Skip to content

Commit f453690

Browse files
veloferenc-csaky
velo
and
ferenc-csaky
authored
ci: Pin actions to SHAs and fix synced branch naming (#442)
Signed-off-by: Ferenc Csaky <ferenc@datasqrl.com> Co-authored-by: Ferenc Csaky <ferenc@datasqrl.com>
1 parent c5422aa commit f453690

4 files changed

Lines changed: 40 additions & 34 deletions

File tree

‎.github/actions/setup-jdk/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ runs:
55
using: 'composite'
66
steps:
77
- name: Set up JDK
8-
uses: actions/setup-java@v6
8+
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
99
with:
1010
distribution: 'temurin'
1111
java-version: '17'

‎.github/dependabot.yml‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,26 @@
33
# Please see the documentation for all configuration options:
44
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
55

6+
# Supply-chain policy: every entry only takes releases that have been public for 14 days (cooldown).
67
version: 2
78
updates:
89
- package-ecosystem: "maven"
910
directory: "/"
10-
schedule:
11-
interval: "weekly"
12-
day: "monday"
13-
time: "10:00"
14-
timezone: "UTC"
11+
schedule: { interval: "weekly", time: "10:00" }
12+
cooldown: { default-days: 14 }
1513
open-pull-requests-limit: 20
1614

1715
- package-ecosystem: "docker"
1816
directory: "/flink-sql-runner/src/main/docker"
19-
schedule:
20-
interval: "weekly"
21-
day: "monday"
22-
time: "10:00"
23-
timezone: "UTC"
17+
schedule: { interval: "weekly", time: "10:00" }
18+
cooldown: { default-days: 14 }
19+
20+
# Keeps the actions pinned to commit SHAs up to date.
21+
# "/" covers .github/workflows only; each local composite action needs its own directory.
22+
- package-ecosystem: "github-actions"
23+
directories:
24+
- "/"
25+
- "/.github/actions/setup-jdk"
26+
- "/.github/actions/setup-maven-settings"
27+
schedule: { interval: "weekly", time: "10:00" }
28+
cooldown: { default-days: 14 }

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131

3232
steps:
3333
- name: Checkout code
34-
uses: actions/checkout@v7
34+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
3535

3636
- name: Setup JDK
3737
uses: ./.github/actions/setup-jdk
@@ -62,7 +62,7 @@ jobs:
6262

6363
steps:
6464
- name: Checkout code
65-
uses: actions/checkout@v7
65+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
6666

6767
- name: Setup JDK
6868
uses: ./.github/actions/setup-jdk
@@ -81,7 +81,7 @@ jobs:
8181

8282
steps:
8383
- name: Checkout code
84-
uses: actions/checkout@v7
84+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
8585

8686
- name: Setup JDK
8787
uses: ./.github/actions/setup-jdk
@@ -103,7 +103,7 @@ jobs:
103103

104104
steps:
105105
- name: Checkout code
106-
uses: actions/checkout@v7
106+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
107107

108108
- name: Setup JDK
109109
uses: ./.github/actions/setup-jdk
@@ -147,16 +147,16 @@ jobs:
147147

148148
steps:
149149
- name: Checkout code
150-
uses: actions/checkout@v7
150+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
151151

152152
- name: Setup JDK
153153
uses: ./.github/actions/setup-jdk
154154

155155
- name: Set up Docker Buildx
156-
uses: docker/setup-buildx-action@v4
156+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
157157

158158
- name: Set up QEMU
159-
uses: docker/setup-qemu-action@v4
159+
uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
160160

161161
- name: Setup Maven settings
162162
uses: ./.github/actions/setup-maven-settings
@@ -189,14 +189,14 @@ jobs:
189189
fi
190190
191191
- name: Log in to container registry
192-
uses: docker/login-action@v4
192+
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
193193
with:
194194
registry: ${{ (github.event_name == 'release' && github.event.action == 'created') && 'docker.io' || 'ghcr.io' }}
195195
username: ${{ (github.event_name == 'release' && github.event.action == 'created') && secrets.DOCKER_USERNAME || github.actor }}
196196
password: ${{ (github.event_name == 'release' && github.event.action == 'created') && secrets.DOCKER_PASSWORD || secrets.GITHUB_TOKEN }}
197197

198198
- name: Build and push Docker image (linux/amd64 + linux/arm64)
199-
uses: docker/build-push-action@v7
199+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
200200
with:
201201
context: ./flink-sql-runner/target
202202
file: ./flink-sql-runner/target/Dockerfile
@@ -211,7 +211,7 @@ jobs:
211211
212212
- name: Upload to GitHub Release
213213
if: github.event_name == 'release' && github.event.action == 'created'
214-
uses: softprops/action-gh-release@v3
214+
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
215215
with:
216216
files: flink-sql-runner/target/flink-sql-runner-${{ needs.cache-dependencies.outputs.project-version }}-${{ needs.cache-dependencies.outputs.flink-version-label }}.jar
217217
env:

‎.github/workflows/test-cloud-compilation.yml‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,6 @@ jobs:
6767
fi
6868
6969
PR_DATA=$(gh api "/repos/${{ github.repository }}/pulls/${PR_NUMBER}")
70-
HEAD_REF=$(echo "$PR_DATA" | jq -r .head.ref)
7170
HEAD_SHA=$(echo "$PR_DATA" | jq -r .head.sha)
7271
BASE_REF=$(echo "$PR_DATA" | jq -r .base.ref)
7372
URL=$(echo "$PR_DATA" | jq -r .html_url)
@@ -88,7 +87,9 @@ jobs:
8887
{
8988
echo "should_sync=${SHOULD_SYNC}"
9089
echo "pr_number=${PR_NUMBER}"
91-
echo "head_ref=${HEAD_REF}"
90+
# The branch pushed into cloud-compilation with BOT_PAT. Never reuse the PR's own head ref:
91+
# a fork author picks that name (it could be "main" or "develop").
92+
echo "head_ref=flink-sql-runner/pr-${PR_NUMBER}"
9293
echo "head_sha=${HEAD_SHA}"
9394
echo "base_ref=${BASE_REF}"
9495
echo "url=${URL}"
@@ -128,7 +129,7 @@ jobs:
128129
statuses: write
129130
steps:
130131
- name: Post passing status for cloud-compilation/build
131-
uses: actions/github-script@v9
132+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
132133
with:
133134
script: |
134135
await github.rest.repos.createCommitStatus({
@@ -153,7 +154,7 @@ jobs:
153154
statuses: write
154155
steps:
155156
- name: Post pending status for cloud-compilation/build
156-
uses: actions/github-script@v9
157+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
157158
with:
158159
script: |
159160
await github.rest.repos.createCommitStatus({
@@ -166,13 +167,13 @@ jobs:
166167
});
167168
168169
- name: Checkout flink-sql-runner repo
169-
uses: actions/checkout@v7
170+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
170171
with:
171172
ref: ${{ needs.decide.outputs.pr_head_sha }}
172173
path: flink-sql-runner
173174

174175
- name: Checkout cloud-compilation repo
175-
uses: actions/checkout@v7
176+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
176177
with:
177178
repository: DataSQRL/cloud-compilation
178179
token: ${{ secrets.BOT_PAT }}
@@ -371,7 +372,7 @@ jobs:
371372
372373
- name: Post failure status for cloud-compilation/build
373374
if: failure()
374-
uses: actions/github-script@v9
375+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
375376
with:
376377
script: |
377378
await github.rest.repos.createCommitStatus({
@@ -417,7 +418,7 @@ jobs:
417418
id: branch_exists
418419
env:
419420
GH_TOKEN: ${{ secrets.BOT_PAT }}
420-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
421+
BRANCH_NAME: flink-sql-runner/pr-${{ github.event.pull_request.number }}
421422
run: |
422423
if gh api "/repos/DataSQRL/cloud-compilation/branches/${BRANCH_NAME}" >/dev/null 2>&1; then
423424
echo "exists=true" >> "$GITHUB_OUTPUT"
@@ -428,7 +429,7 @@ jobs:
428429
429430
- name: Checkout cloud-compilation repo
430431
if: steps.branch_exists.outputs.exists == 'true'
431-
uses: actions/checkout@v7
432+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
432433
with:
433434
repository: DataSQRL/cloud-compilation
434435
token: ${{ secrets.BOT_PAT }}
@@ -467,7 +468,7 @@ jobs:
467468
if: steps.branch_exists.outputs.exists == 'true'
468469
id: revert
469470
env:
470-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
471+
BRANCH_NAME: flink-sql-runner/pr-${{ github.event.pull_request.number }}
471472
BASE_REF: ${{ github.event.pull_request.base.ref }}
472473
PR_NUMBER: ${{ github.event.pull_request.number }}
473474
run: |
@@ -495,7 +496,7 @@ jobs:
495496
if: steps.branch_exists.outputs.exists == 'true'
496497
env:
497498
GH_TOKEN: ${{ secrets.BOT_PAT }}
498-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
499+
BRANCH_NAME: flink-sql-runner/pr-${{ github.event.pull_request.number }}
499500
BASE_REF: ${{ github.event.pull_request.base.ref }}
500501
PR_NUMBER: ${{ github.event.pull_request.number }}
501502
run: |
@@ -525,7 +526,7 @@ jobs:
525526
if: steps.branch_exists.outputs.exists == 'true'
526527
env:
527528
GH_TOKEN: ${{ secrets.BOT_PAT }}
528-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
529+
BRANCH_NAME: flink-sql-runner/pr-${{ github.event.pull_request.number }}
529530
PR_NUMBER: ${{ github.event.pull_request.number }}
530531
run: |
531532
CC_PR_URL=$(gh pr list \
@@ -553,7 +554,7 @@ jobs:
553554
- name: Comment on cloud-compilation PR (if exists)
554555
env:
555556
GH_TOKEN: ${{ secrets.BOT_PAT }}
556-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
557+
BRANCH_NAME: flink-sql-runner/pr-${{ github.event.pull_request.number }}
557558
PR_NUMBER: ${{ github.event.pull_request.number }}
558559
run: |
559560
CC_PR=$(gh pr list \

0 commit comments

Comments
 (0)