Skip to content

[Security] Pin GitHub Actions to a full-length commit SHA #417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbachorik merged 1 commit into from
Mar 17, 2026
Merged

[Security] Pin GitHub Actions to a full-length commit SHA #417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/actions/setup_cached_java/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ runs:
fi
- name: Cache Build JDK [${{ inputs.arch }}]
id: cache_build_jdk
uses: actions/cache/restore@v4
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: |
jdks/${{ steps.infer_build_jdk.outputs.build_jdk }}
Expand All @@ -37,7 +37,7 @@ runs:
enableCrossOsArchive: true
- name: Cache JDK ${{ inputs.version }} [${{ inputs.arch }}]
id: cache_jdk
uses: actions/cache/restore@v4
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: |
jdks/jdk${{ inputs.version }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/approve-trivial.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,6 @@ jobs:
scope: DataDog/java-profiler
policy: self.approve-trivial.approve-pr
- name: Auto-approve PR
uses: hmarr/auto-approve-action@v4
uses: hmarr/auto-approve-action@8f929096a962e83ccdfa8afcf855f39f12d4dac7 # v4
with:
github-token: ${{ steps.octo-sts.outputs.token }}
36 changes: 18 additions & 18 deletions .github/workflows/cache_java.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ jobs:
sdkman_path: ${{ steps.export-path.outputs.sdkman_path }}
steps:
- name: Cache SDKMan! AMD64
uses: actions/cache@v5
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: sdkman
key: sdkman-amd64-${{ github.run_id }}
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
run: |
curl -s "https://get.sdkman.io" | bash
- name: Upload SDKMAN! as Artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: sdkman-installation-amd64
path: ${{ env.SDKMAN_DIR }}
Expand All @@ -109,7 +109,7 @@ jobs:
sdkman_path: ${{ steps.export-path.outputs.sdkman_path }}
steps:
- name: Cache SDKMan! AARCH64
uses: actions/cache@v5
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: sdkman
key: sdkman-aarch64-${{ github.run_id }}
Expand All @@ -136,7 +136,7 @@ jobs:
run: |
curl -s "https://get.sdkman.io" | bash
- name: Upload SDKMAN! as Artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: sdkman-installation-aarch64
path: ${{ env.SDKMAN_DIR }}
Expand All @@ -151,10 +151,10 @@ jobs:
# FIXME: Zing disabled - Azul pulled public CDN access
java_variant: [ "8", "8-orcl", "8-j9", "8-ibm", "11", "11-j9", "17", "17-j9", "17-graal", "21", "21-j9", "21-graal", "25", "25-graal" ]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Try restore cache JDK ${{ matrix.java_variant }}
id: cache-jdk
uses: actions/cache/restore@v5
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -175,7 +175,7 @@ jobs:
sudo apt-get install -y curl zip unzip
- name: Download SDKMAN! from Artifact
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: sdkman-installation-amd64
path: sdkman
Expand All @@ -193,7 +193,7 @@ jobs:

- name: Save JDK ${{ matrix.java_variant }} cache
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/cache/save@v5
uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -210,14 +210,14 @@ jobs:
matrix:
java_variant: [ "8-librca", "11-librca", "17-librca", "21-librca", "25-librca" ]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup OS
run: |
# This needs to be done early because alpine does not have bash and tar is also iffy
apk update && apk add curl zip unzip bash tar
- name: Cache JDK ${{ matrix.java_variant }}
id: cache-jdk
uses: actions/cache/restore@v5
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -243,7 +243,7 @@ jobs:

- name: Save JDK ${{ matrix.java_variant }} cache
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/cache/save@v5
uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -262,10 +262,10 @@ jobs:
# FIXME: Zing disabled - Azul pulled public CDN access
java_variant: [ "8", "8-j9", "11", "11-j9", "17", "17-j9", "17-graal", "21", "21-j9", "21-graal", "25", "25-graal" ]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Cache JDK ${{ matrix.java_variant }}
id: cache-jdk
uses: actions/cache/restore@v5
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -286,7 +286,7 @@ jobs:
sudo apt-get install -y curl zip unzip
- name: Download SDKMAN! from Artifact
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: sdkman-installation-aarch64
path: sdkman
Expand All @@ -303,7 +303,7 @@ jobs:

- name: Save JDK ${{ matrix.java_variant }} cache
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/cache/save@v5
uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -319,14 +319,14 @@ jobs:
matrix:
java_variant: [ "8-librca", "11-librca", "17-librca", "21-librca", "25-librca" ]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup OS
run: |
# This needs to be done early because alpine does not have bash and tar is also iffy
sudo apt update && sudo apt install -y curl zip unzip bash tar
- name: Cache JDK ${{ matrix.java_variant }}
id: cache-jdk
uses: actions/cache/restore@v5
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand All @@ -352,7 +352,7 @@ jobs:

- name: Save JDK ${{ matrix.java_variant }} cache
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/cache/save@v5
uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: |
${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,10 @@ jobs:
needs: check-for-pr
if: needs.check-for-pr.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup Java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: '21'
Expand All @@ -63,15 +63,15 @@ jobs:
sudo mv /usr/bin/clang-format-11 /usr/bin/clang-format

- name: Cache Gradle Wrapper Binaries
uses: actions/cache@v5
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ~/.gradle/wrapper/dists
key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
restore-keys: |
gradle-wrapper-${{ runner.os }}-

- name: Cache Gradle User Home
uses: actions/cache@v5
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ~/.gradle/caches
key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
Expand All @@ -87,10 +87,10 @@ jobs:
needs: check-for-pr
if: needs.check-for-pr.outputs.skip != 'true'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup Java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: '21'
Expand All @@ -101,15 +101,15 @@ jobs:
sudo apt-get install -y curl zip unzip binutils

- name: Cache Gradle Wrapper Binaries
uses: actions/cache@v5
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ~/.gradle/wrapper/dists
key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
restore-keys: |
gradle-wrapper-${{ runner.os }}-

- name: Cache Gradle User Home
uses: actions/cache@v5
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ~/.gradle/caches
key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
Expand Down Expand Up @@ -178,7 +178,7 @@ jobs:
actions: read
id-token: write
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Generate test summary
env:
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/codecheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ jobs:
env:
HEAD_REF: ${{ github.head_ref }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: System setup
run: |
sudo apt-get update
sudo apt install -y clang clang-tools openjdk-11-jdk
- name: Set up Python
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: 3.9
- name: Install Python dependencies
Expand All @@ -38,7 +38,7 @@ jobs:
run: |
./gradlew scanBuild --no-daemon
- name: Upload logs
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
if: always()
with:
name: scan-build-reports
Expand Down Expand Up @@ -71,11 +71,11 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
Expand All @@ -84,4 +84,4 @@ jobs:
# queries: ./path/to/local/query, your-org/your-repo/queries@main
- run: ./gradlew -x test assembleReleaseJar
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
8 changes: 4 additions & 4 deletions .github/workflows/gh_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,15 +26,15 @@ jobs:
if: (startsWith(github.event.ref, 'refs/tags/v_') || inputs.release_tag != '') && !endsWith(github.event.ref, '-SNAPSHOT')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- uses: webfactory/ssh-agent@v0.9.1
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
with:
ssh-private-key: ${{ secrets.SSH_PUSH_SECRET }}
- name: Create Release [automatic]
id: create_release_auto
uses: ncipollo/release-action@v1
uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
if: ${{ startsWith(github.ref, 'refs/tags/') }}
with:
generateReleaseNotes: true
Expand All @@ -44,7 +44,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Create Release [manual]
id: create_release_manual
uses: ncipollo/release-action@v1
uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
if: ${{ !startsWith(github.ref, 'refs/tags/') }}
with:
generateReleaseNotes: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
if: failure()
steps:
- name: Download all failure artifacts
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: failures-*
path: ./artifacts
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/release-validated.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,12 @@ jobs:
release_branch: ${{ steps.compute-version.outputs.release_branch }}
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Setup Java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: '21'
Expand Down Expand Up @@ -153,7 +153,7 @@ jobs:
echo "::error::Pre-release tests failed. Cannot proceed with release."
exit 1

- uses: webfactory/ssh-agent@v0.9.1
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
with:
ssh-private-key: ${{ secrets.SSH_PUSH_SECRET }}

Expand All @@ -168,7 +168,7 @@ jobs:
git checkout $GITHUB_REF_NAME

- name: Setup Java
uses: actions/setup-java@v5
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
distribution: 'zulu'
java-version: '21'
Expand Down
Loading
Loading