diff --git a/.github/workflows/e2e-nightly.yml b/.github/workflows/e2e-nightly.yml index 099a310..951343a 100644 --- a/.github/workflows/e2e-nightly.yml +++ b/.github/workflows/e2e-nightly.yml @@ -23,10 +23,10 @@ jobs: NETKEEP_R2_ACCESS_KEY: ${{ secrets.NETKEEP_R2_ACCESS_KEY }} NETKEEP_R2_SECRET_KEY: ${{ secrets.NETKEEP_R2_SECRET_KEY }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: '22' cache: npm @@ -36,7 +36,7 @@ jobs: run: npx playwright install --with-deps chromium firefox webkit - name: Run complete journey run: ./scripts/e2e-test.sh all - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: always() with: name: playwright-complete diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b9907e9..6c49fba 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: contents: read packages: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false @@ -49,13 +49,13 @@ jobs: cat "${RELEASE_ERROR}" exit 1 fi - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: docker.io username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -88,23 +88,23 @@ jobs: outputs: digest: ${{ steps.build.outputs.digest }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 + - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: docker.io username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - id: meta - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 with: images: | ghcr.io/lrqnet/netkeep @@ -115,7 +115,7 @@ jobs: type=semver,pattern={{major}} type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }} - id: build - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a with: context: . target: production @@ -144,30 +144,30 @@ jobs: outputs: digest: ${{ steps.build.outputs.digest }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 + - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: docker.io username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - id: meta - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 with: images: | ghcr.io/lrqnet/netkeep-oxidized docker.io/lrqnet/netkeep-oxidized tags: type=raw,value=0.37.0-r5 - id: build - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a with: context: . file: Dockerfile.oxidized @@ -195,23 +195,23 @@ jobs: outputs: digest: ${{ steps.build.outputs.digest }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 + - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 with: registry: docker.io username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - id: meta - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 with: images: | ghcr.io/lrqnet/netkeep-updater @@ -222,7 +222,7 @@ jobs: type=semver,pattern={{major}} type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }} - id: build - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a with: context: . file: Dockerfile.updater @@ -254,7 +254,7 @@ jobs: contents: write id-token: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Create digest-pinned release Compose @@ -301,7 +301,7 @@ jobs: cosign-release: v3.0.6 - name: Sign update manifest run: cosign sign-blob --yes --bundle dist/update-manifest.sigstore.json dist/update-manifest.json - - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 + - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 with: generate_release_notes: true files: | diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index ecb3a2d..a0b1594 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -16,13 +16,13 @@ jobs: dependencies: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 with: php-version: '8.4' - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: '22' cache: npm @@ -36,10 +36,10 @@ jobs: filesystem: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 with: scan-type: fs scan-ref: . @@ -56,7 +56,7 @@ jobs: continue-on-error: true with: sarif_file: trivy-results.sarif - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: always() with: name: trivy-filesystem-sarif @@ -66,11 +66,11 @@ jobs: secrets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false fetch-depth: 0 - - uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 with: scan-type: fs scan-ref: . @@ -78,7 +78,7 @@ jobs: format: table output: trivy-secrets.txt exit-code: '1' - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: always() with: name: trivy-secrets @@ -101,12 +101,12 @@ jobs: build: docker build -f Dockerfile.updater -t netkeep-updater:scan . image: netkeep-updater:scan steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Build ${{ matrix.name }} run: ${{ matrix.build }} - - uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 with: image-ref: ${{ matrix.image }} format: table @@ -114,7 +114,7 @@ jobs: severity: HIGH,CRITICAL ignore-unfixed: true exit-code: '0' - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: always() with: name: trivy-${{ matrix.name }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index bcb7270..6189bb1 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -12,7 +12,7 @@ jobs: updater: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Go format and tests @@ -31,15 +31,15 @@ jobs: quality: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 with: php-version: '8.4' tools: composer:v2 coverage: none - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: '22' cache: npm @@ -97,14 +97,14 @@ jobs: DB_USERNAME: netkeep DB_PASSWORD: netkeep-test steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 with: php-version: '8.4' coverage: none - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: '22' cache: npm @@ -121,10 +121,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: '22' cache: npm @@ -134,7 +134,7 @@ jobs: run: npx playwright install --with-deps chromium - name: Run clean installation and integration journey run: ./scripts/e2e-test.sh chromium - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: always() with: name: playwright-chromium