Merge pull request #185 from Kong/INS-5211-pin-external-github-actions-to-commit-SHA

fix: Pin all external github actions to their corresponding commit SHAs

Author: jackkav

.github/workflows/release.yaml

@@ -41,7 +41,7 @@ jobs:
       # Produces SBOM and CVE report
       # Helps understand vulnerabilities / license compliance across third party dependencies
       - id: sca-project
-        uses: Kong/public-shared-actions/security-actions/sca@2f02738ecb1670f01391162e43fe3f5d4e7942a1 # v2.2.2
+        uses: Kong/public-shared-actions/security-actions/sca@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # v4.1.1
         with:
           dir: .
           upload-sbom-release-assets: true
@@ -99,7 +99,7 @@ jobs:
           outputs: type=docker,dest=${{ env.DOCKER_OCI_ARCHIVE }}.tar,oci-mediatypes=true
 
       - name: Upload Docker OCI layout TAR Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ env.DOCKER_OCI_ARCHIVE }}
           path: ${{ env.DOCKER_OCI_ARCHIVE }}.tar
@@ -118,7 +118,7 @@ jobs:
     steps:
 
       - name: Download OCI docker TAR artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: ${{ env.DOCKER_OCI_ARCHIVE }}
           path: ${{ github.workspace }}
@@ -129,7 +129,7 @@ jobs:
 
       - name: Scan the docker OCI Tar ball
         id: sbom_action_amd64
-        uses: Kong/public-shared-actions/security-actions/scan-docker-image@2f02738ecb1670f01391162e43fe3f5d4e7942a1 # v2.2.2
+        uses: Kong/public-shared-actions/security-actions/scan-docker-image@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # v4.1.3
         with:
           asset_prefix: image-${{ env.IMAGE_NAME }}-amd64
           image: ${{ env.DOCKER_OCI_ARCHIVE }}.tar
@@ -155,7 +155,7 @@ jobs:
     steps:
 
       - name: Download OCI docker TAR artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: ${{ env.DOCKER_OCI_ARCHIVE }}
           path: ${{ github.workspace }}
@@ -183,7 +183,7 @@ jobs:
 
       # Setup regctl to parse platform specific image digest from image manifest
       - name: Install regctl
-        uses: regclient/actions/regctl-installer@main
+        uses: regclient/actions/regctl-installer@ce5fd131e371ffcdd7508b478cb223b3511a9183 # main
 
       # The image manifest digest/sha is generated only after the image is published to registry
       - name: Parse architecture specific digest from image manifest
@@ -197,7 +197,7 @@ jobs:
       - name: Sign images
         id: sign_images
         if: ${{ steps.image_manifest_metadata.outputs.sha != '' }}
-        uses: Kong/public-shared-actions/security-actions/sign-docker-image@2f02738ecb1670f01391162e43fe3f5d4e7942a1 # v2.2.2
+        uses: Kong/public-shared-actions/security-actions/sign-docker-image@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # v4.1.1
         with:
           image_digest: ${{ steps.image_manifest_metadata.outputs.sha }}
           tags: ${{ env.IMAGE_TAGS }}
@@ -213,7 +213,7 @@ jobs:
   release-images-provenance:
     needs: ["check", "build-images", "scan-images", "release-images"]
     if: ${{ github.ref_type == 'tag' || (github.event_name == 'push' && github.ref_name == 'master') }}
-    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0
     permissions:
       contents: write
       id-token: write # For using token to sign images

.github/workflows/sast.yml

@@ -30,4 +30,4 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: Kong/public-shared-actions/security-actions/semgrep@2f02738ecb1670f01391162e43fe3f5d4e7942a1 # v2.2.2
+      - uses: Kong/public-shared-actions/security-actions/semgrep@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # v4.0.1

.github/workflows/test.yaml

@@ -9,7 +9,6 @@ jobs:
       with:
         node-version: 21
     - run: npm ci
-    - uses: biomejs/setup-biome@v2
+    - uses: biomejs/setup-biome@c016c38f26f2c4a6eb3662679143614a254263fd # v2
     - run: biome ci .
-    - run: npm test
-    - run: npm audit --audit-level=moderate
+    - run: npm test