Skip to content

Commit b98c73f

Browse files
authored
fix: security updates on commitlint action and workflows (#48)
- Updated immutable tag for commitlint actions - Updated immutable hash for action workflows
1 parent 50cc744 commit b98c73f

File tree

2 files changed

+11
-14
lines changed

2 files changed

+11
-14
lines changed

.github/workflows/release-please.yml

+6-10
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,19 @@
11
on:
22
push:
3-
branches:
4-
- main
5-
workflow_dispatch:
6-
7-
permissions:
8-
id-token: write # for PYPI release
3+
branches: ['main']
94

105
name: release-please
116

127
jobs:
138
release-please:
149
runs-on: ubuntu-latest
10+
permissions:
11+
id-token: write # for PYPI release
12+
1513
steps:
1614
- name: Release
1715
id: release
18-
uses: google-github-actions/release-please-action@v4
19-
with:
20-
token: ${{ secrets.BOT_TOKEN }}
16+
uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1
2117

2218
- uses: actions/checkout@v3
2319
if: ${{ steps.release.outputs.release_created }}
@@ -40,4 +36,4 @@ jobs:
4036

4137
- name: Publish package
4238
if: ${{ steps.release.outputs.release_created }}
43-
uses: pypa/gh-action-pypi-publish@v1.8.14
39+
uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0

action.yml

+5-4
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,12 @@ runs:
2323
using: 'composite'
2424
steps:
2525
- name: Install Python
26-
uses: actions/setup-python@v5
26+
uses: actions/setup-python@v5.1.0
2727
with:
2828
python-version: '3.8'
2929

3030
- name: Install Commitlint
31-
run: python -m pip install -e ${{ github.action_path }}
31+
run: python -m pip install --disable-pip-version-check -e ${{ github.action_path }}
3232
shell: bash
3333

3434
# checkout to the source code
@@ -40,17 +40,18 @@ runs:
4040
echo "count=$(echo '${{ toJson(github.event.commits) }}' | jq '. | length')" \
4141
>> $GITHUB_OUTPUT
4242
shell: bash
43+
4344
- name: Checkout to pushed commits
4445
if: github.event_name == 'push'
45-
uses: actions/checkout@v4
46+
uses: actions/checkout@v4.1.7
4647
with:
4748
ref: ${{ github.sha }}
4849
fetch-depth: ${{ steps.push_commit_count.outputs.count }}
4950

5051
# for pull_request event
5152
- name: Checkout to PR source branch
5253
if: github.event_name == 'pull_request'
53-
uses: actions/checkout@v4
54+
uses: actions/checkout@v4.1.7
5455
with:
5556
ref: ${{ github.event.pull_request.head.sha }}
5657
fetch-depth: ${{ github.event.pull_request.commits }}

0 commit comments

Comments
 (0)