: git @@ -426,7 +426,7 @@ jobs: lipo -create -output libintl.a /usr/local/opt/gettext/lib/libintl.a /opt/homebrew/opt/gettext/lib/libintl.a - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -578,7 +578,7 @@ jobs: mv git/.github/macos-installer/disk-image/*.pkg git/.github/macos-installer/ - name: Upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: macos-artifacts path: | @@ -631,7 +631,7 @@ jobs: tar -C /__e/node20 -x --strip-components=1 -f /tmp/node.tar.gz - name: Clone git - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: path: git @@ -695,7 +695,7 @@ jobs: mv "$PKGNAME.deb" "$GITHUB_WORKSPACE" - name: Upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: linux-unsigned-${{ matrix.arch.name }} path: | @@ -710,14 +710,14 @@ jobs: environment: release steps: - name: Log into Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: path: git @@ -754,7 +754,7 @@ jobs: /usr/lib/gnupg2/gpg-preset-passphrase --preset '${{ steps.gpg-secrets.outputs.keygrip }}' <<<'${{ steps.gpg-secrets.outputs.passphrase }}' - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: linux-unsigned-${{ matrix.arch }} @@ -765,7 +765,7 @@ jobs: debsigs --sign=origin --verify --check microsoft-git_"$version"_${{ matrix.arch }}.deb - name: Upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: linux-${{ matrix.arch }} path: | @@ -800,7 +800,7 @@ jobs: needs: [prereqs, windows_artifacts, create-macos-artifacts, create-linux-artifacts] steps: - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ matrix.component.artifact }} @@ -864,56 +864,56 @@ jobs: needs.windows_artifacts.result == 'success') steps: - name: Download Windows portable (x86_64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: win-portable-x86_64 path: win-portable-x86_64 - name: Download Windows portable (aarch64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: win-portable-aarch64 path: win-portable-aarch64 - name: Download Windows installer (x86_64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: win-installer-x86_64 path: win-installer-x86_64 - name: Download Windows installer (aarch64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: win-installer-aarch64 path: win-installer-aarch64 - name: Download macOS artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: macos-artifacts path: macos-artifacts - name: Download Debian package (amd64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: linux-amd64 path: deb-package - name: Download Debian package (arm64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: linux-arm64 path: deb-package - name: Log into Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: path: git @@ -924,7 +924,7 @@ jobs: secrets: | ${{ secrets.LINUX_GPG_PUBLIC_SECRET_NAME }} base64> deb-package/msft-git-public.asc - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/check-style.yml b/.github/workflows/check-style.yml index 72e66762601413..5602082fe89141 100644 --- a/.github/workflows/check-style.yml +++ b/.github/workflows/check-style.yml @@ -20,7 +20,7 @@ jobs: jobname: ClangFormat runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml index 7a35b67a636acc..f0770954ce66ee 100644 --- a/.github/workflows/check-whitespace.yml +++ b/.github/workflows/check-whitespace.yml @@ -19,7 +19,7 @@ jobs: check-whitespace: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1ab0b2d68f6a98..a6b5f2658aea45 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install dependencies run: ci/install-dependencies.sh @@ -34,7 +34,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} config-file: ./.github/codeql/codeql-config.yml @@ -46,7 +46,7 @@ jobs: make -j$(nproc) - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: upload: False output: sarif-results @@ -56,12 +56,12 @@ jobs: run: ls -la sarif-results - name: publish sarif for debugging - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sarif-results-${{ matrix.language }} path: sarif-results - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: sarif-results/${{ matrix.language }}.sarif diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 1f393e2d680bce..8dcbe62afc6ffc 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -39,10 +39,10 @@ jobs: COVERITY_PLATFORM: overridden-below NO_RUST: Yup steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: install minimal Git for Windows SDK if: contains(matrix.os, 'windows') - uses: git-for-windows/setup-git-for-windows-sdk@v2 + uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - run: ci/install-dependencies.sh if: contains(matrix.os, 'ubuntu') || contains(matrix.os, 'macos') env: @@ -99,7 +99,7 @@ jobs: # A cache miss will add ~30s to create, but a cache hit will save minutes. - name: restore the Coverity Build Tool id: cache - uses: actions/cache/restore@v5 + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ${{ runner.temp }}/cov-analysis key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }} @@ -142,7 +142,7 @@ jobs: esac - name: cache the Coverity Build Tool if: steps.cache.outputs.cache-hit != 'true' - uses: actions/cache/save@v5 + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ${{ runner.temp }}/cov-analysis key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }} diff --git a/.github/workflows/l10n.yml b/.github/workflows/l10n.yml index 114a12a9e59f60..ec6dbab276f30b 100644 --- a/.github/workflows/l10n.yml +++ b/.github/workflows/l10n.yml @@ -63,7 +63,7 @@ jobs: origin \ ${{ github.ref }} \ $args - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: '>=1.16' cache: false @@ -92,7 +92,7 @@ jobs: cat git-po-helper.out exit $exit_code - name: Create comment in pull request for report - uses: mshick/add-pr-comment@v3 + uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3.12.0 if: >- always() && github.event_name == 'pull_request_target' && diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9bc5ef24b40e0e..e24935e8f14b0d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -63,7 +63,7 @@ jobs: echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT - name: skip if the commit or tree was already tested id: skip-if-redundant - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 if: steps.check-ref.outputs.enabled == 'yes' with: github-token: ${{secrets.GITHUB_TOKEN}} @@ -112,8 +112,8 @@ jobs: group: windows-build-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - name: build shell: bash env: @@ -123,7 +123,7 @@ jobs: - name: zip up tracked files run: git archive -o artifacts/tracked.tar.gz HEAD - name: upload tracked files and build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-artifacts path: artifacts @@ -140,14 +140,14 @@ jobs: cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - name: download tracked files and build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: windows-artifacts path: ${{github.workspace}} - name: extract tracked files and build artifacts shell: bash run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - name: test shell: bash run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10 @@ -157,7 +157,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: failed-tests-windows-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -176,20 +176,20 @@ jobs: group: vs-build-${{ github.ref }}-${{ matrix.arch }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - name: initialize vcpkg - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: 'microsoft/vcpkg' path: 'compat/vcbuild/vcpkg' - name: download vcpkg artifacts - uses: git-for-windows/get-azure-pipelines-artifact@v0 + uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0.3.1 with: repository: git/git definitionId: 9 - name: add msbuild to PATH - uses: microsoft/setup-msbuild@v3 + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0 - name: copy dlls to root shell: cmd run: compat\vcbuild\vcpkg_copy_dlls.bat release ${{ matrix.arch }}-windows @@ -216,7 +216,7 @@ jobs: - name: zip up tracked files run: git archive -o artifacts/tracked.tar.gz HEAD - name: upload tracked files and build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: vs-artifacts-${{ matrix.arch }} path: artifacts @@ -232,9 +232,9 @@ jobs: group: vs-test-${{ matrix.nr }}-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - name: download tracked files and build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: vs-artifacts-x64 path: ${{github.workspace}} @@ -252,7 +252,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: failed-tests-windows-vs-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -266,8 +266,8 @@ jobs: group: windows-meson-build-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - name: Set up dependencies shell: pwsh run: pip install meson ninja @@ -278,7 +278,7 @@ jobs: shell: pwsh run: meson compile -C build - name: Upload build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-meson-artifacts path: build @@ -294,13 +294,13 @@ jobs: group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - name: Set up dependencies shell: pwsh run: pip install meson ninja - name: Download build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: windows-meson-artifacts path: build @@ -313,7 +313,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: failed-tests-windows-meson-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -349,7 +349,7 @@ jobs: TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t runs-on: ${{matrix.vector.pool}} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: ci/install-dependencies.sh - run: ci/run-build-and-tests.sh - name: print test failures @@ -357,7 +357,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: failed-tests-${{matrix.vector.jobname}} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -370,7 +370,7 @@ jobs: CI_JOB_IMAGE: ubuntu-latest runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: ci/install-dependencies.sh - run: ci/run-build-and-minimal-fuzzers.sh dockerized: @@ -449,7 +449,7 @@ jobs: else apt-get -q update && apt-get -q -y install git fi - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: ci/install-dependencies.sh - run: useradd builder --create-home - run: chown -R builder . @@ -461,7 +461,7 @@ jobs: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: failed-tests-${{matrix.vector.jobname}} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -476,7 +476,7 @@ jobs: group: static-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: ci/install-dependencies.sh - run: ci/run-static-analysis.sh - run: ci/check-directional-formatting.bash @@ -492,7 +492,7 @@ jobs: group: rust-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: ci/install-dependencies.sh - run: ci/run-rust-checks.sh sparse: @@ -506,7 +506,7 @@ jobs: group: sparse-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install other dependencies run: ci/install-dependencies.sh - run: make sparse @@ -522,6 +522,6 @@ jobs: CI_JOB_IMAGE: ubuntu-latest runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: ci/install-dependencies.sh - run: ci/test-documentation.sh diff --git a/.github/workflows/nano-server.yml b/.github/workflows/nano-server.yml index 60e056a44bf8cc..579654e7a1671d 100644 --- a/.github/workflows/nano-server.yml +++ b/.github/workflows/nano-server.yml @@ -14,8 +14,8 @@ jobs: IMAGE: mcr.microsoft.com/powershell:nanoserver-ltsc2022 steps: - - uses: actions/checkout@v7 - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - name: build Git shell: bash run: make -j15 diff --git a/.github/workflows/scalar-functional-tests.yml b/.github/workflows/scalar-functional-tests.yml index 672c505877b115..f270bc94f50f2f 100644 --- a/.github/workflows/scalar-functional-tests.yml +++ b/.github/workflows/scalar-functional-tests.yml @@ -37,11 +37,11 @@ jobs: steps: - name: Check out Git's source code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Setup build tools on Windows if: runner.os == 'Windows' - uses: git-for-windows/setup-git-for-windows-sdk@v2 + uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 - name: Update the Git wrapper for UCRT64 if: runner.os == 'Windows' @@ -134,7 +134,7 @@ jobs: case "$(scalar version 2>&1)" in *.vfs.*) echo Good;; *) exit 1;; esac - name: Check out Scalar's source code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works. path: scalar @@ -155,7 +155,7 @@ jobs: mv $props.new $props - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: '9.0.306' @@ -232,7 +232,7 @@ jobs: - name: Archive Trace2 Logs if: ( success() || failure() ) && ( steps.trace2_zip_unix.conclusion == 'success' || steps.trace2_zip_windows.conclusion == 'success' ) - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.TRACE2_BASENAME }}.zip path: scalar/${{ env.TRACE2_BASENAME }}.zip @@ -244,6 +244,6 @@ jobs: # Git for Windows, which runs a slightly incompatible MSYS2 runtime). - name: action-tmate if: env.DEBUG_WITH_TMATE == 'true' && failure() - uses: mxschmitt/action-tmate@v3 + uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24 with: limit-access-to-actor: true diff --git a/.github/workflows/vfs-functional-tests.yml b/.github/workflows/vfs-functional-tests.yml index 7c927ff3e4b6fe..8b63dcb9315d8e 100644 --- a/.github/workflows/vfs-functional-tests.yml +++ b/.github/workflows/vfs-functional-tests.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Check out Git's source code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Setup build tools - uses: git-for-windows/setup-git-for-windows-sdk@v2 + uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 with: architecture: ${{ matrix.architecture }} @@ -107,7 +107,7 @@ jobs: fi - name: Upload Git artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: MicrosoftGit-${{ matrix.architecture }} path: MicrosoftGit @@ -122,13 +122,13 @@ jobs: steps: - name: Download x86_64 build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: MicrosoftGit-x86_64 path: MicrosoftGit - name: Download aarch64 build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: MicrosoftGit-aarch64 path: MicrosoftGit @@ -163,7 +163,7 @@ jobs: BATCH - name: Upload Git artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: MicrosoftGit path: MicrosoftGit From 1b063447c1f449b47ae0ee505378ace69d4c83d2 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Mon, 19 Oct 2026 12:59:30 +0200 Subject: [PATCH 2/4] fixup! Pin GitHub Actions to full-length commit SHAs This commit performs a one-time pinning, something that downstream repositories need to maintain from that point on. Such maintenance comes at a high cost when the workflows in question are not actually under the downstream repositories' control, but are inherited from an upstream project, such as (fast-moving) git/git. The intention of this patch is to increase security, which to a certain extent might even be accomplished here, under the assumption that the current SHA-1s refer to non-vulnerable versions. The commit message is a bit secretive about whatever analysis went into that, if any, so we cannot know. While this patch _might? increase security, it also increases the maintenance burden in a non-negligible way, though. For example, it forgot to pin the GitHub Action maintained in the VFS for Git repository to run the VFS for Git Functional Tests, and it pinned the CodeQL Actions to an already-outdated version. Let's drop this patch, for that reason, in preparation for integrating a much more sustainable way to pin the Actions' SHA-1s (ignoring the question whether pinning Actions to SHA-1s actually increases security, or merely shifts blame). Signed-off-by: Johannes Schindelin --- .github/dependabot.yml | 2 - .github/workflows/build-git-installers.yml | 58 ++++++++--------- .github/workflows/check-style.yml | 2 +- .github/workflows/check-whitespace.yml | 2 +- .github/workflows/codeql.yml | 10 +-- .github/workflows/coverity.yml | 8 +-- .github/workflows/l10n.yml | 4 +- .github/workflows/main.yml | 64 +++++++++---------- .github/workflows/nano-server.yml | 4 +- .github/workflows/scalar-functional-tests.yml | 12 ++-- .github/workflows/vfs-functional-tests.yml | 12 ++-- 11 files changed, 88 insertions(+), 90 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 453393a180dfa6..22d5376407abf1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,5 +11,3 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" - cooldown: - default-days: 7 \ No newline at end of file diff --git a/.github/workflows/build-git-installers.yml b/.github/workflows/build-git-installers.yml index 50a5589ee94b9e..1bfdb13484a42a 100644 --- a/.github/workflows/build-git-installers.yml +++ b/.github/workflows/build-git-installers.yml @@ -41,7 +41,7 @@ jobs: echo "version=${GITHUB_REF#refs/tags/v}" >>$GITHUB_OUTPUT id: tag - name: Clone git - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 - name: Validate the tag identified with trigger run: | die () { @@ -97,7 +97,7 @@ jobs: git config --global user.name "$USER_NAME" && git config --global user.email "$USER_EMAIL" && echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 with: flavor: build-installers architecture: ${{ matrix.arch.name }} @@ -117,7 +117,7 @@ jobs: git fetch "https://github.com/${{github.repository}}" refs/tags/${tag_name}:refs/tags/${tag_name} && git reset --hard ${tag_name} - name: Log in to Azure - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 + uses: azure/login@v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -186,7 +186,7 @@ jobs: git commit -s -m "mingw-w64-git: new version ($version)" PKGBUILD && git bundle create "$b"/MINGW-packages.bundle origin/main..main) - name: Publish mingw-w64-${{matrix.arch.toolchain}}-git - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: "${{ matrix.arch.artifact }}" path: artifacts @@ -217,11 +217,11 @@ jobs: runs-on: ${{ matrix.arch.runner }} steps: - name: Download ${{ matrix.arch.artifact }} - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: ${{ matrix.arch.artifact }} path: ${{ matrix.arch.artifact }} - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 with: flavor: build-installers architecture: ${{ matrix.arch.name }} @@ -230,7 +230,7 @@ jobs: run: | git clone --filter=blob:none --single-branch -b main https://github.com/git-for-windows/build-extra /usr/src/build-extra - name: Log in to Azure - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 + uses: azure/login@v3 if: env.DO_WIN_CODESIGN == 'true' with: client-id: ${{ secrets.AZURE_CLIENT_ID }} @@ -238,7 +238,7 @@ jobs: subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) if: env.DO_WIN_CODESIGN == 'true' - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 with: path: git - name: Download code signing secrets @@ -384,7 +384,7 @@ jobs: } exit $ret - name: Publish ${{matrix.type.name}}-${{matrix.arch.name}} - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: win-${{matrix.type.name}}-${{matrix.arch.name}} path: artifacts @@ -399,7 +399,7 @@ jobs: environment: release steps: - name: Check out repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 with: path: git @@ -426,7 +426,7 @@ jobs: lipo -create -output libintl.a /usr/local/opt/gettext/lib/libintl.a /opt/homebrew/opt/gettext/lib/libintl.a - name: Log in to Azure - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 + uses: azure/login@v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -578,7 +578,7 @@ jobs: mv git/.github/macos-installer/disk-image/*.pkg git/.github/macos-installer/ - name: Upload artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: macos-artifacts path: | @@ -631,7 +631,7 @@ jobs: tar -C /__e/node20 -x --strip-components=1 -f /tmp/node.tar.gz - name: Clone git - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 with: path: git @@ -695,7 +695,7 @@ jobs: mv "$PKGNAME.deb" "$GITHUB_WORKSPACE" - name: Upload artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: linux-unsigned-${{ matrix.arch.name }} path: | @@ -710,14 +710,14 @@ jobs: environment: release steps: - name: Log into Azure - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 + uses: azure/login@v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 with: path: git @@ -754,7 +754,7 @@ jobs: /usr/lib/gnupg2/gpg-preset-passphrase --preset '${{ steps.gpg-secrets.outputs.keygrip }}' <<<'${{ steps.gpg-secrets.outputs.passphrase }}' - name: Download artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: linux-unsigned-${{ matrix.arch }} @@ -765,7 +765,7 @@ jobs: debsigs --sign=origin --verify --check microsoft-git_"$version"_${{ matrix.arch }}.deb - name: Upload artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: linux-${{ matrix.arch }} path: | @@ -800,7 +800,7 @@ jobs: needs: [prereqs, windows_artifacts, create-macos-artifacts, create-linux-artifacts] steps: - name: Download artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: ${{ matrix.component.artifact }} @@ -864,56 +864,56 @@ jobs: needs.windows_artifacts.result == 'success') steps: - name: Download Windows portable (x86_64) - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: win-portable-x86_64 path: win-portable-x86_64 - name: Download Windows portable (aarch64) - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: win-portable-aarch64 path: win-portable-aarch64 - name: Download Windows installer (x86_64) - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: win-installer-x86_64 path: win-installer-x86_64 - name: Download Windows installer (aarch64) - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: win-installer-aarch64 path: win-installer-aarch64 - name: Download macOS artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: macos-artifacts path: macos-artifacts - name: Download Debian package (amd64) - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: linux-amd64 path: deb-package - name: Download Debian package (arm64) - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: linux-arm64 path: deb-package - name: Log into Azure - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 + uses: azure/login@v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 with: path: git @@ -924,7 +924,7 @@ jobs: secrets: | ${{ secrets.LINUX_GPG_PUBLIC_SECRET_NAME }} base64> deb-package/msft-git-public.asc - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9 with: script: | const fs = require('fs'); diff --git a/.github/workflows/check-style.yml b/.github/workflows/check-style.yml index 5602082fe89141..72e66762601413 100644 --- a/.github/workflows/check-style.yml +++ b/.github/workflows/check-style.yml @@ -20,7 +20,7 @@ jobs: jobname: ClangFormat runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml index f0770954ce66ee..7a35b67a636acc 100644 --- a/.github/workflows/check-whitespace.yml +++ b/.github/workflows/check-whitespace.yml @@ -19,7 +19,7 @@ jobs: check-whitespace: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a6b5f2658aea45..1ab0b2d68f6a98 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 - name: Install dependencies run: ci/install-dependencies.sh @@ -34,7 +34,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} config-file: ./.github/codeql/codeql-config.yml @@ -46,7 +46,7 @@ jobs: make -j$(nproc) - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@v4 with: upload: False output: sarif-results @@ -56,12 +56,12 @@ jobs: run: ls -la sarif-results - name: publish sarif for debugging - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: sarif-results-${{ matrix.language }} path: sarif-results - name: Upload SARIF - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: sarif-results/${{ matrix.language }}.sarif diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 8dcbe62afc6ffc..1f393e2d680bce 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -39,10 +39,10 @@ jobs: COVERITY_PLATFORM: overridden-below NO_RUST: Yup steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - name: install minimal Git for Windows SDK if: contains(matrix.os, 'windows') - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + uses: git-for-windows/setup-git-for-windows-sdk@v2 - run: ci/install-dependencies.sh if: contains(matrix.os, 'ubuntu') || contains(matrix.os, 'macos') env: @@ -99,7 +99,7 @@ jobs: # A cache miss will add ~30s to create, but a cache hit will save minutes. - name: restore the Coverity Build Tool id: cache - uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache/restore@v5 with: path: ${{ runner.temp }}/cov-analysis key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }} @@ -142,7 +142,7 @@ jobs: esac - name: cache the Coverity Build Tool if: steps.cache.outputs.cache-hit != 'true' - uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache/save@v5 with: path: ${{ runner.temp }}/cov-analysis key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }} diff --git a/.github/workflows/l10n.yml b/.github/workflows/l10n.yml index ec6dbab276f30b..114a12a9e59f60 100644 --- a/.github/workflows/l10n.yml +++ b/.github/workflows/l10n.yml @@ -63,7 +63,7 @@ jobs: origin \ ${{ github.ref }} \ $args - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@v6 with: go-version: '>=1.16' cache: false @@ -92,7 +92,7 @@ jobs: cat git-po-helper.out exit $exit_code - name: Create comment in pull request for report - uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3.12.0 + uses: mshick/add-pr-comment@v3 if: >- always() && github.event_name == 'pull_request_target' && diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e24935e8f14b0d..9bc5ef24b40e0e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -63,7 +63,7 @@ jobs: echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT - name: skip if the commit or tree was already tested id: skip-if-redundant - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + uses: actions/github-script@v9 if: steps.check-ref.outputs.enabled == 'yes' with: github-token: ${{secrets.GITHUB_TOKEN}} @@ -112,8 +112,8 @@ jobs: group: windows-build-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: actions/checkout@v7 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 - name: build shell: bash env: @@ -123,7 +123,7 @@ jobs: - name: zip up tracked files run: git archive -o artifacts/tracked.tar.gz HEAD - name: upload tracked files and build artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: windows-artifacts path: artifacts @@ -140,14 +140,14 @@ jobs: cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - name: download tracked files and build artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: windows-artifacts path: ${{github.workspace}} - name: extract tracked files and build artifacts shell: bash run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 - name: test shell: bash run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10 @@ -157,7 +157,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: failed-tests-windows-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -176,20 +176,20 @@ jobs: group: vs-build-${{ github.ref }}-${{ matrix.arch }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: actions/checkout@v7 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 - name: initialize vcpkg - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7 with: repository: 'microsoft/vcpkg' path: 'compat/vcbuild/vcpkg' - name: download vcpkg artifacts - uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0.3.1 + uses: git-for-windows/get-azure-pipelines-artifact@v0 with: repository: git/git definitionId: 9 - name: add msbuild to PATH - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0 + uses: microsoft/setup-msbuild@v3 - name: copy dlls to root shell: cmd run: compat\vcbuild\vcpkg_copy_dlls.bat release ${{ matrix.arch }}-windows @@ -216,7 +216,7 @@ jobs: - name: zip up tracked files run: git archive -o artifacts/tracked.tar.gz HEAD - name: upload tracked files and build artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: vs-artifacts-${{ matrix.arch }} path: artifacts @@ -232,9 +232,9 @@ jobs: group: vs-test-${{ matrix.nr }}-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 - name: download tracked files and build artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: vs-artifacts-x64 path: ${{github.workspace}} @@ -252,7 +252,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: failed-tests-windows-vs-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -266,8 +266,8 @@ jobs: group: windows-meson-build-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v6 - name: Set up dependencies shell: pwsh run: pip install meson ninja @@ -278,7 +278,7 @@ jobs: shell: pwsh run: meson compile -C build - name: Upload build artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: windows-meson-artifacts path: build @@ -294,13 +294,13 @@ jobs: group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v6 - name: Set up dependencies shell: pwsh run: pip install meson ninja - name: Download build artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: windows-meson-artifacts path: build @@ -313,7 +313,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: failed-tests-windows-meson-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -349,7 +349,7 @@ jobs: TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t runs-on: ${{matrix.vector.pool}} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - run: ci/install-dependencies.sh - run: ci/run-build-and-tests.sh - name: print test failures @@ -357,7 +357,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: failed-tests-${{matrix.vector.jobname}} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -370,7 +370,7 @@ jobs: CI_JOB_IMAGE: ubuntu-latest runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - run: ci/install-dependencies.sh - run: ci/run-build-and-minimal-fuzzers.sh dockerized: @@ -449,7 +449,7 @@ jobs: else apt-get -q update && apt-get -q -y install git fi - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - run: ci/install-dependencies.sh - run: useradd builder --create-home - run: chown -R builder . @@ -461,7 +461,7 @@ jobs: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: failed-tests-${{matrix.vector.jobname}} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -476,7 +476,7 @@ jobs: group: static-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - run: ci/install-dependencies.sh - run: ci/run-static-analysis.sh - run: ci/check-directional-formatting.bash @@ -492,7 +492,7 @@ jobs: group: rust-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - run: ci/install-dependencies.sh - run: ci/run-rust-checks.sh sparse: @@ -506,7 +506,7 @@ jobs: group: sparse-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - name: Install other dependencies run: ci/install-dependencies.sh - run: make sparse @@ -522,6 +522,6 @@ jobs: CI_JOB_IMAGE: ubuntu-latest runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 - run: ci/install-dependencies.sh - run: ci/test-documentation.sh diff --git a/.github/workflows/nano-server.yml b/.github/workflows/nano-server.yml index 579654e7a1671d..60e056a44bf8cc 100644 --- a/.github/workflows/nano-server.yml +++ b/.github/workflows/nano-server.yml @@ -14,8 +14,8 @@ jobs: IMAGE: mcr.microsoft.com/powershell:nanoserver-ltsc2022 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + - uses: actions/checkout@v7 + - uses: git-for-windows/setup-git-for-windows-sdk@v2 - name: build Git shell: bash run: make -j15 diff --git a/.github/workflows/scalar-functional-tests.yml b/.github/workflows/scalar-functional-tests.yml index f270bc94f50f2f..672c505877b115 100644 --- a/.github/workflows/scalar-functional-tests.yml +++ b/.github/workflows/scalar-functional-tests.yml @@ -37,11 +37,11 @@ jobs: steps: - name: Check out Git's source code - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 - name: Setup build tools on Windows if: runner.os == 'Windows' - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + uses: git-for-windows/setup-git-for-windows-sdk@v2 - name: Update the Git wrapper for UCRT64 if: runner.os == 'Windows' @@ -134,7 +134,7 @@ jobs: case "$(scalar version 2>&1)" in *.vfs.*) echo Good;; *) exit 1;; esac - name: Check out Scalar's source code - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 with: fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works. path: scalar @@ -155,7 +155,7 @@ jobs: mv $props.new $props - name: Setup .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@v5 with: dotnet-version: '9.0.306' @@ -232,7 +232,7 @@ jobs: - name: Archive Trace2 Logs if: ( success() || failure() ) && ( steps.trace2_zip_unix.conclusion == 'success' || steps.trace2_zip_windows.conclusion == 'success' ) - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: ${{ env.TRACE2_BASENAME }}.zip path: scalar/${{ env.TRACE2_BASENAME }}.zip @@ -244,6 +244,6 @@ jobs: # Git for Windows, which runs a slightly incompatible MSYS2 runtime). - name: action-tmate if: env.DEBUG_WITH_TMATE == 'true' && failure() - uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24 + uses: mxschmitt/action-tmate@v3 with: limit-access-to-actor: true diff --git a/.github/workflows/vfs-functional-tests.yml b/.github/workflows/vfs-functional-tests.yml index 8b63dcb9315d8e..7c927ff3e4b6fe 100644 --- a/.github/workflows/vfs-functional-tests.yml +++ b/.github/workflows/vfs-functional-tests.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Check out Git's source code - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v6 - name: Setup build tools - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1 + uses: git-for-windows/setup-git-for-windows-sdk@v2 with: architecture: ${{ matrix.architecture }} @@ -107,7 +107,7 @@ jobs: fi - name: Upload Git artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: MicrosoftGit-${{ matrix.architecture }} path: MicrosoftGit @@ -122,13 +122,13 @@ jobs: steps: - name: Download x86_64 build - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: MicrosoftGit-x86_64 path: MicrosoftGit - name: Download aarch64 build - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8 with: name: MicrosoftGit-aarch64 path: MicrosoftGit @@ -163,7 +163,7 @@ jobs: BATCH - name: Upload Git artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7 with: name: MicrosoftGit path: MicrosoftGit From 38d1f10083fa1d77b97bbf690752bfdfb0351a13 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Sat, 17 Oct 2026 09:04:09 +0200 Subject: [PATCH 3/4] ci: make downstream action-pin maintenance repeatable Microsoft Git inherits GitHub workflows from upstreams that use non-pinned versions for convenience. For compliance reasons, Microsoft Git must pin those to SHA-1s. Here is a script that exchanges the moving tags/refs in the `uses:` statements with their fixed SHA-1s. Assisted-by: GPT-6.1 Sol Signed-off-by: Johannes Schindelin --- .github/pin-github-actions-shas.js | 137 ++++++++++++++++++++++++ .github/pin-github-actions-shas.test.js | 88 +++++++++++++++ 2 files changed, 225 insertions(+) create mode 100755 .github/pin-github-actions-shas.js create mode 100644 .github/pin-github-actions-shas.test.js diff --git a/.github/pin-github-actions-shas.js b/.github/pin-github-actions-shas.js new file mode 100755 index 00000000000000..90a662c284b2bf --- /dev/null +++ b/.github/pin-github-actions-shas.js @@ -0,0 +1,137 @@ +#!/usr/bin/env node + +const { execFileSync } = require('node:child_process'); +const fs = require('node:fs'); + +const pinningMessage = `ci: pin GitHub Actions to satisfy downstream policy + +Microsoft Git inherits workflows that upstream maintains using symbolic +Action refs. Downstream organizational policy requires full commit IDs +instead, adding pin maintenance to this project's maintainers' workload. + +Keep pins aligned with the original upstream Action refs in a fresh +downstream snapshot, independent of any earlier pinning commit. +`; + +function git(...args) { + return execFileSync('git', ['--no-pager', ...args], { + encoding: 'utf8', + stdio: ['ignore', 'pipe', 'pipe'], + maxBuffer: 16 * 1024 * 1024 + }).trim(); +} + +const isSHA = value => /^[0-9a-f]{40}$/i.test(value); +const uses = /^( *-? *uses: *)(["']?)([\w./-]+)@([^ \t"'\r\n]+)\2([^\r\n]*)/gm; +const useLine = new RegExp(uses.source); + +function findOriginalActionRef(file, actionName, workflowHistory) { + for (const patch of workflowHistory.split('\0')) { + const removed = patch.replace(/^-/gm, ''); + const versions = [...removed.matchAll(uses)] + .filter(use => use[3] === actionName && + !isSHA(use[4])) + .map(use => use[4]); + if (!versions.length) + continue; + const [version] = versions; + if (versions.some(candidate => candidate !== version)) + throw new Error('Ambiguous Action ref: ' + + `${file}, ${actionName}`); + return version; + } + throw new Error(`Cannot recover Action ref: ${file}, ${actionName}`); +} + +function readWorkflow(file) { + const text = fs.readFileSync(file, 'utf8'); + const parts = text.split(/(^ *-? *uses:[^\r\n]*)/m); + const matches = parts.map(part => part.match(useLine)) + .filter(use => use && !use[3].startsWith('./')); + const workflowHistory = matches.some(use => isSHA(use[4])) + ? git('log', '--follow', '-p', '-U0', + '-Guses:.*@', '--no-ext-diff', '--no-textconv', + '--format=%x00', '--', file) + : ''; + const actionRefs = matches.map(use => { + const actionName = use[3]; + const version = isSHA(use[4]) ? + findOriginalActionRef( + file, actionName, workflowHistory) : + use[4]; + const actionRepo = actionName.split('/').slice(0, 2).join('/'); + return { + use, actionName, version, + pinKey: `${actionRepo}@${version}` + }; + }); + return { file, text, parts, actionRefs }; +} + +function resolveActionSHA(actionName, version) { + const actionRepo = actionName.split('/').slice(0, 2).join('/'); + const actionTagRef = `refs/tags/${version}`; + const output = git('ls-remote', '--quiet', + `https://github.com/${actionRepo}`, + actionTagRef, `${actionTagRef}^{}`, `refs/heads/${version}`); + const actionRepoRefs = Object.fromEntries(output.split('\n') + .map(line => line.split('\t').reverse())); + const sha = actionRepoRefs[`${actionTagRef}^{}`] || + actionRepoRefs[actionTagRef] || + actionRepoRefs[`refs/heads/${version}`]; + if (!sha || !isSHA(sha)) + throw new Error('Cannot resolve Action ref: ' + + `${actionName}@${version}`); + return sha; +} + +function substitute({ file, text, parts, actionRefs }, pins) { + const replacements = new Map(actionRefs.map(actionRef => { + const { use, version, pinKey } = actionRef; + const [, prefix, quote, actionName, , suffix] = use; + const sha = pins[pinKey]; + let note = suffix.trim().replace(/^#\s*/, ''); + if (note.startsWith(`${version}; `)) + note = note.slice(version.length + 2); + else if (note === version || /^v?\d[\w.+-]*$/.test(note)) + note = ''; + const pinned = `${prefix}${quote}${actionName}@${sha}${quote}` + + ` # ${version}` + (note ? `; ${note}` : ''); + return [use[0], pinned]; + })); + const updated = parts.map(part => replacements.get(part) ?? part) + .join(''); + return updated === text ? null : [file, updated]; +} + +try { + process.chdir(git('rev-parse', '--show-toplevel')); + const files = git('ls-files', '-z', '--', '.github/workflows') + .split('\0').filter(file => /\.ya?ml$/.test(file)); + if (git('status', '--porcelain', '--untracked-files=no', + '--', '.github/workflows')) + throw new Error('Workflow files have uncommitted changes'); + const workflows = files.map(readWorkflow); + const actionRefs = workflows.flatMap(workflow => workflow.actionRefs); + const uniquePins = new Map(actionRefs.map(actionRef => + [actionRef.pinKey, actionRef])); + const pins = Object.fromEntries([...uniquePins.values()].map( + ({ pinKey, actionName, version }) => + [pinKey, resolveActionSHA(actionName, version)])); + const changed = workflows.map(workflow => substitute(workflow, pins)) + .filter(Boolean); + if (changed.length) { + const message = git('rev-parse', '--git-path', + 'COMMIT_EDITMSG'); + fs.writeFileSync(message, pinningMessage); + for (const [file, text] of changed) + fs.writeFileSync(file, text); + console.log(git('commit', '--signoff', '-F', message, + '--', ...changed.map(([file]) => file))); + } else { + console.log('Action pins are up to date.'); + } +} catch (error) { + console.error(`error: ${error.message}`); + process.exitCode = 1; +} diff --git a/.github/pin-github-actions-shas.test.js b/.github/pin-github-actions-shas.test.js new file mode 100644 index 00000000000000..da21c74688dffb --- /dev/null +++ b/.github/pin-github-actions-shas.test.js @@ -0,0 +1,88 @@ +const assert = require('node:assert/strict'); +const { execFileSync } = require('node:child_process'); +const fs = require('node:fs'); +const os = require('node:os'); +const path = require('node:path'); +const { test } = require('node:test'); +const { pathToFileURL } = require('node:url'); + +test('fresh pinning commits preserve unrelated work', t => { + const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'pin test-')); + t.after(() => fs.rmSync(directory, { recursive: true })); + const env = Object.fromEntries(Object.entries(process.env) + .filter(([key]) => !/^GIT_/i.test(key))); + env.GIT_CONFIG_NOSYSTEM = '1'; + env.GIT_CONFIG_GLOBAL = os.devNull; + const git = (...args) => execFileSync('git', args, { + cwd: directory, env, encoding: 'utf8', + stdio: ['ignore', 'pipe', 'pipe'] + }).trim(); + git('init', '-q', '--initial-branch=test', '--object-format=sha1'); + git('config', 'user.name', 'Pin Test'); + git('config', 'user.email', 'pins@example.com'); + const workflows = path.join(directory, '.github/workflows'); + fs.mkdirSync(workflows, { recursive: true }); + const file = path.join(workflows, 'main.yml'); + const write = text => fs.writeFileSync(file, text); + const read = () => fs.readFileSync(file, 'utf8'); + const run = () => execFileSync(process.execPath, + [path.join(__dirname, 'pin-github-actions-shas.js')], + { cwd: directory, env, stdio: ['ignore', 'pipe', 'pipe'] }); + const workflow = `on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: 'example/action@v1' + - uses: example/action/subpath@v2 + if: false + - uses: ./local-action + reusable: + uses: example/action/.github/workflows/test.yaml@master +`.replace(/\n/g, '\r\n'); + write(workflow); + const another = path.join(workflows, 'another.yaml'); + fs.writeFileSync(another, workflow.replace('@v1', '@v2')); + const unrelated = path.join(directory, 'unrelated'); + fs.writeFileSync(unrelated, 'original\n'); + git('add', '--', '.github/workflows', 'unrelated'); + git('commit', '-qm', 'Upstream workflows'); + const first = git('rev-parse', 'HEAD'); + git('tag', 'v1'); + git('tag', '-am', 'Annotated version', 'v2'); + git('commit', '--allow-empty', '-qm', 'Update action'); + const second = git('rev-parse', 'HEAD'); + const pinned = v1 => workflow + .replace(/@v1'/, `@${v1}' # v1`) + .replace('@v2', `@${first} # v2`) + .replace('@master', `@${second} # master`); + git('branch', 'master'); + git('branch', 'v1'); + git('config', `url.${pathToFileURL(directory).href}.insteadOf`, + 'https://github.com/example/action'); + fs.writeFileSync(unrelated, 'staged change\n'); + git('add', '--', 'unrelated'); + const expectedSubject = + 'ci: pin GitHub Actions to satisfy downstream policy'; + run(); + assert.equal(git('log', '-1', '--format=%s'), expectedSubject); + assert.equal(git('rev-parse', 'HEAD^'), second); + assert.equal(read(), pinned(first)); + assert.match(git('log', '-1', '--format=%B'), + /Signed-off-by: Pin Test /); + write(read().replace(/# v[12]/g, '# v0.0.0')); + git('commit', '-qm', 'Release labels', '--', '.github/workflows'); + git('tag', '-f', 'v1', second); + const beforeRefresh = git('rev-parse', 'HEAD'); + run(); + assert.equal(git('log', '-1', '--format=%s'), expectedSubject); + assert.equal(git('rev-parse', 'HEAD^'), beforeRefresh); + assert.equal(read(), pinned(second)); + assert.equal(fs.readFileSync(another, 'utf8'), + pinned(first).replace('# v1', '# v2')); + const head = git('rev-parse', 'HEAD'); + run(); + assert.equal(git('rev-parse', 'HEAD'), head); + assert.equal(git('diff', '--cached', '--name-only'), 'unrelated'); + assert.equal(git('show', 'HEAD:unrelated'), 'original'); +}); From 372cda275e50a67a8c62a0bb592045a8615bb3b6 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Mon, 19 Oct 2026 13:09:39 +0200 Subject: [PATCH 4/4] ci: pin GitHub Actions to satisfy downstream policy Microsoft Git inherits workflows that upstream maintains using symbolic Action refs. Downstream organizational policy requires full commit IDs instead, adding pin maintenance to this project's maintainers' workload. Keep pins aligned with the original upstream Action refs in a fresh downstream snapshot, independent of any earlier pinning commit. Signed-off-by: Johannes Schindelin --- .github/workflows/build-git-installers.yml | 58 ++++++++--------- .github/workflows/check-style.yml | 2 +- .github/workflows/check-whitespace.yml | 2 +- .github/workflows/codeql.yml | 10 +-- .github/workflows/coverity.yml | 8 +-- .github/workflows/l10n.yml | 4 +- .github/workflows/main.yml | 64 +++++++++---------- .github/workflows/nano-server.yml | 4 +- .github/workflows/scalar-functional-tests.yml | 12 ++-- .github/workflows/vfs-functional-tests.yml | 14 ++-- 10 files changed, 89 insertions(+), 89 deletions(-) diff --git a/.github/workflows/build-git-installers.yml b/.github/workflows/build-git-installers.yml index 1bfdb13484a42a..eeb3edbe0bdcea 100644 --- a/.github/workflows/build-git-installers.yml +++ b/.github/workflows/build-git-installers.yml @@ -41,7 +41,7 @@ jobs: echo "version=${GITHUB_REF#refs/tags/v}" >>$GITHUB_OUTPUT id: tag - name: Clone git - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate the tag identified with trigger run: | die () { @@ -97,7 +97,7 @@ jobs: git config --global user.name "$USER_NAME" && git config --global user.email "$USER_EMAIL" && echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 with: flavor: build-installers architecture: ${{ matrix.arch.name }} @@ -117,7 +117,7 @@ jobs: git fetch "https://github.com/${{github.repository}}" refs/tags/${tag_name}:refs/tags/${tag_name} && git reset --hard ${tag_name} - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -186,7 +186,7 @@ jobs: git commit -s -m "mingw-w64-git: new version ($version)" PKGBUILD && git bundle create "$b"/MINGW-packages.bundle origin/main..main) - name: Publish mingw-w64-${{matrix.arch.toolchain}}-git - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: "${{ matrix.arch.artifact }}" path: artifacts @@ -217,11 +217,11 @@ jobs: runs-on: ${{ matrix.arch.runner }} steps: - name: Download ${{ matrix.arch.artifact }} - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: ${{ matrix.arch.artifact }} path: ${{ matrix.arch.artifact }} - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 with: flavor: build-installers architecture: ${{ matrix.arch.name }} @@ -230,7 +230,7 @@ jobs: run: | git clone --filter=blob:none --single-branch -b main https://github.com/git-for-windows/build-extra /usr/src/build-extra - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3 if: env.DO_WIN_CODESIGN == 'true' with: client-id: ${{ secrets.AZURE_CLIENT_ID }} @@ -238,7 +238,7 @@ jobs: subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) if: env.DO_WIN_CODESIGN == 'true' - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: path: git - name: Download code signing secrets @@ -384,7 +384,7 @@ jobs: } exit $ret - name: Publish ${{matrix.type.name}}-${{matrix.arch.name}} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: win-${{matrix.type.name}}-${{matrix.arch.name}} path: artifacts @@ -399,7 +399,7 @@ jobs: environment: release steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: path: git @@ -426,7 +426,7 @@ jobs: lipo -create -output libintl.a /usr/local/opt/gettext/lib/libintl.a /opt/homebrew/opt/gettext/lib/libintl.a - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -578,7 +578,7 @@ jobs: mv git/.github/macos-installer/disk-image/*.pkg git/.github/macos-installer/ - name: Upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: macos-artifacts path: | @@ -631,7 +631,7 @@ jobs: tar -C /__e/node20 -x --strip-components=1 -f /tmp/node.tar.gz - name: Clone git - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: path: git @@ -695,7 +695,7 @@ jobs: mv "$PKGNAME.deb" "$GITHUB_WORKSPACE" - name: Upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: linux-unsigned-${{ matrix.arch.name }} path: | @@ -710,14 +710,14 @@ jobs: environment: release steps: - name: Log into Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: path: git @@ -754,7 +754,7 @@ jobs: /usr/lib/gnupg2/gpg-preset-passphrase --preset '${{ steps.gpg-secrets.outputs.keygrip }}' <<<'${{ steps.gpg-secrets.outputs.passphrase }}' - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: linux-unsigned-${{ matrix.arch }} @@ -765,7 +765,7 @@ jobs: debsigs --sign=origin --verify --check microsoft-git_"$version"_${{ matrix.arch }}.deb - name: Upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: linux-${{ matrix.arch }} path: | @@ -800,7 +800,7 @@ jobs: needs: [prereqs, windows_artifacts, create-macos-artifacts, create-linux-artifacts] steps: - name: Download artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: ${{ matrix.component.artifact }} @@ -864,56 +864,56 @@ jobs: needs.windows_artifacts.result == 'success') steps: - name: Download Windows portable (x86_64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: win-portable-x86_64 path: win-portable-x86_64 - name: Download Windows portable (aarch64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: win-portable-aarch64 path: win-portable-aarch64 - name: Download Windows installer (x86_64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: win-installer-x86_64 path: win-installer-x86_64 - name: Download Windows installer (aarch64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: win-installer-aarch64 path: win-installer-aarch64 - name: Download macOS artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: macos-artifacts path: macos-artifacts - name: Download Debian package (amd64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: linux-amd64 path: deb-package - name: Download Debian package (arm64) - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: linux-arm64 path: deb-package - name: Log into Azure - uses: azure/login@v3 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Check out repository (for akv-secret Action) - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: path: git @@ -924,7 +924,7 @@ jobs: secrets: | ${{ secrets.LINUX_GPG_PUBLIC_SECRET_NAME }} base64> deb-package/msft-git-public.asc - - uses: actions/github-script@v9 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: script: | const fs = require('fs'); diff --git a/.github/workflows/check-style.yml b/.github/workflows/check-style.yml index 72e66762601413..c7120680cf7580 100644 --- a/.github/workflows/check-style.yml +++ b/.github/workflows/check-style.yml @@ -20,7 +20,7 @@ jobs: jobname: ClangFormat runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml index 7a35b67a636acc..9a511801a780e3 100644 --- a/.github/workflows/check-whitespace.yml +++ b/.github/workflows/check-whitespace.yml @@ -19,7 +19,7 @@ jobs: check-whitespace: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1ab0b2d68f6a98..a05883eb3c3679 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Install dependencies run: ci/install-dependencies.sh @@ -34,7 +34,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: languages: ${{ matrix.language }} config-file: ./.github/codeql/codeql-config.yml @@ -46,7 +46,7 @@ jobs: make -j$(nproc) - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: upload: False output: sarif-results @@ -56,12 +56,12 @@ jobs: run: ls -la sarif-results - name: publish sarif for debugging - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: sarif-results-${{ matrix.language }} path: sarif-results - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: sarif_file: sarif-results/${{ matrix.language }}.sarif diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 1f393e2d680bce..2de9f85906243d 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -39,10 +39,10 @@ jobs: COVERITY_PLATFORM: overridden-below NO_RUST: Yup steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: install minimal Git for Windows SDK if: contains(matrix.os, 'windows') - uses: git-for-windows/setup-git-for-windows-sdk@v2 + uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - run: ci/install-dependencies.sh if: contains(matrix.os, 'ubuntu') || contains(matrix.os, 'macos') env: @@ -99,7 +99,7 @@ jobs: # A cache miss will add ~30s to create, but a cache hit will save minutes. - name: restore the Coverity Build Tool id: cache - uses: actions/cache/restore@v5 + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ runner.temp }}/cov-analysis key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }} @@ -142,7 +142,7 @@ jobs: esac - name: cache the Coverity Build Tool if: steps.cache.outputs.cache-hit != 'true' - uses: actions/cache/save@v5 + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: ${{ runner.temp }}/cov-analysis key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }} diff --git a/.github/workflows/l10n.yml b/.github/workflows/l10n.yml index 114a12a9e59f60..6dbbb4a2f6bd42 100644 --- a/.github/workflows/l10n.yml +++ b/.github/workflows/l10n.yml @@ -63,7 +63,7 @@ jobs: origin \ ${{ github.ref }} \ $args - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: '>=1.16' cache: false @@ -92,7 +92,7 @@ jobs: cat git-po-helper.out exit $exit_code - name: Create comment in pull request for report - uses: mshick/add-pr-comment@v3 + uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3 if: >- always() && github.event_name == 'pull_request_target' && diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9bc5ef24b40e0e..1da08434596810 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -63,7 +63,7 @@ jobs: echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT - name: skip if the commit or tree was already tested id: skip-if-redundant - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 if: steps.check-ref.outputs.enabled == 'yes' with: github-token: ${{secrets.GITHUB_TOKEN}} @@ -112,8 +112,8 @@ jobs: group: windows-build-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - name: build shell: bash env: @@ -123,7 +123,7 @@ jobs: - name: zip up tracked files run: git archive -o artifacts/tracked.tar.gz HEAD - name: upload tracked files and build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: windows-artifacts path: artifacts @@ -140,14 +140,14 @@ jobs: cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - name: download tracked files and build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: windows-artifacts path: ${{github.workspace}} - name: extract tracked files and build artifacts shell: bash run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - name: test shell: bash run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10 @@ -157,7 +157,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: failed-tests-windows-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -176,20 +176,20 @@ jobs: group: vs-build-${{ github.ref }}-${{ matrix.arch }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - name: initialize vcpkg - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: repository: 'microsoft/vcpkg' path: 'compat/vcbuild/vcpkg' - name: download vcpkg artifacts - uses: git-for-windows/get-azure-pipelines-artifact@v0 + uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0 with: repository: git/git definitionId: 9 - name: add msbuild to PATH - uses: microsoft/setup-msbuild@v3 + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3 - name: copy dlls to root shell: cmd run: compat\vcbuild\vcpkg_copy_dlls.bat release ${{ matrix.arch }}-windows @@ -216,7 +216,7 @@ jobs: - name: zip up tracked files run: git archive -o artifacts/tracked.tar.gz HEAD - name: upload tracked files and build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: vs-artifacts-${{ matrix.arch }} path: artifacts @@ -232,9 +232,9 @@ jobs: group: vs-test-${{ matrix.nr }}-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - name: download tracked files and build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: vs-artifacts-x64 path: ${{github.workspace}} @@ -252,7 +252,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: failed-tests-windows-vs-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -266,8 +266,8 @@ jobs: group: windows-meson-build-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - name: Set up dependencies shell: pwsh run: pip install meson ninja @@ -278,7 +278,7 @@ jobs: shell: pwsh run: meson compile -C build - name: Upload build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: windows-meson-artifacts path: build @@ -294,13 +294,13 @@ jobs: group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - name: Set up dependencies shell: pwsh run: pip install meson ninja - name: Download build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: windows-meson-artifacts path: build @@ -313,7 +313,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: failed-tests-windows-meson-${{ matrix.nr }} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -349,7 +349,7 @@ jobs: TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t runs-on: ${{matrix.vector.pool}} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: ci/install-dependencies.sh - run: ci/run-build-and-tests.sh - name: print test failures @@ -357,7 +357,7 @@ jobs: run: ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: failed-tests-${{matrix.vector.jobname}} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -370,7 +370,7 @@ jobs: CI_JOB_IMAGE: ubuntu-latest runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: ci/install-dependencies.sh - run: ci/run-build-and-minimal-fuzzers.sh dockerized: @@ -449,7 +449,7 @@ jobs: else apt-get -q update && apt-get -q -y install git fi - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: ci/install-dependencies.sh - run: useradd builder --create-home - run: chown -R builder . @@ -461,7 +461,7 @@ jobs: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh - name: Upload failed tests' directories if: failure() && env.FAILED_TEST_ARTIFACTS != '' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: failed-tests-${{matrix.vector.jobname}} path: ${{env.FAILED_TEST_ARTIFACTS}} @@ -476,7 +476,7 @@ jobs: group: static-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: ci/install-dependencies.sh - run: ci/run-static-analysis.sh - run: ci/check-directional-formatting.bash @@ -492,7 +492,7 @@ jobs: group: rust-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: ci/install-dependencies.sh - run: ci/run-rust-checks.sh sparse: @@ -506,7 +506,7 @@ jobs: group: sparse-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install other dependencies run: ci/install-dependencies.sh - run: make sparse @@ -522,6 +522,6 @@ jobs: CI_JOB_IMAGE: ubuntu-latest runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - run: ci/install-dependencies.sh - run: ci/test-documentation.sh diff --git a/.github/workflows/nano-server.yml b/.github/workflows/nano-server.yml index 60e056a44bf8cc..625e064c570a0c 100644 --- a/.github/workflows/nano-server.yml +++ b/.github/workflows/nano-server.yml @@ -14,8 +14,8 @@ jobs: IMAGE: mcr.microsoft.com/powershell:nanoserver-ltsc2022 steps: - - uses: actions/checkout@v7 - - uses: git-for-windows/setup-git-for-windows-sdk@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - name: build Git shell: bash run: make -j15 diff --git a/.github/workflows/scalar-functional-tests.yml b/.github/workflows/scalar-functional-tests.yml index 672c505877b115..7fd7c612b8ee02 100644 --- a/.github/workflows/scalar-functional-tests.yml +++ b/.github/workflows/scalar-functional-tests.yml @@ -37,11 +37,11 @@ jobs: steps: - name: Check out Git's source code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Setup build tools on Windows if: runner.os == 'Windows' - uses: git-for-windows/setup-git-for-windows-sdk@v2 + uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 - name: Update the Git wrapper for UCRT64 if: runner.os == 'Windows' @@ -134,7 +134,7 @@ jobs: case "$(scalar version 2>&1)" in *.vfs.*) echo Good;; *) exit 1;; esac - name: Check out Scalar's source code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works. path: scalar @@ -155,7 +155,7 @@ jobs: mv $props.new $props - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: '9.0.306' @@ -232,7 +232,7 @@ jobs: - name: Archive Trace2 Logs if: ( success() || failure() ) && ( steps.trace2_zip_unix.conclusion == 'success' || steps.trace2_zip_windows.conclusion == 'success' ) - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: ${{ env.TRACE2_BASENAME }}.zip path: scalar/${{ env.TRACE2_BASENAME }}.zip @@ -244,6 +244,6 @@ jobs: # Git for Windows, which runs a slightly incompatible MSYS2 runtime). - name: action-tmate if: env.DEBUG_WITH_TMATE == 'true' && failure() - uses: mxschmitt/action-tmate@v3 + uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3 with: limit-access-to-actor: true diff --git a/.github/workflows/vfs-functional-tests.yml b/.github/workflows/vfs-functional-tests.yml index 7c927ff3e4b6fe..44b20fa98008b2 100644 --- a/.github/workflows/vfs-functional-tests.yml +++ b/.github/workflows/vfs-functional-tests.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Check out Git's source code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Setup build tools - uses: git-for-windows/setup-git-for-windows-sdk@v2 + uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 with: architecture: ${{ matrix.architecture }} @@ -107,7 +107,7 @@ jobs: fi - name: Upload Git artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: MicrosoftGit-${{ matrix.architecture }} path: MicrosoftGit @@ -122,13 +122,13 @@ jobs: steps: - name: Download x86_64 build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: MicrosoftGit-x86_64 path: MicrosoftGit - name: Download aarch64 build - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: MicrosoftGit-aarch64 path: MicrosoftGit @@ -163,7 +163,7 @@ jobs: BATCH - name: Upload Git artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: MicrosoftGit path: MicrosoftGit @@ -210,7 +210,7 @@ jobs: functional_tests: name: Functional Tests needs: package - uses: microsoft/VFSForGit/.github/workflows/functional-tests.yaml@master + uses: microsoft/VFSForGit/.github/workflows/functional-tests.yaml@c5ea3d5dc5e44f51ffa7876f46409dfe650de851 # master with: vfs_repository: microsoft/VFSForGit vfs_run_id: ${{ needs.package.outputs.vfs_run_id }}