Merge pull request #33 from Hasnep/add-ratchet

Add ratchet
Hasnep · Feb 5, 2025 · 383ce9b · 383ce9b
2 parents 04a8e51 + c89ca5c
commit 383ce9b
Show file tree

Hide file tree

Showing 8 changed files with 23 additions and 16 deletions.
diff --git a/.github/workflows/bundle.yaml b/.github/workflows/bundle.yaml
@@ -14,13 +14,13 @@ jobs:
       contents: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Roc
-        uses: hasnep/setup-roc@main
+        uses: hasnep/setup-roc@9866c6fdc971ee9f4b3eeba03d825dc32a5efa7f # ratchet:hasnep/setup-roc@v0.5.0
         with:
           roc-version: 0.0.0-alpha2-rolling
       - name: Bundle and release the library
-        uses: hasnep/bundle-roc-library@v0.1.0
+        uses: hasnep/bundle-roc-library@4364d15b4ae83c99e0bc0caab8a254a5d0a9369f # ratchet:hasnep/bundle-roc-library@v0.1.0
         with:
           library: src/main.roc
           token: ${{ github.token }}
diff --git a/.github/workflows/check-pr-labels.yaml b/.github/workflows/check-pr-labels.yaml
@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for PR category labels
-        uses: yogevbd/enforce-label-action@2.2.2
+        uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024 # ratchet:yogevbd/enforce-label-action@2.2.2
         with:
           REQUIRED_LABELS_ANY: feature,fix,chore
           REQUIRED_LABELS_ANY_DESCRIPTION: Please tag your PR with one of `feature`, `fix`, or `chore`.
       - name: Check for PR version labels
-        uses: yogevbd/enforce-label-action@2.2.2
+        uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024 # ratchet:yogevbd/enforce-label-action@2.2.2
         with:
           REQUIRED_LABELS_ANY: major,minor,patch
           REQUIRED_LABELS_ANY_DESCRIPTION: Please tag your PR with one of `major`, `minor`, `patch`.
diff --git a/.github/workflows/generate-docs.yaml b/.github/workflows/generate-docs.yaml
@@ -15,9 +15,9 @@ jobs:
       id-token: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Roc
-        uses: hasnep/setup-roc@main
+        uses: hasnep/setup-roc@9866c6fdc971ee9f4b3eeba03d825dc32a5efa7f # ratchet:hasnep/setup-roc@v0.5.0
         with:
           roc-version: 0.0.0-alpha2-rolling
       - name: Generate docs
@@ -26,8 +26,8 @@ jobs:
         run: |
           find generated-docs/ -type f -name '*.html' -exec sed -i "s/\(href\|src\)=\"\//\1=\"\/${{ github.event.repository.name }}\//g" {} +
       - name: Upload docs artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # ratchet:actions/upload-pages-artifact@v3
         with:
           path: generated-docs
       - name: Deploy docs
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # ratchet:actions/deploy-pages@v4
diff --git a/.github/workflows/run-pre-commit.yaml b/.github/workflows/run-pre-commit.yaml
@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4.2.2
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v16
+        uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # ratchet:DeterminateSystems/nix-installer-action@v16
       - name: Cache Nix environment
-        uses: DeterminateSystems/magic-nix-cache-action@v8
+        uses: DeterminateSystems/magic-nix-cache-action@6221693898146dc97e38ad0e013488a16477a4c4 # ratchet:DeterminateSystems/magic-nix-cache-action@v9
       - name: Use Nix dev shell for subsequent steps
-        uses: rrbutani/use-nix-shell-action@v1
+        uses: rrbutani/use-nix-shell-action@59a52b2b9bbfe3cc0e7deb8f9059abe37a439edf # ratchet:rrbutani/use-nix-shell-action@v1
         with:
           extraNixOptions: --accept-flake-config
       - name: Run Pre-commit

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: Install Roc
-        uses: hasnep/setup-roc@main
+        uses: hasnep/setup-roc@9866c6fdc971ee9f4b3eeba03d825dc32a5efa7f # ratchet:hasnep/setup-roc@v0.5.0
         with:
           roc-version: 0.0.0-alpha2-rolling
       - name: Test the library

diff --git a/.github/workflows/update-draft-release.yaml b/.github/workflows/update-draft-release.yaml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Update the draft release
         id: update-draft-release
-        uses: release-drafter/release-drafter@v6
+        uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # ratchet:release-drafter/release-drafter@v6
         with:
           config-name: release-drafter.yaml
           disable-autolabeler: true

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -77,6 +77,12 @@ repos:
         entry: actionlint
         types: [yaml]
         files: \.github/workflows/.*\.ya?ml$
+      - name: Check GitHub Actions are pinned
+        id: github-workflows-check-pinned
+        language: system
+        entry: ratchet check
+        types: [yaml]
+        files: \.github/workflows/.*\.ya?ml$
 
   # Nix
   - repo: local

diff --git a/flake.nix b/flake.nix
@@ -29,6 +29,7 @@
             pkgs.nodePackages.prettier
             pkgs.pre-commit
             pkgs.python312Packages.pre-commit-hooks
+            pkgs.ratchet
           ];
           enterShell = "pre-commit install --overwrite";
         };