From cd44d7913457fedf1bf427ea0f9106f3985ed992 Mon Sep 17 00:00:00 2001 From: Teakowa Date: Sun, 25 Oct 2026 06:32:50 +0800 Subject: [PATCH] ci: lint workflows and pin third-party actions to SHAs Call the shared actionlint workflow from ci.yml so workflow changes are linted in CI, and migrate every tag-pinned third-party action to a full commit SHA with the resolved tag as a comment, per the ci-platform mandate. Refs wrightkit/.github#124 --- .github/workflows/ci.yml | 8 +++++++- .github/workflows/release-please.yml | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f919094..b5e46b7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,12 @@ env: CARGO_TERM_COLOR: always jobs: + workflow-lint: + name: Workflow lint + uses: wrightkit/.github/.github/workflows/actionlint.yml@main + permissions: + contents: read + rust-quality: name: Rust (1.88.0) uses: wrightkit/.github/.github/workflows/rust-quality.yml@main @@ -29,7 +35,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main with: diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 0042f20..a70a9c7 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Run release-please id: release - uses: googleapis/release-please-action@v5 + uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: token: ${{ secrets.GH_TOKEN }} config-file: release-please-config.json @@ -34,7 +34,7 @@ jobs: - name: Check out Release PR branch if: steps.release.outputs.prs_created == 'true' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }} token: ${{ secrets.GH_TOKEN }}