From 536664efcf3b42e2af54a96e5ff167e69af9427c Mon Sep 17 00:00:00 2001 From: David Wilding Date: Thu, 16 Jul 2026 14:45:31 +0800 Subject: [PATCH 1/3] update rockcraft-pack hash to v0 and fix upload-sarif version comment --- .github/workflows/integration-test.yaml | 2 +- .github/workflows/zizmor.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration-test.yaml b/.github/workflows/integration-test.yaml index 53feb80..e737268 100644 --- a/.github/workflows/integration-test.yaml +++ b/.github/workflows/integration-test.yaml @@ -17,7 +17,7 @@ jobs: persist-credentials: false - name: Pack the rock - uses: canonical/craft-actions/rockcraft-pack@210d55fa6cb7a1ab39e3194315d6a03249af3d34 + uses: canonical/craft-actions/rockcraft-pack@acd2f2e61c7563b38ba89390ca0e910fa7d2784f # v0 - name: Run the integration test run: make integration diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index eec8276..9ff4ffc 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -28,7 +28,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: results.sarif category: zizmor From 7262625451362174e890bc528c029adf43beebe2 Mon Sep 17 00:00:00 2001 From: David Wilding Date: Thu, 16 Jul 2026 15:43:29 +0800 Subject: [PATCH 2/3] ci: pin all actions at major version in comments --- .github/workflows/lint.yaml | 2 +- .github/workflows/publish.yaml | 10 +++++----- .github/workflows/security.yaml | 2 +- .github/workflows/version-check.yaml | 2 +- .github/workflows/zizmor.yaml | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 092583e..0ae8d1b 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -16,6 +16,6 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 - name: Lint the code run: make lint diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 40edf79..331a31b 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -72,13 +72,13 @@ jobs: artifact-metadata: write steps: - name: Download rock artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ matrix.artifact-name }} path: ./rock - name: Generate SBOM (Syft) - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 with: image: oci-archive:./rock/${{ matrix.artifact-name }} format: spdx-json @@ -87,18 +87,18 @@ jobs: upload-release-assets: false - name: Attest build provenance - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 with: subject-path: ./rock/${{ matrix.artifact-name }} - name: Attest SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 with: subject-path: ./rock/${{ matrix.artifact-name }} sbom-path: ./sbom.spdx.json - name: Scan rock (Grype) - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7 with: sbom: ./sbom.spdx.json fail-build: true diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 8901373..3189d91 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -18,7 +18,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 - name: Export locked dependencies (excluding this project) run: uv export --frozen --no-emit-project --no-hashes --format requirements-txt -o requirements.txt - name: Run pip-audit diff --git a/.github/workflows/version-check.yaml b/.github/workflows/version-check.yaml index d28c3b5..9132a4c 100644 --- a/.github/workflows/version-check.yaml +++ b/.github/workflows/version-check.yaml @@ -16,7 +16,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 - name: Check that all versions match run: | set -euo pipefail diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index 9ff4ffc..e639484 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -20,7 +20,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 - name: Run zizmor run: uvx zizmor@v1.23.1 --format=sarif . > results.sarif @@ -28,7 +28,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 with: sarif_file: results.sarif category: zizmor From ad67c8ab6d5450cc3c9ab90a327a5b6eca733112 Mon Sep 17 00:00:00 2001 From: David Wilding Date: Thu, 16 Jul 2026 15:49:29 +0800 Subject: [PATCH 3/3] ci: use full version numbers in action comments --- .github/workflows/dependency-review.yaml | 4 ++-- .github/workflows/integration-test.yaml | 4 ++-- .github/workflows/lint.yaml | 4 ++-- .github/workflows/publish.yaml | 16 ++++++++-------- .github/workflows/security.yaml | 4 ++-- .github/workflows/validate-pr-title.yaml | 2 +- .github/workflows/version-check.yaml | 4 ++-- .github/workflows/zizmor.yaml | 6 +++--- 8 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index 707ee62..c448192 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -14,10 +14,10 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Dependency review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: fail-on-severity: high diff --git a/.github/workflows/integration-test.yaml b/.github/workflows/integration-test.yaml index e737268..2ddc943 100644 --- a/.github/workflows/integration-test.yaml +++ b/.github/workflows/integration-test.yaml @@ -12,12 +12,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Pack the rock - uses: canonical/craft-actions/rockcraft-pack@acd2f2e61c7563b38ba89390ca0e910fa7d2784f # v0 + uses: canonical/craft-actions/rockcraft-pack@acd2f2e61c7563b38ba89390ca0e910fa7d2784f # v0.1.1 - name: Run the integration test run: make integration diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 0ae8d1b..8ca2945 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -12,10 +12,10 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Lint the code run: make lint diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 331a31b..5151234 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -37,7 +37,7 @@ jobs: needs: [prepare] strategy: matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }} - uses: canonical/oci-factory/.github/workflows/Build-Rock.yaml@de55cd493720fc91cf5b629a34a10b3be7b0434a # memcached_1.6-26.04_edge + uses: canonical/oci-factory/.github/workflows/Build-Rock.yaml@de55cd493720fc91cf5b629a34a10b3be7b0434a # memcached_1.6-26.04_35 with: rock-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }} rock-repo-commit: ${{ github.head_ref || github.ref_name }} @@ -55,7 +55,7 @@ jobs: strategy: fail-fast: false matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }} - uses: canonical/oci-factory/.github/workflows/Test-Rock.yaml@de55cd493720fc91cf5b629a34a10b3be7b0434a # memcached_1.6-26.04_edge + uses: canonical/oci-factory/.github/workflows/Test-Rock.yaml@de55cd493720fc91cf5b629a34a10b3be7b0434a # memcached_1.6-26.04_35 with: oci-archive-name: ${{ matrix.artifact-name }} @@ -72,13 +72,13 @@ jobs: artifact-metadata: write steps: - name: Download rock artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ matrix.artifact-name }} path: ./rock - name: Generate SBOM (Syft) - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 with: image: oci-archive:./rock/${{ matrix.artifact-name }} format: spdx-json @@ -87,18 +87,18 @@ jobs: upload-release-assets: false - name: Attest build provenance - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 with: subject-path: ./rock/${{ matrix.artifact-name }} - name: Attest SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 with: subject-path: ./rock/${{ matrix.artifact-name }} sbom-path: ./sbom.spdx.json - name: Scan rock (Grype) - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 with: sbom: ./sbom.spdx.json fail-build: true @@ -114,7 +114,7 @@ jobs: packages: write steps: - name: Upload Rock to GHCR - uses: canonical/oci-factory/.github/actions/upload-rock@de55cd493720fc91cf5b629a34a10b3be7b0434a # memcached_1.6-26.04_edge + uses: canonical/oci-factory/.github/actions/upload-rock@de55cd493720fc91cf5b629a34a10b3be7b0434a # memcached_1.6-26.04_35 with: artifact_name: ${{ matrix.artifact-name }} tags: ${{ matrix.tag }} diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 3189d91..aaf5dc7 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -15,10 +15,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 + - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Export locked dependencies (excluding this project) run: uv export --frozen --no-emit-project --no-hashes --format requirements-txt -o requirements.txt - name: Run pip-audit diff --git a/.github/workflows/validate-pr-title.yaml b/.github/workflows/validate-pr-title.yaml index 119d6a2..4b03817 100644 --- a/.github/workflows/validate-pr-title.yaml +++ b/.github/workflows/validate-pr-title.yaml @@ -13,7 +13,7 @@ jobs: name: Validate PR title runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - run: python3 .github/check-conventional-pr-title.py diff --git a/.github/workflows/version-check.yaml b/.github/workflows/version-check.yaml index 9132a4c..2bce68d 100644 --- a/.github/workflows/version-check.yaml +++ b/.github/workflows/version-check.yaml @@ -12,11 +12,11 @@ jobs: version-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Check that all versions match run: | set -euo pipefail diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index e639484..0d7fc02 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -15,12 +15,12 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Run zizmor run: uvx zizmor@v1.23.1 --format=sarif . > results.sarif @@ -28,7 +28,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: results.sarif category: zizmor