From bcfa169169d60daecadad275c8ae22047f6779b9 Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Thu, 3 Sep 2026 18:39:57 -0400 Subject: [PATCH] DEVOPS-1133: Pin GitHub Actions to commit hashes Pin all GitHub Actions and reusable workflow references to immutable commit hashes, and add the dependabot auto-merge and WIP status workflows. --- .github/workflows/dependabot-auto-merge.yml | 17 +++++++++++++++++ .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/pull_request.yml | 12 ++++++------ .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- .github/workflows/security_scan.yml | 4 ++-- .github/workflows/wip-status.yml | 12 ++++++++++++ .github/workflows/zizmor-security-upstream.yml | 4 ++-- 9 files changed, 45 insertions(+), 16 deletions(-) create mode 100644 .github/workflows/dependabot-auto-merge.yml create mode 100644 .github/workflows/wip-status.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000000..25a67610ea --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,17 @@ +name: Dependabot auto-merge + +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + call-workflow-dependabot-auto-merge: + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 + permissions: + contents: write + pull-requests: write + statuses: write + checks: read + with: + dependabot-groups: mirageo-ci-tools,pre-commit-hooks + checks-to-skip: 'CodeQL' diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index ae3a4247dd..97e6036337 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -9,7 +9,7 @@ permissions: {} jobs: call-workflow-create-jira-issue: if: startsWith(github.repository, 'MiraGeoscience/') # run on the Mira repo only - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: read issues: write diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index ed9916b8ec..e3eb46152c 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -7,7 +7,7 @@ on: jobs: call-workflow-pr_jira_actions: if: github.event.action != 'edited' || github.event.changes.title != null - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: read pull-requests: write diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 307ebdc7d8..8210eb1093 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -46,12 +46,12 @@ jobs: steps: - name: Checkout target repository source - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: Setup Python env - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.11' @@ -61,7 +61,7 @@ jobs: # Checkout PR branch. # TREAT THIS CODE AS MALICIOUS, DON'T RUN CODE FROM THIS BRANCH. - name: checkout pull request source - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.event.pull_request.head.sha }} path: pr_source @@ -83,12 +83,12 @@ jobs: steps: - name: Checkout target repository source - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: Setup Python env - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.11' @@ -98,7 +98,7 @@ jobs: # Checkout PR branch. # TREAT THIS CODE AS MALICIOUS, DON'T RUN CODE FROM THIS BRANCH. - name: checkout pull request source - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.event.pull_request.head.sha }} path: 'pr_source' diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index c8998ceeb3..88b570d826 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -14,7 +14,7 @@ concurrency: jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: write with: @@ -29,7 +29,7 @@ jobs: JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory, TestPyPI) - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: write with: diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 20df57d585..e278468c52 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -41,7 +41,7 @@ jobs: name: Publish production Conda package on JFrog Artifactory needs: validate-release-tag if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: write with: @@ -54,7 +54,7 @@ jobs: name: Publish production PyPI package (JFrog Artifactory, PyPI) needs: validate-release-tag if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 permissions: contents: write with: diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index f66335baeb..69791c4179 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -32,7 +32,7 @@ jobs: security-events: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 call-workflow-zizmor-advanced-security: name: Zizmor analysis (annotate) @@ -42,4 +42,4 @@ jobs: checks: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 diff --git a/.github/workflows/wip-status.yml b/.github/workflows/wip-status.yml new file mode 100644 index 0000000000..7b10fb5e37 --- /dev/null +++ b/.github/workflows/wip-status.yml @@ -0,0 +1,12 @@ +name: WIP status + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review, edited] + +jobs: + call-workflow-wip-status: + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-wip-status.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0 + permissions: + contents: read + statuses: write diff --git a/.github/workflows/zizmor-security-upstream.yml b/.github/workflows/zizmor-security-upstream.yml index 636bb8b286..df455e9a53 100644 --- a/.github/workflows/zizmor-security-upstream.yml +++ b/.github/workflows/zizmor-security-upstream.yml @@ -18,12 +18,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.12"