Commit b98c73f

authored

fix: security updates on commitlint action and workflows (#48)

- Updated immutable tag for commitlint actions - Updated immutable hash for action workflows

1 parent 50cc744 commit b98c73fCopy full SHA for b98c73f

File tree

+11

-14

lines changed

+11

-14

lines changed

Lines changed: 6 additions & 10 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,23 +1,19 @@`
`1`	`1`	`on:`
`2`	`2`	`push:`
`3`		`- branches:`
`4`		`- - main`
`5`		`- workflow_dispatch:`
`6`		`-`
`7`		`-permissions:`
`8`		`- id-token: write # for PYPI release`
	`3`	`+ branches: ['main']`
`9`	`4`
`10`	`5`	`name: release-please`
`11`	`6`
`12`	`7`	`jobs:`
`13`	`8`	`release-please:`
`14`	`9`	`runs-on: ubuntu-latest`
	`10`	`+ permissions:`
	`11`	`+ id-token: write # for PYPI release`
	`12`	`+`
`15`	`13`	`steps:`
`16`	`14`	`- name: Release`
`17`	`15`	`id: release`
`18`		`- uses: google-github-actions/release-please-action@v4`
`19`		`- with:`
`20`		`- token: ${{ secrets.BOT_TOKEN }}`
	`16`	`+ uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1`
`21`	`17`
`22`	`18`	`- uses: actions/checkout@v3`
`23`	`19`	`if: ${{ steps.release.outputs.release_created }}`
`@@ -40,4 +36,4 @@ jobs:`
`40`	`36`
`41`	`37`	`- name: Publish package`
`42`	`38`	`if: ${{ steps.release.outputs.release_created }}`
`43`		`- uses: pypa/gh-action-pypi-publish@v1.8.14`
	`39`	`+ uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 #v1.9.0`

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -23,12 +23,12 @@ runs:`
`23`	`23`	`using: 'composite'`
`24`	`24`	`steps:`
`25`	`25`	`- name: Install Python`
`26`		`- uses: actions/setup-python@v5`
	`26`	`+ uses: actions/setup-python@v5.1.0`
`27`	`27`	`with:`
`28`	`28`	`python-version: '3.8'`
`29`	`29`
`30`	`30`	`- name: Install Commitlint`
`31`		`- run: python -m pip install -e ${{ github.action_path }}`
	`31`	`+ run: python -m pip install --disable-pip-version-check -e ${{ github.action_path }}`
`32`	`32`	`shell: bash`
`33`	`33`
`34`	`34`	`# checkout to the source code`
`@@ -40,17 +40,18 @@ runs:`
`40`	`40`	`echo "count=$(echo '${{ toJson(github.event.commits) }}' \| jq '. \| length')" \`
`41`	`41`	`>> $GITHUB_OUTPUT`
`42`	`42`	`shell: bash`
	`43`	`+`
`43`	`44`	`- name: Checkout to pushed commits`
`44`	`45`	`if: github.event_name == 'push'`
`45`		`- uses: actions/checkout@v4`
	`46`	`+ uses: actions/checkout@v4.1.7`
`46`	`47`	`with:`
`47`	`48`	`ref: ${{ github.sha }}`
`48`	`49`	`fetch-depth: ${{ steps.push_commit_count.outputs.count }}`
`49`	`50`
`50`	`51`	`# for pull_request event`
`51`	`52`	`- name: Checkout to PR source branch`
`52`	`53`	`if: github.event_name == 'pull_request'`
`53`		`- uses: actions/checkout@v4`
	`54`	`+ uses: actions/checkout@v4.1.7`
`54`	`55`	`with:`
`55`	`56`	`ref: ${{ github.event.pull_request.head.sha }}`
`56`	`57`	`fetch-depth: ${{ github.event.pull_request.commits }}`

Comments

(0)