From db763a6f26c66d15610a2689e23603bd46dd6d49 Mon Sep 17 00:00:00 2001 From: James Woolfenden Date: Mon, 4 May 2026 12:19:45 +0100 Subject: [PATCH 1/2] chore: pin dependencies to immutable SHAs via ghat --- .github/workflows/build.yml | 25 +++++++++++++++++++++++++ .github/workflows/pull_request.yml | 8 ++++---- .github/workflows/verify.yml | 16 ++++++++-------- .pre-commit-config.yaml | 16 ++++++++-------- example/examplea/terraform.tf | 2 +- 5 files changed, 46 insertions(+), 21 deletions(-) create mode 100644 .github/workflows/build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..1da1917 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,25 @@ +name: build +on: + push: + branches: [master, main] + pull_request: + +permissions: + id-token: write + contents: read + +jobs: + validate: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: opentofu/setup-opentofu@fc711fa910b93cba0f3fbecaafc9f42fd0c411cb # v2.0.0 + with: + tofu_wrapper: false + # Uncomment for tofu plan — uses OIDC Workload Identity Federation (no long-lived secrets) + # - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 + # with: + # workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} + # service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} + - run: tofu init -backend=false + - run: tofu validate diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index c450601..c5860f0 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: token: ${{ github.token }} fetch-depth: '0' @@ -36,11 +36,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: token: ${{ github.token }} fetch-depth: '0' - - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: 3.11 - run: | @@ -52,4 +52,4 @@ jobs: tar -xvf actionlint_1.6.23_linux_amd64.tar.gz --directory "$GITHUB_WORKSPACE/bin" chmod +x "$GITHUB_WORKSPACE/bin/actionlint" echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH" - - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index bebda3a..93ae5c2 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -16,9 +16,9 @@ jobs: terraform: runs-on: ubuntu-latest steps: - - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0 + - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0 - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ env.branch }} token: ${{ github.token }} @@ -28,7 +28,7 @@ jobs: echo "plugin_cache_dir=$HOME/.terraform.d/plugin-cache" >~/.terraformrc mkdir --parents ~/.terraform.d/plugin-cache - name: Cache Terraform - uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: | ~/.terraform.d/plugin-cache @@ -53,12 +53,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ env.branch }} token: ${{ github.token }} fetch-depth: '0' - - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: 3.11 - run: | @@ -70,17 +70,17 @@ jobs: tar -xvf actionlint_1.6.23_linux_amd64.tar.gz --directory "$GITHUB_WORKSPACE/bin" chmod +x "$GITHUB_WORKSPACE/bin/actionlint" echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH" - - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 version: permissions: write-all name: versioning runs-on: ubuntu-latest steps: - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: '0' - name: Bump version and push tag - uses: anothrNick/github-tag-action@a2c70ae13a881faf2b4953baaa9e49731997ab36 # 1.67.0 + uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} DEFAULT_BUMP: patch diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 095c68b..d0333a1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -4,7 +4,7 @@ default_language_version: python: python3.11 repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.5.0 + rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0 hooks: - id: check-json - id: check-merge-conflict @@ -17,41 +17,41 @@ repos: - --autofix - id: detect-private-key - repo: https://github.com/Lucas-C/pre-commit-hooks - rev: v1.5.4 + rev: ad1b27d73581aa16cca06fc4a0761fc563ffe8e8 # v1.5.6 hooks: - id: forbid-tabs exclude_types: [python, javascript, dtd, markdown, makefile, xml] exclude: binary|\.bin$ - repo: https://github.com/jameswoolfenden/pre-commit-shell - rev: 0.0.2 + rev: 062f0b028ae65827e04f91c1e6738cfcbe9b337f # v1.0.6 hooks: - id: shell-lint exclude: template|\.template$ - repo: https://github.com/igorshubovych/markdownlint-cli - rev: v0.38.0 + rev: e72a3ca1632f0b11a07d171449fe447a7ff6795e # v0.48.0 hooks: - id: markdownlint - repo: https://github.com/jameswoolfenden/pre-commit - rev: v0.1.50 + rev: e022e4ac6ed682e95d1e813ee62d4fece371014b # v0.1.53 hooks: - id: terraform-fmt language_version: python3.11 - id: tf2docs language_version: python3.11 - repo: https://github.com/bridgecrewio/checkov - rev: 3.1.70 + rev: e52a901a3829d818d20c9b75e544845c8b756968 # 3.2.526 hooks: - id: checkov files: . verbose: true entry: checkov -d example/examplea --external-checks-dir checkov --download-external-modules true --compact - repo: https://github.com/jameswoolfenden/pike - rev: v0.3.4 + rev: d043242b9e1733e9e5a67c20bb87c05a4d563596 # v0.4.1 hooks: - id: pike-docs-go args: ["readme","-d", ".", "-i"] - repo: https://github.com/jameswoolfenden/ghat - rev: v0.1.3 + rev: 9ac03a27b221b0173a40e66aac1d09f5be4db40c # v0.1.23 hooks: - id: ghat-go args: ["swot","-d", "."] diff --git a/example/examplea/terraform.tf b/example/examplea/terraform.tf index 0e8cf33..710fc1b 100644 --- a/example/examplea/terraform.tf +++ b/example/examplea/terraform.tf @@ -1,8 +1,8 @@ terraform { required_providers { google = { - version = "5.0.0" source = "hashicorp/google" + version = "7.30.0" } } required_version = ">= 1.3.5" From 56cf035bb245e2770e6db49fc09689e2afccad7a Mon Sep 17 00:00:00 2001 From: James Woolfenden Date: Mon, 4 May 2026 12:53:46 +0100 Subject: [PATCH 2/2] Delete .github/workflows/build.yml --- .github/workflows/build.yml | 25 ------------------------- 1 file changed, 25 deletions(-) delete mode 100644 .github/workflows/build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index 1da1917..0000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: build -on: - push: - branches: [master, main] - pull_request: - -permissions: - id-token: write - contents: read - -jobs: - validate: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: opentofu/setup-opentofu@fc711fa910b93cba0f3fbecaafc9f42fd0c411cb # v2.0.0 - with: - tofu_wrapper: false - # Uncomment for tofu plan — uses OIDC Workload Identity Federation (no long-lived secrets) - # - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 - # with: - # workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} - # service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} - - run: tofu init -backend=false - - run: tofu validate