From 55a14b527321c897fb2fb7b8fe90dfa4bc716b6a Mon Sep 17 00:00:00 2001 From: Elodie Mirza Date: Sat, 1 Aug 2026 11:15:28 +0100 Subject: [PATCH 1/2] ci: pin workflow actions to shas Signed-off-by: Elodie Mirza --- .github/workflows/docs.yml | 2 +- .../factory-rust-builder-ubuntu-validation.yml | 2 +- .github/workflows/merge-gate.yml | 2 +- .github/workflows/rust-ci.yml | 10 +++++----- .github/workflows/secret-scan.yml | 2 +- .github/workflows/security.yml | 6 +++--- .github/workflows/supply-chain.yml | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 44e6dd4..2937766 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 - name: Verify docs run: scripts/verify-docs.sh diff --git a/.github/workflows/factory-rust-builder-ubuntu-validation.yml b/.github/workflows/factory-rust-builder-ubuntu-validation.yml index 83dc894..eefe852 100644 --- a/.github/workflows/factory-rust-builder-ubuntu-validation.yml +++ b/.github/workflows/factory-rust-builder-ubuntu-validation.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 - name: Log in to GHCR env: diff --git a/.github/workflows/merge-gate.yml b/.github/workflows/merge-gate.yml index 215f830..303f85c 100644 --- a/.github/workflows/merge-gate.yml +++ b/.github/workflows/merge-gate.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout trusted gate logic - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 with: ref: ${{ github.event.repository.default_branch }} persist-credentials: false diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 7435670..7c61d4d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -44,7 +44,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 - name: Install Rust run: rustup toolchain install ${{ matrix.toolchain }} --profile minimal @@ -56,7 +56,7 @@ jobs: run: rustup component add clippy rustfmt - name: Cache Cargo registry - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag: v6 with: path: | ~/.cargo/registry @@ -116,7 +116,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 - name: Install Rust run: | @@ -132,7 +132,7 @@ jobs: rustup component add clippy --toolchain 1.80.0 - name: Cache Cargo registry - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag: v6 with: path: | ~/.cargo/registry @@ -151,7 +151,7 @@ jobs: run: echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT" - name: Cache advisory database - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag: v6 with: path: ~/.cargo/advisory-db key: ${{ runner.os }}-cargo-advisory-release-script-${{ steps.advisory-cache.outputs.week }}-${{ hashFiles('.github/workflows/rust-ci.yml', 'scripts/install-release-tools.sh') }} diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index d65fd9a..168ee8a 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 with: fetch-depth: 0 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index ae60bb0..18ab966 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -51,13 +51,13 @@ jobs: timeout-minutes: 25 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 - name: Install Rust run: rustup toolchain install stable --profile minimal - name: Cache Cargo - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag: v6 with: path: | ~/.cargo/registry @@ -72,7 +72,7 @@ jobs: run: echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT" - name: Cache advisory database - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag: v6 with: path: ~/.cargo/advisory-db key: ${{ runner.os }}-cargo-advisory-${{ steps.advisory-cache.outputs.week }}-${{ hashFiles('.github/workflows/security.yml', 'scripts/install-release-tools.sh') }} diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 3793b23..37897e8 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -59,13 +59,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag: v7 - name: Install Rust run: rustup toolchain install stable --profile minimal - name: Cache Cargo - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag: v6 with: path: | ~/.cargo/registry From 5ef23e799caf035cbe00ee48aea345df30f7c686 Mon Sep 17 00:00:00 2001 From: Elodie Mirza Date: Sat, 1 Aug 2026 11:23:10 +0100 Subject: [PATCH 2/2] chore: update supply-chain workflow hashes --- supply-chain/SHA256SUMS | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/supply-chain/SHA256SUMS b/supply-chain/SHA256SUMS index 7d39c2b..06b3f2b 100644 --- a/supply-chain/SHA256SUMS +++ b/supply-chain/SHA256SUMS @@ -1,11 +1,11 @@ 587a2d98f4dca854692940758b3f0f5e1df8333f511e3aef75004abf40f3be7d .github/dependabot.yml -51de682077fe144c35b2c40a77562eb659ced13938a6804e255a3a2143527980 .github/workflows/docs.yml -2bc8c4bef8a7f29a4c728e73824c01b4fe0423cd0708dd559c21dd471d1420a9 .github/workflows/factory-rust-builder-ubuntu-validation.yml -66f5d78f2d4e41997856caa465649dc12ab1a9154e060a417463105708f8287e .github/workflows/merge-gate.yml -2d136a12d2601edf8c837fb91004165c2a887e42fd9c5f5419bc7f7cb7bd2196 .github/workflows/rust-ci.yml -2dcde10bada7a28cf5e11f05829a7aa604592e1f463050d8009fac5bce6659d3 .github/workflows/secret-scan.yml -67065458d4550b561e2fa9c06ff9b487d31ed81f96585c9f64631b8e8f285150 .github/workflows/security.yml -6596a69911194dc1a858f13cc8b4e431b64adbf14e5a5d9294b2faa19aed1141 .github/workflows/supply-chain.yml +0044363aee7a5d5ed05f2ff8ee2fa5d588feaad37097c06888ebb40857e0be50 .github/workflows/docs.yml +681f327c612c0910434b595f60057af1cf214f8c430a9add0d589358757fdb76 .github/workflows/factory-rust-builder-ubuntu-validation.yml +b678ff2b2a071274dcbd4f272160c97f75eb03ac9b7570f9d3195b4a64403d65 .github/workflows/merge-gate.yml +a5c81a05767bd9c9832d2494643ccd68a266896b823b25bbc57eac9d699925a8 .github/workflows/rust-ci.yml +32d287ff65e10ab559a48c76513ec144bb80bf763d4dbc43f40d9731ad3d1c44 .github/workflows/secret-scan.yml +382bb611ad1a9abf27faaa59aea0b44aee4db712bef0743cdd56055ed5d88110 .github/workflows/security.yml +d04c69ed0d1f7d35fa99f3629de934411fd5e64b6fc3994b24a93f3fb1750e50 .github/workflows/supply-chain.yml 9821d4fcd34086f66c64309b7b9e22e49ef519f922a7069a7ddb1125ff40e76f Cargo.lock dfade02b11516cba954fad124711671300ec6edf5545e3486e1a0983087e6eed Cargo.toml d1ed6be3874d77ee89a1602d0be549b282625489d399884e6fdb8dfd96e6fb2b crates/aprs-cli/Cargo.toml