Skip to content

Commit 0608ac3

Browse files
BretFisherBretFisher
committed
pinning actions
1 parent f90de4d commit 0608ac3

13 files changed

Lines changed: 138 additions & 100 deletions

‎.github/dependabot.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,23 @@ updates:
99
# Maintain dependencies for GitHub Actions
1010
- package-ecosystem: "github-actions"
1111
directory: "/"
12+
cooldown:
13+
default-days: 7
1214
schedule:
1315
interval: "daily"
16+
17+
# Add this section for each directory with a Dockerfile, K8s manifest, or Helm chart
18+
# They must use a semver tag, and Dependabot must be able to access the registry
19+
# You can give it access to private ones:
20+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#configuration-options-for-private-registries
21+
# follow along on a feature request to support multiple directories in one package-ecosystem
22+
# https://github.com/dependabot/dependabot-core/issues/2178
23+
- package-ecosystem: "docker"
24+
directory: "/"
25+
cooldown:
26+
default-days: 7
27+
schedule:
28+
interval: "weekly"
29+
commit-message:
30+
# Prefix all commit messages with "[docker] "
31+
prefix: "[docker] "

‎.github/workflows/01-basic-docker-build.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ jobs:
1515
steps:
1616

1717
- name: Login to Docker Hub
18-
uses: docker/login-action@v4
18+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
1919
with:
2020
username: ${{ secrets.DOCKERHUB_USERNAME }}
2121
password: ${{ secrets.DOCKERHUB_TOKEN }}
2222

2323
- name: Docker build
24-
uses: docker/build-push-action@v7
24+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
2525
with:
2626
push: ${{ github.event_name != 'pull_request' }}
2727
tags: bretfisher/docker-ci-automation:latest,bretfisher/docker-ci-automation:01

‎.github/workflows/02-add-buildkit-cache.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,17 @@ jobs:
1515

1616
#NEW: (START) ##########################################################
1717
- name: Set up Docker Buildx
18-
uses: docker/setup-buildx-action@v4
18+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
1919
#NEW: (END) ############################################################
2020

2121
- name: Login to Docker Hub
22-
uses: docker/login-action@v4
22+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
2323
with:
2424
username: ${{ secrets.DOCKERHUB_USERNAME }}
2525
password: ${{ secrets.DOCKERHUB_TOKEN }}
2626

2727
- name: Docker build
28-
uses: docker/build-push-action@v7
28+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
2929
with:
3030
push: ${{ github.event_name != 'pull_request' }}
3131
tags: bretfisher/docker-ci-automation:02

‎.github/workflows/03-add-multi-platform.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,20 @@ jobs:
1515

1616
#NEW: (START) ##########################################################
1717
- name: Set up QEMU
18-
uses: docker/setup-qemu-action@v4
18+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
1919
#NEW: (END) ############################################################
2020

2121
- name: Set up Docker Buildx
22-
uses: docker/setup-buildx-action@v4
22+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
2323

2424
- name: Login to Docker Hub
25-
uses: docker/login-action@v4
25+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
2626
with:
2727
username: ${{ secrets.DOCKERHUB_USERNAME }}
2828
password: ${{ secrets.DOCKERHUB_TOKEN }}
2929

3030
- name: Docker build
31-
uses: docker/build-push-action@v7
31+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
3232
with:
3333
push: ${{ github.event_name != 'pull_request' }}
3434
tags: bretfisher/docker-ci-automation:03

‎.github/workflows/04-add-metadata.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,21 +15,21 @@ jobs:
1515

1616

1717
- name: Set up QEMU
18-
uses: docker/setup-qemu-action@v4
18+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
1919

2020
- name: Set up Docker Buildx
21-
uses: docker/setup-buildx-action@v4
21+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
2222

2323
- name: Login to Docker Hub
24-
uses: docker/login-action@v4
24+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
2525
with:
2626
username: ${{ secrets.DOCKERHUB_USERNAME }}
2727
password: ${{ secrets.DOCKERHUB_TOKEN }}
2828

2929
#NEW: (START) ##########################################################
3030
- name: Docker meta
3131
id: docker_meta
32-
uses: docker/metadata-action@v6
32+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf #v6.0.0
3333
with:
3434
images: bretfisher/docker-ci-automation
3535
flavor: |
@@ -43,7 +43,7 @@ jobs:
4343
#NEW: (END) ############################################################
4444

4545
- name: Docker build
46-
uses: docker/build-push-action@v7
46+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
4747
with:
4848
#NEW: (START) ##########################################################
4949
push: true

‎.github/workflows/05-add-comment.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,20 @@ jobs:
2020
steps:
2121

2222
- name: Set up QEMU
23-
uses: docker/setup-qemu-action@v4
23+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
2424

2525
- name: Set up Docker Buildx
26-
uses: docker/setup-buildx-action@v4
26+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
2727

2828
- name: Login to Docker Hub
29-
uses: docker/login-action@v4
29+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
3030
with:
3131
username: ${{ secrets.DOCKERHUB_USERNAME }}
3232
password: ${{ secrets.DOCKERHUB_TOKEN }}
3333

3434
- name: Docker meta
3535
id: docker_meta
36-
uses: docker/metadata-action@v6
36+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf #v6.0.0
3737
with:
3838
images: bretfisher/docker-ci-automation
3939
flavor: |
@@ -46,7 +46,7 @@ jobs:
4646
type=semver,pattern={{version}}
4747
4848
- name: Docker build
49-
uses: docker/build-push-action@v7
49+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
5050
with:
5151
push: false # false for this demo to prevent overwriting image tags of other examples
5252
tags: ${{ steps.docker_meta.outputs.tags }}
@@ -64,7 +64,7 @@ jobs:
6464
# If PR, put image tags in the PR comments
6565
# from https://github.com/marketplace/actions/create-or-update-comment
6666
- name: Find comment for image tags
67-
uses: peter-evans/find-comment@v3
67+
uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e #v3.1.0
6868
if: github.event_name == 'pull_request'
6969
id: fc
7070
with:
@@ -74,7 +74,7 @@ jobs:
7474

7575
# If PR, put image tags in the PR comments
7676
- name: Create or update comment for image tags
77-
uses: peter-evans/create-or-update-comment@v4
77+
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 #v4.0.0
7878
if: github.event_name == 'pull_request'
7979
with:
8080
comment-id: ${{ steps.fc.outputs.comment-id }}

‎.github/workflows/06-add-cve-scanning.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,19 @@ jobs:
1515
steps:
1616

1717
- name: Set up QEMU
18-
uses: docker/setup-qemu-action@v4
18+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
1919

2020
- name: Set up Docker Buildx
21-
uses: docker/setup-buildx-action@v4
21+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
2222

2323
- name: Login to Docker Hub
24-
uses: docker/login-action@v4
24+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
2525
with:
2626
username: ${{ secrets.DOCKERHUB_USERNAME }}
2727
password: ${{ secrets.DOCKERHUB_TOKEN }}
2828

2929
- name: Build and export to Docker
30-
uses: docker/build-push-action@v7
30+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
3131
with:
3232
push: false
3333
load: true # Export to Docker Engine rather than pushing to a registry
@@ -39,7 +39,7 @@ jobs:
3939

4040
#NEW: (START) ##########################################################
4141
- name: Run Trivy for all CVEs (non-blocking)
42-
uses: aquasecurity/trivy-action@master
42+
uses: aquasecurity/trivy-action@264c9c5e188ea085e7377fd77abd17bfbd4e5926 #master
4343
with:
4444
image-ref: ${{ github.run_id }}
4545
exit-code: 0
@@ -48,7 +48,7 @@ jobs:
4848

4949
- name: Docker Metadata for Final Image Build
5050
id: docker_meta
51-
uses: docker/metadata-action@v6
51+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf #v6.0.0
5252
with:
5353
images: bretfisher/docker-ci-automation
5454
flavor: |
@@ -62,7 +62,7 @@ jobs:
6262
# type=semver,pattern={{version}}
6363

6464
- name: Docker Build and Push to Docker Hub
65-
uses: docker/build-push-action@v7
65+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
6666
with:
6767
push: true
6868
tags: ${{ steps.docker_meta.outputs.tags }}

‎.github/workflows/07-add-cve-scanning-adv.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,23 +22,23 @@ jobs:
2222

2323
#NEW: (START) ##########################################################
2424
- name: Checkout git repo
25-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
2626
#NEW: (END) ############################################################
2727

2828
- name: Set up QEMU
29-
uses: docker/setup-qemu-action@v4
29+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
3030

3131
- name: Set up Docker Buildx
32-
uses: docker/setup-buildx-action@v4
32+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
3333

3434
- name: Login to Docker Hub
35-
uses: docker/login-action@v4
35+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
3636
with:
3737
username: ${{ secrets.DOCKERHUB_USERNAME }}
3838
password: ${{ secrets.DOCKERHUB_TOKEN }}
3939

4040
- name: Build and export to Docker
41-
uses: docker/build-push-action@v7
41+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
4242
with:
4343
push: false
4444
load: true # Export to Docker Engine rather than pushing to a registry
@@ -49,15 +49,15 @@ jobs:
4949
platforms: linux/amd64
5050

5151
- name: Run Trivy for all CVEs (non-blocking)
52-
uses: aquasecurity/trivy-action@master
52+
uses: aquasecurity/trivy-action@264c9c5e188ea085e7377fd77abd17bfbd4e5926 #master
5353
with:
5454
image-ref: ${{ github.run_id }}
5555
format: table
5656
exit-code: 0
5757

5858
#NEW: (START) ##########################################################
5959
- name: Run Trivy for HIGH,CRITICAL CVEs and report (blocking)
60-
uses: aquasecurity/trivy-action@master
60+
uses: aquasecurity/trivy-action@264c9c5e188ea085e7377fd77abd17bfbd4e5926 #master
6161
with:
6262
image-ref: ${{ github.run_id }}
6363
exit-code: 1
@@ -68,15 +68,15 @@ jobs:
6868
output: 'trivy-results.sarif'
6969

7070
- name: Upload Trivy scan results to GitHub Security tab
71-
uses: github/codeql-action/upload-sarif@v3
71+
uses: github/codeql-action/upload-sarif@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 #v3.35.1
7272
if: always()
7373
with:
7474
sarif_file: 'trivy-results.sarif'
7575
#NEW: (END) ############################################################
7676

7777
- name: Docker Metadata for Final Image Build
7878
id: docker_meta
79-
uses: docker/metadata-action@v6
79+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf #v6.0.0
8080
with:
8181
images: bretfisher/docker-ci-automation
8282
flavor: |
@@ -90,7 +90,7 @@ jobs:
9090
# type=semver,pattern={{version}}
9191

9292
- name: Docker Build and Push to Docker Hub
93-
uses: docker/build-push-action@v7
93+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
9494
with:
9595
push: true
9696
tags: ${{ steps.docker_meta.outputs.tags }}

‎.github/workflows/08-add-unit-test.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,20 @@ jobs:
1515

1616

1717
- name: Set up QEMU
18-
uses: docker/setup-qemu-action@v4
18+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
1919

2020
- name: Set up Docker Buildx
21-
uses: docker/setup-buildx-action@v4
21+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
2222

2323
- name: Login to Docker Hub
24-
uses: docker/login-action@v4
24+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
2525
with:
2626
username: ${{ secrets.DOCKERHUB_USERNAME }}
2727
password: ${{ secrets.DOCKERHUB_TOKEN }}
2828

2929
#NEW: (START) ##########################################################
3030
- name: Build and export to Docker
31-
uses: docker/build-push-action@v7
31+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
3232
with:
3333
push: false
3434
load: true # Export to Docker Engine rather than pushing to a registry
@@ -46,7 +46,7 @@ jobs:
4646

4747
- name: Docker Metadata for Final Image Build
4848
id: docker_meta
49-
uses: docker/metadata-action@v6
49+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf #v6.0.0
5050
with:
5151
images: bretfisher/docker-ci-automation
5252
flavor: |
@@ -60,7 +60,7 @@ jobs:
6060
# type=semver,pattern={{version}}
6161

6262
- name: Docker Build and Push to Docker Hub
63-
uses: docker/build-push-action@v7
63+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
6464
with:
6565
push: true
6666
tags: ${{ steps.docker_meta.outputs.tags }}

‎.github/workflows/09-add-integration-test.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,22 @@ jobs:
1515
steps:
1616

1717
- name: Checkout git repo
18-
uses: actions/checkout@v6
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
1919

2020
- name: Set up QEMU
21-
uses: docker/setup-qemu-action@v4
21+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v4.0.0
2222

2323
- name: Set up Docker Buildx
24-
uses: docker/setup-buildx-action@v4
24+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
2525

2626
- name: Login to Docker Hub
27-
uses: docker/login-action@v4
27+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
2828
with:
2929
username: ${{ secrets.DOCKERHUB_USERNAME }}
3030
password: ${{ secrets.DOCKERHUB_TOKEN }}
3131

3232
- name: Build and export to Docker
33-
uses: docker/build-push-action@v7
33+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
3434
with:
3535
push: false
3636
load: true # Export to Docker Engine rather than pushing to a registry
@@ -53,7 +53,7 @@ jobs:
5353

5454
- name: Docker Metadata for Final Image Build
5555
id: docker_meta
56-
uses: docker/metadata-action@v6
56+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf #v6.0.0
5757
with:
5858
images: bretfisher/docker-ci-automation
5959
flavor: |
@@ -67,7 +67,7 @@ jobs:
6767
# type=semver,pattern={{version}}
6868

6969
- name: Docker Build and Push to Docker Hub
70-
uses: docker/build-push-action@v7
70+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
7171
with:
7272
push: true
7373
tags: ${{ steps.docker_meta.outputs.tags }}

0 commit comments

Comments
 (0)