workflow: pin GitHub actions to their full length commit SHA

Used https://github.com/step-security/secure-repo to help with it
intel · Feb 1, 2024 · 12cfc77 · 12cfc77
1 parent 981328f
commit 12cfc77
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 21 deletions.
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
@@ -6,19 +6,22 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   # Build shared library with GMake (Clang)
   release-gmake-clang-shared:
     runs-on: ubuntu-22.04
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           repository: 'intel/intel-ipsec-mb'
 
       - name: Build
-        uses: vmactions/freebsd-vm@v1
+        uses: vmactions/freebsd-vm@35a5b20a98476a681c7576a344775be7e7f77f06 # v1.0.6
         with:
           usesh: true
           mem: 8192
@@ -33,12 +36,12 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           repository: 'intel/intel-ipsec-mb'
 
       - name: Build
-        uses: vmactions/freebsd-vm@v1
+        uses: vmactions/freebsd-vm@35a5b20a98476a681c7576a344775be7e7f77f06 # v1.0.6
         with:
           usesh: true
           mem: 8192
@@ -53,12 +56,12 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           repository: 'intel/intel-ipsec-mb'
 
       - name: Clang Release Build
-        uses: vmactions/freebsd-vm@v1
+        uses: vmactions/freebsd-vm@35a5b20a98476a681c7576a344775be7e7f77f06 # v1.0.6
         with:
           usesh: true
           mem: 8192
@@ -79,12 +82,12 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           repository: 'intel/intel-ipsec-mb'
 
       - name: Release build with GCC
-        uses: vmactions/freebsd-vm@v1
+        uses: vmactions/freebsd-vm@35a5b20a98476a681c7576a344775be7e7f77f06 # v1.0.6
         with:
           usesh: true
           mem: 8192

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   # Build shared library with Make (GCC)
   release-make-gcc-shared:
@@ -16,7 +19,7 @@ jobs:
       run: sudo apt-get install -y nasm
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: intel/intel-ipsec-mb
 
@@ -39,7 +42,7 @@ jobs:
       run: sudo apt-get install -y nasm
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: intel/intel-ipsec-mb
 
@@ -55,7 +58,7 @@ jobs:
       run: sudo apt-get install -y nasm clang
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: intel/intel-ipsec-mb
 
@@ -71,7 +74,7 @@ jobs:
       run: sudo apt-get install -y nasm clang
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: intel/intel-ipsec-mb
 
@@ -87,7 +90,7 @@ jobs:
       run: sudo apt-get install -y nasm clang
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: intel/intel-ipsec-mb
 
@@ -105,7 +108,7 @@ jobs:
       run: sudo apt-get install -y nasm
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: 'intel/intel-ipsec-mb'
 
@@ -138,7 +141,7 @@ jobs:
       run: sudo apt-get install -y nasm
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: 'intel/intel-ipsec-mb'
 

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   # CMake release build with shared library (msbuild)
   release-cmake-msvc-msbuild:
@@ -15,15 +18,15 @@ jobs:
 
     steps:
     - name: Setup NASM
-      uses: ilammy/setup-nasm@v1
+      uses: ilammy/setup-nasm@13cbeb366c45c4379d3478cdcbadd8295feb5028 # v1.5.1
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: 'intel/intel-ipsec-mb'
 
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.0.2
+      uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
 
     - name: Setup environment
       run: |
@@ -50,15 +53,15 @@ jobs:
 
     steps:
     - name: Setup NASM
-      uses: ilammy/setup-nasm@v1
+      uses: ilammy/setup-nasm@13cbeb366c45c4379d3478cdcbadd8295feb5028 # v1.5.1
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         repository: 'intel/intel-ipsec-mb'
 
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.0.2
+      uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
 
     - name: Setup environment
       run: |