From 35d2bd50c4f98ca0b9e55edb2cb00031d491cca7 Mon Sep 17 00:00:00 2001 From: Frenchie Date: Fri, 12 Sep 2025 15:42:41 +1000 Subject: [PATCH] Chore: Dependency pinning & Depdendabot introduction (#436) 1. Pins the Github Action workflow hashes under `.github/workflows` to full-length commit SHAs. 2. Adds a base level `.github/dependabot.yml` config to keep these (and other go/Docker) deps up to date. ## Motivation and Context - Github's [security guide](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions) recommends using the immutable SHA of an action when consuming third party actions. - Depdendabot makes ongoing dep house keeping manageable. --- .github/dependabot.yml | 18 ++++++++++++++++++ .github/workflows/ci.yml | 14 +++++++------- .github/workflows/claude.yml | 2 +- .github/workflows/deploy.yml | 30 +++++++++++++++--------------- .github/workflows/release.yml | 18 +++++++++--------- 5 files changed, 50 insertions(+), 32 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..02a3cd3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 +updates: + - package-ecosystem: gomod + directory: / + schedule: + interval: daily + - package-ecosystem: github-actions + directory: / + groups: + actions: + patterns: + - "*" + schedule: + interval: daily + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "daily" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1857861..e2edd2a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,15 +16,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5 with: go-version: ${{ env.GO_VERSION }} - name: Cache Go modules - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 #v4 with: path: | ~/.cache/go-build @@ -60,15 +60,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5 with: go-version: ${{ env.GO_VERSION }} - name: Cache Go modules - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 #v4 with: path: | ~/.cache/go-build @@ -84,7 +84,7 @@ jobs: run: make test-all - name: Upload coverage artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4 with: name: coverage-report path: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index b09fc3e..a726d60 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,7 +26,7 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 with: fetch-depth: 1 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 2f8a0da..f8eb46c 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -18,13 +18,13 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3 - name: Log in to Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3 with: registry: ghcr.io username: ${{ github.actor }} @@ -32,7 +32,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f #v5 with: images: ghcr.io/${{ github.repository }} tags: | @@ -40,7 +40,7 @@ jobs: type=raw,value=main,enable={{is_default_branch}} - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 #v5 with: context: . file: ./Dockerfile @@ -61,25 +61,25 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5 with: go-version: ${{ env.GO_VERSION }} - name: Setup Pulumi - uses: pulumi/actions@v6 + uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e #v6 with: pulumi-version: ${{ env.PULUMI_VERSION }} - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed #v2 with: credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }} - name: Setup Google Cloud SDK - uses: google-github-actions/setup-gcloud@v2 + uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f #v2 with: project_id: mcp-registry-staging install_components: gke-gcloud-auth-plugin @@ -100,25 +100,25 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5 with: go-version: ${{ env.GO_VERSION }} - name: Setup Pulumi - uses: pulumi/actions@v6 + uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e #v6 with: pulumi-version: ${{ env.PULUMI_VERSION }} - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed #v2 with: credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }} - name: Setup Google Cloud SDK - uses: google-github-actions/setup-gcloud@v2 + uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f #v2 with: project_id: mcp-registry-prod install_components: gke-gcloud-auth-plugin diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5c3904b..6be85ac 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,23 +14,23 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5 with: go-version: '1.24.x' - name: Install cosign - uses: sigstore/cosign-installer@v3 + uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 #v3 - name: Install Syft uses: anchore/sbom-action/download-syft@v0.20.5 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a #v6 with: distribution: goreleaser version: v2.12.0 @@ -43,13 +43,13 @@ jobs: needs: goreleaser steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3 - name: Log in to Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3 with: registry: ghcr.io username: ${{ github.actor }} @@ -57,7 +57,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f #v5 with: images: ghcr.io/${{ github.repository }} tags: | @@ -65,7 +65,7 @@ jobs: type=raw,value=latest - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 #v5 with: context: . file: ./Dockerfile