Skip to content

Commit 108670c

Browse files
xophamxopham
authored
ci: pin github actions by hash and update via dependabot (#6626)
## Summary of changes - **Add dependabot for github actions** - **Pin actions by hash** ## Reason for change Pinning 3rd-party GitHub Actions by commit SHA makes them less vulnerable to compromise of the 3rd party. To avoid outdating and non-verbosity, versions are commented after the SHA and updating via dependabot is introduced that will automatically update the commented version tag as well. In case of a false commit SHA, this change could break the corresponding workflow. Typically, this does not cause major interruptions, but it can for example affect a release pipeline and require restart causing delays. ## Implementation details ## Test coverage ## Other details <!-- Fixes #{issue} --> <!-- ⚠️ Note: where possible, please obtain 2 approvals prior to merging. Unless CODEOWNERS specifies otherwise, for external teams it is typically best to have one review from a team member, and one review from apm-dotnet. Trivial changes do not require 2 reviews. -->
1 parent e7aa45c commit 108670c

25 files changed

+80
-71
lines changed

‎.github/dependabot.yml

+9
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,12 @@ updates:
9494
- dependency-name: "System.Reflection.Emit"
9595
- dependency-name: "System.Reflection.Emit.Lightweight"
9696
### End Datadog.Trace.csproj ignored dependencies
97+
98+
- package-ecosystem: "github-actions"
99+
directory: "/"
100+
schedule:
101+
interval: "monthly"
102+
groups:
103+
gh-actions-packages:
104+
patterns:
105+
- "*"

‎.github/workflows/auto_add_vnext_milestone_to_pr.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,14 @@ jobs:
1818
issues: write # need to potentially create a new milestone
1919
steps:
2020
- name: Checkout
21-
uses: actions/checkout@v2
21+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
2222

23-
- uses: actions/setup-dotnet@v1
23+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
2424
with:
2525
dotnet-version: '9.0.102'
2626

2727
- name: "Assign to vNext Milestone"
2828
run: ./tracer/build.sh AssignPullRequestToMilestone
2929
env:
3030
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
31-
PullRequestNumber: "${{ github.event.pull_request.number }}"
31+
PullRequestNumber: "${{ github.event.pull_request.number }}"

‎.github/workflows/auto_bump_test_package_versions.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ jobs:
2323
run: git config --system core.longpaths true
2424

2525
- name: Checkout
26-
uses: actions/checkout@v2
26+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
2727
with:
2828
ref: ${{ github.event.pull_request.base.sha }}
2929

30-
- uses: actions/setup-dotnet@v1
30+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
3131
with:
3232
dotnet-version: '9.0.102'
3333

@@ -36,7 +36,7 @@ jobs:
3636

3737
- name: Create Pull Request
3838
id: pr
39-
uses: peter-evans/create-pull-request@v3.10.0
39+
uses: peter-evans/create-pull-request@9825ae65b1cb54b543b938503728b432a0176d29 # v3.10.0
4040
with:
4141
token: ${{ secrets.GITHUB_TOKEN }}
4242
branch: "bot/test-package-versions-bump"
@@ -51,7 +51,7 @@ jobs:
5151
5252
- name: Send Slack notification about generating failure
5353
if: failure()
54-
uses: slackapi/slack-github-action@v1.26.0
54+
uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
5555
with:
5656
# This data can be any valid JSON from a previous step in the GitHub Action
5757
payload: |

‎.github/workflows/auto_check_snapshots.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ jobs:
1313

1414
steps:
1515
- name: Checkout
16-
uses: actions/checkout@v2
16+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
1717
with:
1818
fetch-depth: 0
1919

20-
- uses: actions/setup-dotnet@v1
20+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
2121
with:
2222
dotnet-version: '9.0.102'
2323

@@ -26,4 +26,4 @@ jobs:
2626
env:
2727
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
2828
PullRequestNumber: "${{ github.event.pull_request.number }}"
29-
TargetBranch: "${{ github.base_ref }}"
29+
TargetBranch: "${{ github.base_ref }}"

‎.github/workflows/auto_code_freeze_block_pr.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
statuses: write # add a commit status check
1919

2020
steps:
21-
- uses: octokit/request-action@v2.x
21+
- uses: octokit/request-action@786351db496fa66730d8faa09ef279108da175a3 # v2.x
2222
name: 'Get Milestones'
2323
id: milestones
2424
with:
@@ -53,4 +53,4 @@ jobs:
5353
"https://api.github.com/repos/DataDog/dd-trace-dotnet/statuses/$sha" \
5454
-d '{"state":"'"$state"'","context":"code_freeze","description":"'"$description"'","target_url":"'"$targetUrl"'"}'
5555
56-
name: 'Check Code Freeze status'
56+
name: 'Check Code Freeze status'

‎.github/workflows/auto_create_version_bump_pr.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
}
3737
3838
- name: Checkout
39-
uses: actions/checkout@v2
39+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
4040
with:
4141
ref: ${{ steps.select_branch.outputs.ref }}
4242

@@ -45,7 +45,7 @@ jobs:
4545
git config user.name "${{ github.actor }}"
4646
git config user.email "${{ github.actor }}@users.noreply.github.com"
4747
48-
- uses: actions/setup-dotnet@v1
48+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
4949
with:
5050
dotnet-version: '9.0.102'
5151

@@ -70,7 +70,7 @@ jobs:
7070

7171
- name: Create Pull Request
7272
id: pr
73-
uses: peter-evans/create-pull-request@v3.10.0
73+
uses: peter-evans/create-pull-request@9825ae65b1cb54b543b938503728b432a0176d29 # v3.10.0
7474
with:
7575
token: ${{ secrets.GITHUB_TOKEN }}
7676
branch: "version-bump-${{steps.versions.outputs.full_version}}"

‎.github/workflows/auto_deploy_aas_test_apps.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ jobs:
1818

1919
steps:
2020
- name: Clone dd-trace-dotnet repository
21-
uses: actions/checkout@v3
21+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2222

23-
- uses: octokit/request-action@v2.x
23+
- uses: octokit/request-action@786351db496fa66730d8faa09ef279108da175a3 # v2.x
2424
name: 'Open Code Freeze Milestone'
2525
id: milestones
2626
if: github.event_name != 'workflow_dispatch'
@@ -51,4 +51,4 @@ jobs:
5151
name: 'Trigger AAS deploy'
5252
if: env.stop != 'true'
5353
with:
54-
aas_github_token: ${{ secrets.GH_EXTERNAL_TOKEN }}
54+
aas_github_token: ${{ secrets.GH_EXTERNAL_TOKEN }}

‎.github/workflows/auto_label_prs.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ jobs:
1414

1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v2
17+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
1818

19-
- uses: actions/setup-dotnet@v1
19+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
2020
with:
2121
dotnet-version: '9.0.102'
2222

2323
- name: "Add labels"
2424
run: ./tracer/build.sh AssignLabelsToPullRequest
2525
env:
2626
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
27-
PullRequestNumber: "${{ github.event.pull_request.number }}"
27+
PullRequestNumber: "${{ github.event.pull_request.number }}"

‎.github/workflows/auto_update_benchmark_branches.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ jobs:
1515
contents: write # Creates and deletes branches
1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@v2
18+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
1919
with:
2020
fetch-depth: 0
2121

22-
- uses: actions/setup-dotnet@v1
22+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
2323
with:
2424
dotnet-version: '9.0.102'
2525

‎.github/workflows/code_freeze_end.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ jobs:
2121

2222
steps:
2323
- name: Clone dd-trace-dotnet repository
24-
uses: actions/checkout@v3
24+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2525

26-
- uses: octokit/request-action@v2.x
26+
- uses: octokit/request-action@786351db496fa66730d8faa09ef279108da175a3 # v2.x
2727
name: 'Close Code Freeze Milestone'
2828
id: milestones
2929
if: github.event_name == 'workflow_dispatch'
@@ -68,4 +68,4 @@ jobs:
6868
with:
6969
page_number: 4
7070
github_token: ${{ secrets.GITHUB_TOKEN }}
71-
end_freeze: "true"
71+
end_freeze: "true"

‎.github/workflows/code_freeze_start.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ jobs:
2222

2323
steps:
2424
- name: Clone dd-trace-dotnet repository
25-
uses: actions/checkout@v3
25+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2626

27-
- uses: octokit/request-action@v2.x
27+
- uses: octokit/request-action@786351db496fa66730d8faa09ef279108da175a3 # v2.x
2828
name: 'Open Code Freeze Milestone'
2929
id: milestones
3030
if: github.event_name == 'workflow_dispatch'
@@ -69,4 +69,4 @@ jobs:
6969
- uses: ./.github/actions/deploy-aas-dev-apps
7070
name: 'Trigger AAS deploy'
7171
with:
72-
aas_github_token: ${{ secrets.GH_EXTERNAL_TOKEN }}
72+
aas_github_token: ${{ secrets.GH_EXTERNAL_TOKEN }}

‎.github/workflows/codeql-analysis.yml

+12-12
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ jobs:
2121

2222
steps:
2323
- name: Checkout repository
24-
uses: actions/checkout@v2
24+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
2525

26-
- uses: actions/setup-dotnet@v1
26+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
2727
with:
2828
dotnet-version: '9.0.102'
2929

@@ -33,7 +33,7 @@ jobs:
3333
3434
# Initializes the CodeQL tools for scanning.
3535
- name: Initialize CodeQL
36-
uses: github/codeql-action/init@v2
36+
uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
3737
with:
3838
languages: csharp, cpp
3939
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,10 +54,10 @@ jobs:
5454
./tracer/build.sh BuildProfilerHome BuildNativeLoader
5555
5656
- name: Perform CodeQL Analysis
57-
uses: github/codeql-action/analyze@v2
57+
uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
5858

5959
- name: filter-sarif cpp
60-
uses: advanced-security/filter-sarif@v1
60+
uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
6161
with:
6262
patterns: |
6363
-**/src/Demos/**
@@ -69,7 +69,7 @@ jobs:
6969
output: ../results/cpp.sarif
7070

7171
- name: filter-sarif csharp
72-
uses: advanced-security/filter-sarif@v1
72+
uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
7373
with:
7474
patterns: |
7575
-**/src/Demos/**
@@ -97,9 +97,9 @@ jobs:
9797

9898
steps:
9999
- name: Checkout repository
100-
uses: actions/checkout@v2
100+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
101101

102-
- uses: actions/setup-dotnet@v1
102+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
103103
with:
104104
dotnet-version: '9.0.102'
105105

@@ -109,7 +109,7 @@ jobs:
109109
110110
# Initializes the CodeQL tools for scanning.
111111
- name: Initialize CodeQL
112-
uses: github/codeql-action/init@v2
112+
uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
113113
with:
114114
languages: csharp, cpp
115115
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -130,10 +130,10 @@ jobs:
130130
./tracer/build.sh BuildTracerHome
131131
132132
- name: Perform CodeQL Analysis
133-
uses: github/codeql-action/analyze@v2
133+
uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
134134

135135
- name: filter-sarif cpp
136-
uses: advanced-security/filter-sarif@v1
136+
uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
137137
with:
138138
patterns: |
139139
-**/src/Demos/**
@@ -145,7 +145,7 @@ jobs:
145145
output: ../results/cpp.sarif
146146

147147
- name: filter-sarif csharp
148-
uses: advanced-security/filter-sarif@v1
148+
uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
149149
with:
150150
patterns: |
151151
-**/src/Demos/**

‎.github/workflows/create-system-test-docker-base-images.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,11 @@ jobs:
2727
AZURE_DEVOPS_TOKEN: "${{ secrets.AZURE_DEVOPS_TOKEN }}"
2828
steps:
2929
- name: Checkout
30-
uses: actions/checkout@v3
30+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3131
with:
3232
fetch-depth: 0
3333

34-
- uses: actions/setup-dotnet@v1
34+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
3535
with:
3636
dotnet-version: '9.0.102'
3737

@@ -52,4 +52,4 @@ jobs:
5252
package_version: "${{steps.versions.outputs.version}}"
5353
lib_waf_version: "${{steps.versions.outputs.lib_waf_version}}"
5454
waf_rules_version: "${{steps.versions.outputs.waf_rules_version}}"
55-
github_token: ${{ secrets.GITHUB_TOKEN }}
55+
github_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/create_draft_release.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323

2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v2
26+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
2727
with:
2828
fetch-depth: 0
2929

@@ -38,7 +38,7 @@ jobs:
3838
echo "Using sha $commitsha"
3939
echo "sha=${commitsha}" >> $GITHUB_OUTPUT
4040
41-
- uses: actions/setup-dotnet@v1
41+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
4242
with:
4343
dotnet-version: '9.0.102'
4444

@@ -84,7 +84,7 @@ jobs:
8484
git push origin "v${{steps.versions.outputs.full_version}}"
8585
8686
- name: Create Release
87-
uses: softprops/action-gh-release@v1
87+
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1.0.0
8888
with:
8989
draft: true
9090
name: "${{steps.versions.outputs.full_version}}"

‎.github/workflows/create_hotfix_branch.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,14 @@ jobs:
2727
run: git config --system core.longpaths true
2828

2929
- name: Checkout
30-
uses: actions/checkout@v2
30+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
3131

3232
- name: "Configure Git Credentials"
3333
run: |
3434
git config user.name "${{ github.actor }}"
3535
git config user.email "${{ github.actor }}@users.noreply.github.com"
3636
37-
- uses: actions/setup-dotnet@v1
37+
- uses: actions/setup-dotnet@71a4fd9b27383962fc5df13a9c871636b43199b4 # v1.10.0
3838
with:
3939
dotnet-version: '9.0.102'
4040

‎.github/workflows/datadog-static-analysis.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
statuses: write # add status checks (?)
1212
steps:
1313
- name: Checkout
14-
uses: actions/checkout@v3
14+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1515
- name: Check code meets quality standards
1616
id: datadog-static-analysis
1717
uses: DataDog/datadog-static-analyzer-github-action@v1
@@ -22,4 +22,4 @@ jobs:
2222
dd_site: datadoghq.com
2323
dd_env: ci
2424
cpu_count: 2
25-
25+

0 commit comments

Comments
 (0)