Pin github actions to specific SHA-s

.github/workflows/build-and-test.yaml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6
         with:
           go-version-file: go.mod
           cache: true
@@ -28,7 +28,7 @@ jobs:
 
       # Cache bin folder with tools and binaries
       - name: Cache bin folder
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 #v4
         with:
           path: bin
           key: ${{ runner.os }}-bin-${{ hashFiles('go.mod', 'go.sum', 'Makefile') }}
@@ -46,7 +46,7 @@ jobs:
 
       - name: Install setup-envtest
         run: |
-          go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+          go install sigs.k8s.io/controller-runtime/tools/setup-envtest@3be3f1bf2b2fcc6b5c9510d55c6a9972294653d0 #v0.24.1
 
       - name: Setup envtest binaries
         id: envtest
@@ -65,10 +65,10 @@ jobs:
     # Run in parallel with build job
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6
         with:
           go-version-file: go.mod
           cache: true
@@ -79,5 +79,5 @@ jobs:
 
       - name: Run security scan
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@15aacc21377149f263d1e9587435f22d6af66db1 #v1.4.0
           govulncheck ./...

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
           # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e #v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -96,6 +96,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e #v4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/release.yaml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6
         with:
           go-version-file: go.mod
           cache: true
@@ -40,14 +40,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 #v6
         with:
           images: ghcr.io/norskhelsenett/gatewayapi-operator
           tags: |
@@ -57,7 +57,7 @@ jobs:
             type=sha
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -75,7 +75,7 @@ jobs:
           fi
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf #v7
         with:
           context: .
           push: true
@@ -90,19 +90,22 @@ jobs:
     needs:
       - create-oci-image
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       - name: Install helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 #v5
         with:
           version: v3.16.4
 
       - name: install-yq
         run: |
-          wget https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz -O - | tar xz && mv ${BINARY} yq && chmod +x yq
+          wget https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz -O ${BINARY}.tar.gz
+          echo "${SHA256}  ${BINARY}.tar.gz" | sha256sum -c -
+          tar xzf ${BINARY}.tar.gz && mv ${BINARY} yq && chmod +x yq
         env:
           VERSION: v4.44.5
           BINARY: yq_linux_amd64
+          SHA256: cc9ee4d476717d2b90e4f20cf2bf31f9d6bfba830227960f6e0401db74270311
 
       - name: Build helm chart
         run: |

.github/workflows/test-chart.yml

@@ -13,18 +13,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone the code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6
         with:
           go-version-file: go.mod
 
       - name: Install the latest version of kind
         run: |
-          curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)
+          ARCH=$(go env GOARCH)
+          curl -Lo ./kind https://kind.sigs.k8s.io/dl/${VERSION}/kind-linux-${ARCH}
+          case "$ARCH" in
+            amd64)
+              echo "${SHA256_AMD64}  ./kind" | sha256sum -c -
+              ;;
+            arm64)
+              echo "${SHA256_ARM64}  ./kind" | sha256sum -c -
+              ;;
+            *)
+              echo "Unsupported architecture: $ARCH" >&2
+              exit 1
+              ;;
+          esac
           chmod +x ./kind
           sudo mv ./kind /usr/local/bin/kind
+        env:
+          VERSION: v0.32.0
+          SHA256_AMD64: 50030de23cf40a18505f20426f6a8506bedf13c6e509244bd1fa9463721b0f54
+          SHA256_ARM64: b92cd615e97585de8ddade28ed5cd7feb4248d717c233eea5b03c37298900f5d
 
       - name: Verify kind installation
         run: kind version
@@ -39,8 +56,9 @@ jobs:
           kind load docker-image gatewayapi-operator:v0.1.0
 
       - name: Install Helm
-        run: |
-          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 #v5
+        with:
+          version: v3.16.4
 
       - name: Verify Helm installation
         run: helm version

.github/workflows/vulnerability-scan.yml

@@ -15,12 +15,12 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: "Checkout repository"
-              uses: actions/checkout@v6
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6
             - name: "Set up Go"
-              uses: actions/setup-go@v6
+              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6
               with:
                   go-version-file: go.mod
             - name: "Install govulncheck"
-              run: go install golang.org/x/vuln/cmd/govulncheck@latest
+              run: go install golang.org/x/vuln/cmd/govulncheck@15aacc21377149f263d1e9587435f22d6af66db1 #v1.4.0
             - name: "Run govulncheck"
               run: govulncheck -show verbose ./...