From 4c3c75295f9157ac0c8caf2e67a84ba189a8db50 Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Tue, 14 Jul 2026 10:39:52 +0300 Subject: [PATCH] ci: pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin third-party actions on mutable @master/@main tags in credentialed jobs: - chetan/invalidate-cloudfront-action (web.release.prod.yml) — handed production AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY - convictional/trigger-workflow-and-wait (snjs.pr.yml, e2e jobs) — handed CI_PAT_TOKEN - johnnyhuy/actions-discord-git-webhook (web.release.prod.yml) — handed DISCORD_WEBHOOK_URL A moved tag would run unreviewed code with those credentials. Behaviour unchanged; per GitHub's pin-to-SHA guidance. Signed-off-by: Kobi Hikri --- .github/workflows/snjs.pr.yml | 4 ++-- .github/workflows/web.release.prod.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/snjs.pr.yml b/.github/workflows/snjs.pr.yml index 86072bd3118..3b61f267db3 100644 --- a/.github/workflows/snjs.pr.yml +++ b/.github/workflows/snjs.pr.yml @@ -79,7 +79,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run E2E test suite - uses: convictional/trigger-workflow-and-wait@master + uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master with: owner: standardnotes repo: server @@ -97,7 +97,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run E2E vaults test suite - uses: convictional/trigger-workflow-and-wait@master + uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master with: owner: standardnotes repo: server diff --git a/.github/workflows/web.release.prod.yml b/.github/workflows/web.release.prod.yml index 04f26580cff..ee946e7e4a3 100644 --- a/.github/workflows/web.release.prod.yml +++ b/.github/workflows/web.release.prod.yml @@ -31,7 +31,7 @@ jobs: - name: Deploy static site to S3 bucket run: aws s3 sync packages/web/dist/ s3://app.standardnotes.com --delete - name: Invalidate CloudFront Cache - uses: chetan/invalidate-cloudfront-action@master + uses: chetan/invalidate-cloudfront-action@fce6f6f546fae2e9fe55f3bd1411063a908f2557 # master env: DISTRIBUTION: ${{ secrets.WEBAPP_CLOUDFRONT_COM_DISTRIBUTION_ID }} PATHS: '/*' @@ -46,6 +46,6 @@ jobs: steps: - name: Run Discord Webhook - uses: johnnyhuy/actions-discord-git-webhook@main + uses: johnnyhuy/actions-discord-git-webhook@344d3543a4d21067013d88ab8ee47ad498d8bb98 # main with: webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}