From 70eb7cd3ee1437550ef41675d30936134a1aa6c6 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Tue, 18 Mar 2025 16:58:33 +0900
Subject: [PATCH] ci: Pinning third party GitHub Actions sha
---
.github/dependabot.yaml | 5 +++++
.github/workflows/build-debug.yml | 6 +++---
.github/workflows/build-docs.yml | 10 +++++-----
.github/workflows/build-release.yml | 6 +++---
.github/workflows/toc.yml | 4 ++--
5 files changed, 18 insertions(+), 13 deletions(-)
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 00aea0a..63b36f3 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -5,3 +5,8 @@ updates:
directory: "/"
schedule:
interval: "weekly" # Check for updates to GitHub Actions every week
+ ignore:
+ # I just want update action when major/minor version is updated. patch updates are too noisy.
+ - dependency-name: '*'
+ update-types:
+ - version-update:semver-patch
diff --git a/.github/workflows/build-debug.yml b/.github/workflows/build-debug.yml
index 91ef4e6..4438794 100644
--- a/.github/workflows/build-debug.yml
+++ b/.github/workflows/build-debug.yml
@@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: Cysharp/Actions/.github/actions/setup-dotnet@main
- run: dotnet build -c Debug
- run: dotnet test -c Debug
@@ -30,7 +30,7 @@ jobs:
steps:
- name: Load secrets
id: op-load-secret
- uses: 1password/load-secrets-action@v2
+ uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
with:
export-env: false
env:
@@ -39,7 +39,7 @@ jobs:
UNITY_PASSWORD: "op://${{ vars.OP_VAULT_ACTIONS_PUBLIC }}/UNITY_LICENSE/credential"
UNITY_SERIAL: "op://${{ vars.OP_VAULT_ACTIONS_PUBLIC }}/UNITY_LICENSE/serial"
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
# Execute scripts: Export Package
# /opt/Unity/Editor/Unity -quit -batchmode -nographics -silent-crashes -logFile -projectPath . -executeMethod PackageExporter.Export
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 09ad0e3..e772684 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -11,21 +11,21 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v4
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: Cysharp/DocfxTemplate
path: docs/_DocfxTemplate
- - uses: Kirbyrawr/docfx-action@master
+ - uses: Kirbyrawr/docfx-action@db9a22c8fe1e8693a2a21be54cb0b87dfaa72cc4
name: Docfx metadata
with:
args: metadata docs/docfx.json
- - uses: Kirbyrawr/docfx-action@master
+ - uses: Kirbyrawr/docfx-action@db9a22c8fe1e8693a2a21be54cb0b87dfaa72cc4
name: Docfx build
with:
args: build docs/docfx.json
- name: Publish to GitHub Pages
- uses: peaceiris/actions-gh-pages@v4
+ uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: docs/_site
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 2375f2e..3bd0713 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -26,7 +26,7 @@ jobs:
timeout-minutes: 10
steps:
- run: echo ${{ needs.update-packagejson.outputs.sha }}
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.update-packagejson.outputs.sha }}
- uses: Cysharp/Actions/.github/actions/setup-dotnet@main
@@ -51,7 +51,7 @@ jobs:
steps:
- name: Load secrets
id: op-load-secret
- uses: 1password/load-secrets-action@v2
+ uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
with:
export-env: false
env:
@@ -61,7 +61,7 @@ jobs:
UNITY_SERIAL: "op://${{ vars.OP_VAULT_ACTIONS_PUBLIC }}/UNITY_LICENSE/serial"
- run: echo ${{ needs.update-packagejson.outputs.sha }}
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.update-packagejson.outputs.sha }}
# Execute scripts: Export Package
diff --git a/.github/workflows/toc.yml b/.github/workflows/toc.yml
index 0f2c675..99d0bf5 100644
--- a/.github/workflows/toc.yml
+++ b/.github/workflows/toc.yml
@@ -10,6 +10,6 @@ jobs:
name: TOC Generator
runs-on: ubuntu-latest
steps:
- - uses: technote-space/toc-generator@v4.3.1
+ - uses: technote-space/toc-generator@9e238e7974de5fcf7b17b7acc54c896160dda0a3 # v4.3.1
with:
- TOC_TITLE: "## Table of Contents"
\ No newline at end of file
+ TOC_TITLE: "## Table of Contents"