Pin actions to a full length commit SHA

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
wagdav · May 19, 2024 · d895499 · d895499
1 parent d1d0b2a
commit d895499
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
@@ -1,3 +1,4 @@
+# yamllint disable rule:line-length
 ---
 name: "Build and Deploy"
 on:  # yamllint disable-line rule:truthy
@@ -15,15 +16,15 @@ jobs:
       name: Homelab
       url: "https://app.cachix.org/deploy/workspace/lab.thewagner.home/"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
         with:
           fetch-depth: 0
-      - uses: docker/setup-qemu-action@v3
-      - uses: cachix/install-nix-action@V27
+      - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3  # v3.0.0
+      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b  # v27
         with:
           nix_path: nixpkgs=channel:nixos-unstable
           extra_nix_config: "extra-platforms = aarch64-linux"
-      - uses: cachix/cachix-action@v14
+      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be  # v14
         with:
           name: wagdav
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml
@@ -1,3 +1,4 @@
+# yamllint disable rule:line-length
 ---
 name: update-flake-lock
 on:  # yamllint disable-line rule:truthy
@@ -9,9 +10,9 @@ jobs:
   lockfile:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@V27
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
+      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b  # v27
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - uses: DeterminateSystems/update-flake-lock@v21
+      - uses: DeterminateSystems/update-flake-lock@a3ccb8f59719c48d6423e97744560221bcf7a3fa  # v21