From be14e4ae5e329d167cf05d7b8700cbf8dec7a922 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 13 Sep 2023 22:17:28 +0000 Subject: [PATCH] chore(deps): pin dependencies --- .github/workflows/check-new-repos.yml | 4 +-- .github/workflows/full-loop.yml | 2 +- .github/workflows/loop.yml | 2 +- .github/workflows/semgrep-self-test.yml | 2 +- action.yml | 34 ++++++++++++------------- 5 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/check-new-repos.yml b/.github/workflows/check-new-repos.yml index 2876e81d..5a3f57a7 100644 --- a/.github/workflows/check-new-repos.yml +++ b/.github/workflows/check-new-repos.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Check New Repos id: check-new-repos - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: github-token: ${{ secrets.GH_PAT }} script: | @@ -53,7 +53,7 @@ jobs: } return message; - - uses: actions-ecosystem/action-slack-notifier@v1 + - uses: actions-ecosystem/action-slack-notifier@fc778468d09c43a6f4d1b8cccaca59766656996a # v1 if: ${{ fromJson(steps.check-new-repos.outputs.result) != '' }} with: slack_token: ${{ secrets.HOTSPOTS_SLACK_TOKEN }} diff --git a/.github/workflows/full-loop.yml b/.github/workflows/full-loop.yml index 78d2c582..dde211aa 100644 --- a/.github/workflows/full-loop.yml +++ b/.github/workflows/full-loop.yml @@ -13,7 +13,7 @@ jobs: name: full-loop runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4 with: fetch-depth: 0 - uses: ./ diff --git a/.github/workflows/loop.yml b/.github/workflows/loop.yml index 2c70f5c0..279d92c8 100644 --- a/.github/workflows/loop.yml +++ b/.github/workflows/loop.yml @@ -19,7 +19,7 @@ jobs: matrix: language: [ 'generic', 'javascript', '' ] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4 with: fetch-depth: 0 - run: | diff --git a/.github/workflows/semgrep-self-test.yml b/.github/workflows/semgrep-self-test.yml index 76a713bd..8cff8089 100644 --- a/.github/workflows/semgrep-self-test.yml +++ b/.github/workflows/semgrep-self-test.yml @@ -14,7 +14,7 @@ jobs: name: semgrep-self-test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4 - run: | python3 -m pip --disable-pip-version-check install -r requirements.txt shell: bash diff --git a/action.yml b/action.yml index 79d4b1de..53b0a9f6 100644 --- a/action.yml +++ b/action.yml @@ -122,7 +122,7 @@ runs: printf '${{ steps.changed-files.outputs.any_changed }}' - id: comments-before if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' }} - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | var query = `query($owner:String!, $name:String!, $prnumber:Int!) { @@ -190,12 +190,12 @@ runs: - if: ${{ steps.reviewdog-enabled.outputs.result == 'true' }} name: Cache pip cache id: cache-pip - uses: actions/cache@v3 + uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 with: path: ~/.cache/pip/ key: ${{ runner.os }}-pip - if: ${{ steps.reviewdog-enabled.outputs.result == 'true' }} - uses: reviewdog/action-setup@v1 + uses: reviewdog/action-setup@80a06617492b461a66508e2dedf16233f0506804 # v1 with: reviewdog_version: latest # Optional. [latest,nightly,v.X.Y.Z] - if: ${{ steps.reviewdog-enabled.outputs.result == 'true' }} @@ -220,7 +220,7 @@ runs: version: 1.0 - if: ${{ steps.reviewdog-enabled.outputs.result == 'true' }} name: Install tfsec - uses: jaxxstorm/action-install-gh-release@v1.10.0 + uses: jaxxstorm/action-install-gh-release@c5ead9a448b4660cf1e7866ee22e4dc56538031a # v1.10.0 with: # Grab a specific tag with caching repo: aquasecurity/tfsec tag: v1.28.1 @@ -251,7 +251,7 @@ runs: - id: comments-after if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' }} - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | var query = `query($owner:String!, $name:String!, $prnumber:Int!) { @@ -293,7 +293,7 @@ runs: - id: assignees-after if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' }} - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 env: ASSIGNEES: ${{ inputs.assignees }} with: @@ -345,7 +345,7 @@ runs: - id: assignee-removed-label if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' }} - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 env: ASSIGNEES: ${{ steps.assignees-after.outputs.result && fromJson(steps.assignees-after.outputs.result) }} with: @@ -390,7 +390,7 @@ runs: - id: description-contains-hotwords if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && github.actor != 'renovate[bot]' }} - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 env: HOTWORDS: ${{ inputs.hotwords }} with: @@ -427,12 +427,12 @@ runs: run: | set -x echo "result=true" >> $GITHUB_OUTPUT - - uses: actions-ecosystem/action-add-labels@v1 + - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1 if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && steps.should-trigger.outputs.result == 'true' }} with: github_token: ${{ inputs.github_token }} labels: needs-security-review - - uses: actions-ecosystem/action-add-assignees@v1 + - uses: actions-ecosystem/action-add-assignees@ce5019e63cc4f35aba27308dc88d19c8f3686747 # v1 if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && steps.should-trigger.outputs.result == 'true' }} with: github_token: ${{ inputs.github_token }} @@ -449,7 +449,7 @@ runs: run: exit 1 - if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && inputs.slack_token && hashFiles('reviewdog.fail.log') }} id: reviewdog-fail-log-head - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | return '\n'+require('fs').readFileSync('reviewdog.fail.log', 'UTF-8').split('\n').slice(0, 4).join('\n') @@ -459,7 +459,7 @@ runs: ASSIGNEES: ${{steps.assignees-after.outputs.result && fromJson(steps.assignees-after.outputs.result)}} run: echo "result=$(echo "$ASSIGNEES" | sed 's|\([^ ]\)|@\1|' | tr -s '\n' ' ')" >> $GITHUB_OUTPUT shell: bash - - uses: actions-ecosystem/action-slack-notifier@v1 + - uses: actions-ecosystem/action-slack-notifier@fc778468d09c43a6f4d1b8cccaca59766656996a # v1 if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && inputs.slack_token && hashFiles('reviewdog.fail.log') }} with: slack_token: ${{ inputs.slack_token }} @@ -468,7 +468,7 @@ runs: channel: secops-hotspots color: red verbose: true - - uses: actions-ecosystem/action-slack-notifier@v1 + - uses: actions-ecosystem/action-slack-notifier@fc778468d09c43a6f4d1b8cccaca59766656996a # v1 if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && inputs.slack_token && steps.should-trigger.outputs.result == 'true' }} with: slack_token: ${{ inputs.slack_token }} @@ -480,21 +480,21 @@ runs: # CodeQL Steps - if: ${{ steps.codeql-enabled.outputs.result == 'true' && hashFiles(inputs.codeql_config) }} name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2 with: languages: ${{ matrix.language }} config-file: ${{ inputs.codeql_config }} - if: ${{ steps.codeql-enabled.outputs.result == 'true' && !hashFiles(inputs.codeql_config)}} name: Initialize CodeQL (without config) - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2 with: languages: ${{ matrix.language }} - if: ${{ steps.codeql-enabled.outputs.result == 'true' }} name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2 - if: ${{ steps.codeql-enabled.outputs.result == 'true' }} name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2 # - run: echo ${{ inputs.in-name }} # shell: bash # - id: output-step-id