From 63b9aef52f41e7f95b35c110bdbd13bb6de383a7 Mon Sep 17 00:00:00 2001 From: Arif Burak Demiray Date: Thu, 12 Nov 2026 15:19:05 +0300 Subject: [PATCH 1/2] ci: pin actions to commit SHAs --- .github/workflows/packaging.yml | 12 ++++++------ .github/workflows/release_notice.yml | 4 ++-- .github/workflows/sbom.yml | 6 +++--- .github/workflows/tests.yml | 12 ++++++------ 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml index fc93b0e..fb99e4b 100644 --- a/.github/workflows/packaging.yml +++ b/.github/workflows/packaging.yml @@ -42,7 +42,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Compare the package versions with COUNTLY_SDK_VERSION run: | @@ -92,7 +92,7 @@ jobs: shell: bash steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Pack this commit like a release and point the port at it run: | @@ -117,7 +117,7 @@ jobs: fi - name: Restore the vcpkg binary cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ${{ runner.temp }}/vcpkg-cache key: vcpkg-${{ matrix.triplet }}-${{ github.run_id }} @@ -198,10 +198,10 @@ jobs: shell: bash steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" @@ -211,7 +211,7 @@ jobs: conan profile detect --force - name: Restore the Conan package cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.conan2/p key: conan-${{ matrix.os }}-${{ github.run_id }} diff --git a/.github/workflows/release_notice.yml b/.github/workflows/release_notice.yml index c0c1fb0..947ef81 100644 --- a/.github/workflows/release_notice.yml +++ b/.github/workflows/release_notice.yml @@ -27,7 +27,7 @@ jobs: } >> "$GITHUB_ENV" - name: Send custom JSON data to Slack workflow id: slack - uses: slackapi/slack-github-action@v1.23.0 + uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0 with: # This data can be any valid JSON from a previous step in the GitHub Action payload: | @@ -41,7 +41,7 @@ jobs: env: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE }} - name: Send custom JSON data to Discord - uses: sarisia/actions-status-discord@v1.13.0 + uses: sarisia/actions-status-discord@9904e3130b8905d5b973df25623f17672dcb3466 # v1.13.0 with: webhook: ${{ secrets.DISCORD_WEBHOOK_URL }} nodetail: true diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 9f64bc6..d38c8fa 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -21,7 +21,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" @@ -41,7 +41,7 @@ jobs: -o "countly-sdk-cpp-${{ steps.generate.outputs.version }}.tar.gz" HEAD - name: Attest SBOM - uses: actions/attest-sbom@v2 + uses: actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2.4.0 with: subject-path: countly-sdk-cpp-${{ steps.generate.outputs.version }}.tar.gz sbom-path: ${{ steps.generate.outputs.sbom_file }} @@ -58,7 +58,7 @@ jobs: - name: Upload as workflow artifact (manual runs) if: github.event_name == 'workflow_dispatch' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: sbom path: | diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index dab326b..f2d5590 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" @@ -108,7 +108,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" @@ -137,7 +137,7 @@ jobs: timeout-minutes: 30 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" @@ -211,7 +211,7 @@ jobs: shell: bash steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" @@ -268,7 +268,7 @@ jobs: abi: [arm64-v8a, x86_64] steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" @@ -291,7 +291,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" From e4aeb478d64f443355400b540ad7009adaf82f29 Mon Sep 17 00:00:00 2001 From: Arif Burak Demiray Date: Thu, 12 Nov 2026 15:19:06 +0300 Subject: [PATCH 2/2] ci: keep actions updated with Dependabot --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2ea7026 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: "/" + target-branch: staging + schedule: + interval: monthly + groups: + github-actions: + patterns: [ "*" ] + commit-message: + prefix: "chore(ci)"