Skip to content

pin GitHub Actions to full commit SHAs and rework actions SHAs to own variables #3035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aldas merged 1 commit into from
Jul 6, 2026
+27 −15
Merged

pin GitHub Actions to full commit SHAs and rework actions SHAs to own variables #3035

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions .github/workflows/checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,26 @@ on:
workflow_dispatch:

permissions:
contents: read # to fetch code (actions/checkout)
contents: read # to fetch code (actions/checkout)

env:
# run static analysis only with the latest Go version
LATEST_GO_VERSION: "1.26"

# https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10
CHECKOUT_ACTION: &checkout_action actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

# https://github.com/actions/setup-go/commit/924ae3a1cded613372ab5595356fb5720e22ba16
SETUP_GO_ACTION: &setup_go_action actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

jobs:
check:
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v6
uses: *checkout_action

- name: Set up Go ${{ matrix.go }}
uses: actions/setup-go@v6
- name: Set up Go
uses: *setup_go_action
with:
go-version: ${{ env.LATEST_GO_VERSION }}
check-latest: true
Expand All @@ -44,4 +49,3 @@ jobs:
go version
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

26 changes: 17 additions & 9 deletions .github/workflows/echo.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,20 @@ on:
workflow_dispatch:

permissions:
contents: read # to fetch code (actions/checkout)
contents: read # to fetch code (actions/checkout)

env:
# run coverage and benchmarks only with the latest Go version
LATEST_GO_VERSION: "1.26"

# https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10
CHECKOUT_ACTION: &checkout_action actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

# https://github.com/actions/setup-go/commit/924ae3a1cded613372ab5595356fb5720e22ba16
SETUP_GO_ACTION: &setup_go_action actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

# https://github.com/codecov/codecov-action/commit/fb8b3582c8e4def4969c97caa2f19720cb33a72f
CODECOV_ACTION: &codecov_action codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7

jobs:
test:
strategy:
Expand All @@ -30,10 +38,10 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- name: Checkout Code
uses: actions/checkout@v6
uses: *checkout_action

- name: Set up Go ${{ matrix.go }}
uses: actions/setup-go@v6
uses: *setup_go_action
with:
go-version: ${{ matrix.go }}

Expand All @@ -42,7 +50,7 @@ jobs:

- name: Upload coverage to Codecov
if: success() && matrix.go == env.LATEST_GO_VERSION && matrix.os == 'ubuntu-latest'
uses: codecov/codecov-action@v6
uses: *codecov_action
with:
token:
fail_ci_if_error: false
Expand All @@ -53,18 +61,18 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Code (Previous)
uses: actions/checkout@v6
uses: *checkout_action
with:
ref: ${{ github.base_ref }}
path: previous

- name: Checkout Code (New)
uses: actions/checkout@v6
uses: *checkout_action
with:
path: new

- name: Set up Go ${{ matrix.go }}
uses: actions/setup-go@v6
- name: Set up Go
uses: *setup_go_action
with:
go-version: ${{ env.LATEST_GO_VERSION }}

Expand Down
Loading