rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: pin all third-party actions to SHA digests

Browse Source 
Pin third-party GitHub Actions to immutable SHA digests to prevent
supply chain attacks via tag force-pushing or branch updates.

Actions pinned:
- trufflesecurity/trufflehog (was @main, now SHA)
- sigstore/cosign-installer@v3.8.1
- docker/setup-buildx-action@v3.12.0
- docker/setup-qemu-action@v3.7.0
- docker/login-action@v3.7.0
- goreleaser/goreleaser-action@v6.4.0
- aquasecurity/trivy-action@0.33.1
- github/codeql-action/upload-sarif@v4.32.1
- golangci/golangci-lint-action@v9.2.0
- docker/setup-compose-action@v1.2.0

Version comments added for maintainability.
This commit is contained in:
mendral-app[bot]
2026-02-04 23:10:59 -08:00
committed by Bryan Frimin
parent 80cdac417a
commit 09d73cf413
3 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
.github/workflows/make.yaml vendored
View File

@@ -31,9 +31,9 @@ jobs:
cache: "npm" cache: "npm"
- run: "npm i -g npm@11.8.0" - run: "npm i -g npm@11.8.0"
- run: "npm ci" - run: "npm ci"
- uses: "docker/setup-qemu-action@v3" - uses: "docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130" # v3.7.0
- uses: "docker/setup-buildx-action@v3" - uses: "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" # v3.12.0
- uses: "sigstore/cosign-installer@v3" - uses: "sigstore/cosign-installer@053f9b74638557590800a301da1ba82351507e2c" # v3.8.1
- name: Cache Trivy database - name: Cache Trivy database
uses: "actions/cache@v5" uses: "actions/cache@v5"
with: with:
@@ -42,7 +42,7 @@ jobs:
restore-keys: | restore-keys: |
trivy-db-${{ runner.os }}- trivy-db-${{ runner.os }}-
- uses: "anchore/sbom-action/download-syft@deef08a0db64bfad603422135db61477b16cef56" # v0.22.1 - uses: "anchore/sbom-action/download-syft@deef08a0db64bfad603422135db61477b16cef56" # v0.22.1
- uses: "goreleaser/goreleaser-action@v6" - uses: "goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a" # v6.4.0
with: with:
distribution: "goreleaser" distribution: "goreleaser"
version: "~> v2" version: "~> v2"
@@ -51,7 +51,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Scan Docker image with Trivy - name: Scan Docker image with Trivy
if: github.ref == 'refs/heads/main' if: github.ref == 'refs/heads/main'
uses: "aquasecurity/trivy-action@0.33.1" uses: "aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8" # 0.33.1
with: with:
image-ref: "ghcr.io/getprobo/probo:latest-amd64" image-ref: "ghcr.io/getprobo/probo:latest-amd64"
format: "sarif" format: "sarif"
@@ -63,7 +63,7 @@ jobs:
cache-dir: ~/.cache/trivy cache-dir: ~/.cache/trivy
- name: Scan Docker image with Trivy - name: Scan Docker image with Trivy
if: github.ref != 'refs/heads/main' if: github.ref != 'refs/heads/main'
uses: "aquasecurity/trivy-action@0.33.1" uses: "aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8" # 0.33.1
with: with:
image-ref: "ghcr.io/getprobo/probo:latest-amd64" image-ref: "ghcr.io/getprobo/probo:latest-amd64"
format: "table" format: "table"
@@ -74,7 +74,7 @@ jobs:
cache-dir: ~/.cache/trivy cache-dir: ~/.cache/trivy
- name: Upload Trivy scan results to GitHub Security tab - name: Upload Trivy scan results to GitHub Security tab
if: github.ref == 'refs/heads/main' if: github.ref == 'refs/heads/main'
uses: github/codeql-action/upload-sarif@v4 uses: github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
with: with:
sarif_file: "trivy-results.sarif" sarif_file: "trivy-results.sarif"
- uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 #v0.22.1 - uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 #v0.22.1
@@ -144,7 +144,7 @@ jobs:
with: with:
node-version-file: ".nvmrc" node-version-file: ".nvmrc"
cache: "npm" cache: "npm"
- uses: golangci/golangci-lint-action@v9 - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
with: with:
install-only: true install-only: true
- run: "npm i -g npm@11.8.0" - run: "npm i -g npm@11.8.0"
@@ -220,9 +220,9 @@ jobs:
- run: "npm i -g npm@11.8.0" - run: "npm i -g npm@11.8.0"
- run: "sudo apt-get install -y mkcert" - run: "sudo apt-get install -y mkcert"
- run: "sudo mkcert -install 2>&1 | grep -v 'no Firefox and/or Chrome/Chromium security databases found' || true" - run: "sudo mkcert -install 2>&1 | grep -v 'no Firefox and/or Chrome/Chromium security databases found' || true"
- uses: "docker/setup-qemu-action@v3" - uses: "docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130" # v3.7.0
- uses: "docker/setup-buildx-action@v3" - uses: "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" # v3.12.0
- uses: "docker/setup-compose-action@v1" - uses: "docker/setup-compose-action@364cc21a5de5b1ee4a7f5f9d3fa374ce0ccde746" # v1.2.0
- run: "npm ci" - run: "npm ci"
- run: "make stack-up" - run: "make stack-up"
- run: "make stack-ps" - run: "make stack-ps"

14
.github/workflows/release.yaml vendored
View File

@@ -44,25 +44,25 @@ jobs:
run: npm ci run: npm ci
- name: Install Cosign - name: Install Cosign
uses: sigstore/cosign-installer@v3 uses: sigstore/cosign-installer@053f9b74638557590800a301da1ba82351507e2c # v3.8.1
- name: Set up Docker Buildx - name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3 uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: Set up QEMU - name: Set up QEMU
uses: docker/setup-qemu-action@v3 uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
with: with:
platforms: all platforms: all
- name: Log in to GitHub Container Registry - name: Log in to GitHub Container Registry
uses: docker/login-action@v3 uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.actor }} username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }} password: ${{ secrets.GITHUB_TOKEN }}
- name: Run GoReleaser - name: Run GoReleaser
uses: goreleaser/goreleaser-action@v6 uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
with: with:
distribution: goreleaser distribution: goreleaser
version: "~> v2" version: "~> v2"
@@ -71,7 +71,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Scan Docker image with Trivy - name: Scan Docker image with Trivy
uses: aquasecurity/trivy-action@0.33.1 uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
with: with:
image-ref: "ghcr.io/getprobo/probo:${{ github.ref_name }}" image-ref: "ghcr.io/getprobo/probo:${{ github.ref_name }}"
format: "sarif" format: "sarif"
@@ -82,7 +82,7 @@ jobs:
severity: "CRITICAL,HIGH" severity: "CRITICAL,HIGH"
- name: Upload Trivy scan results to GitHub Security tab - name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v4 uses: github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
if: always() if: always()
with: with:
sarif_file: "trivy-results.sarif" sarif_file: "trivy-results.sarif"

2
.github/workflows/secrets.yaml vendored
View File

@@ -17,6 +17,6 @@ jobs:
with: with:
fetch-depth: 0 fetch-depth: 0
submodules: recursive submodules: recursive
- uses: "trufflesecurity/trufflehog@main" - uses: "trufflesecurity/trufflehog@b78fbfd8eb982f4802e09a265fb2bc37b3040975" # main
with: with:
extra_args: "--results=verified,unknown" extra_args: "--results=verified,unknown"