From fea2e9a7d6eb1dfed55d7b5c1c0e7b1627e22bf3 Mon Sep 17 00:00:00 2001 From: "@zimeg" Date: Mon, 19 May 2025 18:21:13 -0700 Subject: [PATCH] ci: pin actions workflow step hashes and use minimum permissions --- .github/workflows/codecov.yml | 13 +++++++++---- .github/workflows/docs-deploy.yml | 15 +++++++++------ .github/workflows/flake8.yml | 11 ++++++++--- .github/workflows/mypy.yml | 11 ++++++++--- .github/workflows/tests.yml | 13 +++++++++---- .github/workflows/triage-issues.yml | 15 +++++++-------- 6 files changed, 50 insertions(+), 28 deletions(-) diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml index 79fd440b2..391c135c6 100644 --- a/.github/workflows/codecov.yml +++ b/.github/workflows/codecov.yml @@ -2,7 +2,8 @@ name: Run codecov on: push: - branches: [main] + branches: + - main pull_request: jobs: @@ -12,12 +13,16 @@ jobs: strategy: matrix: python-version: ["3.13"] + permissions: + contents: read env: BOLT_PYTHON_CODECOV_RUNNING: "1" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} - name: Install dependencies @@ -31,7 +36,7 @@ jobs: run: | pytest --cov=./slack_bolt/ --cov-report=xml - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3 with: fail_ci_if_error: true verbose: true diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml index 54523819e..ed18c4b1d 100644 --- a/.github/workflows/docs-deploy.yml +++ b/.github/workflows/docs-deploy.yml @@ -5,23 +5,26 @@ on: branches: - main paths: - - 'docs/**' + - "docs/**" push: branches: - main paths: - - 'docs/**' + - "docs/**" workflow_dispatch: jobs: build: name: Build Docusaurus runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 - - uses: actions/setup-node@v4 + persist-credentials: false + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 cache: npm @@ -36,7 +39,7 @@ jobs: working-directory: ./docs - name: Upload Build Artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: ./docs/build @@ -59,4 +62,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 \ No newline at end of file + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/flake8.yml b/.github/workflows/flake8.yml index c64484b1b..87f3496e1 100644 --- a/.github/workflows/flake8.yml +++ b/.github/workflows/flake8.yml @@ -2,7 +2,8 @@ name: Run flake8 validation on: push: - branches: [main] + branches: + - main pull_request: jobs: @@ -12,10 +13,14 @@ jobs: strategy: matrix: python-version: ["3.13"] + permissions: + contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} - name: Run flake8 verification diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml index a592bd8cd..f333756b5 100644 --- a/.github/workflows/mypy.yml +++ b/.github/workflows/mypy.yml @@ -2,7 +2,8 @@ name: Run mypy validation on: push: - branches: [main] + branches: + - main pull_request: jobs: @@ -12,10 +13,14 @@ jobs: strategy: matrix: python-version: ["3.13"] + permissions: + contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} - name: Run mypy verification diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index bb35112c3..86fa4621c 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -2,7 +2,8 @@ name: Run all the unit tests on: push: - branches: [main] + branches: + - main pull_request: jobs: @@ -20,10 +21,14 @@ jobs: - "3.11" - "3.12" - "3.13" + permissions: + contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} - name: Install synchronous dependencies @@ -68,7 +73,7 @@ jobs: pytest tests/scenario_tests_async/ --junitxml=reports/test_scenario_async.xml - name: Upload test results to Codecov if: ${{ !cancelled() }} - uses: codecov/test-results-action@v1 + uses: codecov/test-results-action@f2dba722c67b86c6caa034178c6e4d35335f6706 # v1.1.0 with: directory: ./reports/ flags: ${{ matrix.python-version }} diff --git a/.github/workflows/triage-issues.yml b/.github/workflows/triage-issues.yml index d1275a94d..b37c13422 100644 --- a/.github/workflows/triage-issues.yml +++ b/.github/workflows/triage-issues.yml @@ -4,20 +4,19 @@ name: Close stale issues and PRs -on: +on: workflow_dispatch: schedule: - - cron: '0 0 * * 1' - -permissions: - issues: write - pull-requests: write + - cron: "0 0 * * 1" jobs: stale: runs-on: ubuntu-latest + permissions: + issues: write + pull-requests: write steps: - - uses: actions/stale@v9.1.0 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: days-before-issue-stale: 30 days-before-issue-close: 10 @@ -30,4 +29,4 @@ jobs: exempt-all-milestones: true remove-stale-when-updated: true enable-statistics: true - operations-per-run: 60 \ No newline at end of file + operations-per-run: 60