From 53a3e1bd5673abae29df5f95483c2c2daf64406c Mon Sep 17 00:00:00 2001 From: Frank Elsinga Date: Mon, 1 Sep 2025 21:12:02 +0200 Subject: [PATCH] chore(ci): pin actions to shas (#3769) --- .github/workflows/android-ci.yml | 30 +++++++-------- .github/workflows/android-device-test.yml | 18 ++++----- .github/workflows/android-release.yml | 14 +++---- .github/workflows/android-testapp-release.yml | 4 +- .github/workflows/cache-cleanup.yml | 2 +- .github/workflows/core-release.yml | 10 ++--- .github/workflows/gh-pages-android-api.yml | 6 +-- .../workflows/gh-pages-android-examples.yml | 4 +- .github/workflows/gh-pages-cpp-api.yml | 4 +- .github/workflows/gh-pages-docc.yml | 12 +++--- .github/workflows/gh-pages-mdbook.yml | 14 +++---- .github/workflows/ios-ci.yml | 30 +++++++-------- .github/workflows/ios-device-test.yml | 14 +++---- .github/workflows/ios-release-cocoapods.yml | 2 +- .github/workflows/linux-ci.yml | 26 ++++++------- .github/workflows/macos-ci.yml | 4 +- .github/workflows/node-ci.yml | 18 ++++----- .github/workflows/node-release.yml | 28 +++++++------- .github/workflows/pr-bloaty-ios.yml | 12 +++--- .github/workflows/pr-linux-tests.yml | 18 ++++----- .github/workflows/qt-ci.yml | 16 ++++---- .github/workflows/rust-ci.yaml | 10 ++--- .github/workflows/typecheck-scripts.yml | 2 +- .github/workflows/upload-coverage.yml | 8 ++-- .github/workflows/windows-ci.yml | 38 +++++++++---------- 25 files changed, 172 insertions(+), 172 deletions(-) diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml index 710cdc1ae..a38673c86 100644 --- a/.github/workflows/android-ci.yml +++ b/.github/workflows/android-ci.yml @@ -26,14 +26,14 @@ jobs: outputs: should_skip: ${{ github.event_name != 'workflow_dispatch' && steps.changed-files.outputs.android_any_modified != 'true' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive - name: Get all Android files that have changed if: github.event_name != 'workflow_dispatch' id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 with: files_yaml_from_source_file: .github/changed-files.yml @@ -54,14 +54,14 @@ jobs: IS_LOCAL_DEVELOPMENT: false MLN_ANDROID_STL: c++_static steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 - uses: ./.github/actions/setup-android-ci - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: ".nvmrc" @@ -93,13 +93,13 @@ jobs: rm -rf venv shell: bash - - uses: infotroph/tree-is-clean@v1 + - uses: infotroph/tree-is-clean@69d598a958e8cb8f3d0e3d52b5ebcd8684f2adc2 # v1 with: check_untracked: true - name: Configure AWS Credentials if: vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -157,7 +157,7 @@ jobs: - name: Create artifact for benchmark APKs if: matrix.renderer == 'opengl' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: if-no-files-found: error name: benchmarkAPKs @@ -184,7 +184,7 @@ jobs: cp MapLibreAndroidTestApp/build/outputs/apk/androidTest/${{ matrix.renderer }}/debug/MapLibreAndroidTestApp-${{ matrix.renderer }}-debug-androidTest.apk InstrumentationTests${{ env.renderer }}.apk - name: Upload android-ui-test-${{ matrix.renderer }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: if-no-files-found: error name: android-ui-test-${{ matrix.renderer }} @@ -207,7 +207,7 @@ jobs: working-directory: test/android steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 @@ -220,7 +220,7 @@ jobs: - name: Configure AWS Credentials if: vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -243,7 +243,7 @@ jobs: cp app/build/outputs/apk/androidTest/release/app-release-androidTest.apk . - name: Store C++ Unit Tests .apk files - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: android-cpp-tests if-no-files-found: error @@ -265,7 +265,7 @@ jobs: if: needs.pre_job.outputs.should_skip != 'true' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 @@ -274,7 +274,7 @@ jobs: - name: Configure AWS Credentials if: vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -314,13 +314,13 @@ jobs: # automatically trigger android-release when code is pushed to main # and the platform/android/VERSION file has changed - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 if: github.ref == 'refs/heads/main' && github.event_name == 'push' - name: VERSION file changed if: github.ref == 'refs/heads/main' && github.event_name == 'push' id: version-file-android-changed - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 with: files: platform/android/VERSION diff --git a/.github/workflows/android-device-test.yml b/.github/workflows/android-device-test.yml index cbb578608..51b0ff6fe 100644 --- a/.github/workflows/android-device-test.yml +++ b/.github/workflows/android-device-test.yml @@ -78,9 +78,9 @@ jobs: runs-on: ubuntu-latest if: github.repository_owner == 'maplibre' && github.event.workflow_run.conclusion == 'success' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: '.nvmrc' @@ -100,7 +100,7 @@ jobs: id: get-pr-number - name: Generate token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2 id: generate_token with: skip-token-revoke: true # revoking will fail for long running workflows, because the token will already have expired @@ -109,7 +109,7 @@ jobs: - name: Check if comment on PR contains '!benchmark android' if: matrix.test.name == 'Android Benchmark' && steps.get-pr-number.outputs.pr-number - uses: peter-evans/find-comment@v3 + uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3 id: benchmark_comment with: issue-number: ${{ steps.get-pr-number.outputs.pr-number }} @@ -126,7 +126,7 @@ jobs: run: echo "run_device_test=true" >> "$GITHUB_ENV" - - uses: LouisBrunner/checks-action@v2.0.0 + - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0 id: create_check with: token: ${{ steps.generate_token.outputs.token }} @@ -143,7 +143,7 @@ jobs: - name: Configure AWS Credentials if: env.run_device_test == 'true' - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -196,20 +196,20 @@ jobs: - name: Upload Test Artifacts if: (matrix.test.name == 'Android Benchmark' || failure()) && env.run_device_test == 'true' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: "Test Artifacts ${{ matrix.test.name }}" path: test_artifacts.zip - name: Generate another token (previous one could have expired) if: always() - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2 id: generate_token_2 with: app-id: ${{ secrets.MAPLIBRE_NATIVE_BOT_APP_ID }} private-key: ${{ secrets.MAPLIBRE_NATIVE_BOT_PRIVATE_KEY }} - - uses: LouisBrunner/checks-action@v2.0.0 + - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0 if: always() with: token: ${{ steps.generate_token_2.outputs.token }} diff --git a/.github/workflows/android-release.yml b/.github/workflows/android-release.yml index e5554d511..5eb9dc5f4 100644 --- a/.github/workflows/android-release.yml +++ b/.github/workflows/android-release.yml @@ -13,7 +13,7 @@ jobs: run: working-directory: platform/android steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Validate and set version working-directory: . @@ -50,7 +50,7 @@ jobs: - name: Create release id: create_release - uses: actions/create-release@v1 + uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -78,16 +78,16 @@ jobs: - Release - Debug steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: ".nvmrc" - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4 with: distribution: "temurin" java-version: "17" @@ -108,7 +108,7 @@ jobs: echo buildtype=${buildtype,,} > "$GITHUB_ENV" - name: Upload aar (${{ matrix.RENDERER }}, ${{ matrix.BUILDTYPE }}) - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -118,7 +118,7 @@ jobs: asset_content_type: application/zip - name: Upload debug symbols (${{ matrix.RENDERER }}, ${{ matrix.BUILDTYPE }}) - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/android-testapp-release.yml b/.github/workflows/android-testapp-release.yml index f0cd61189..862209e30 100644 --- a/.github/workflows/android-testapp-release.yml +++ b/.github/workflows/android-testapp-release.yml @@ -10,7 +10,7 @@ jobs: create-android-testapp-release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Create Release run: | @@ -41,7 +41,7 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_DSN: ${{ secrets.SENTRY_DSN_ANDROID }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 diff --git a/.github/workflows/cache-cleanup.yml b/.github/workflows/cache-cleanup.yml index ee095b609..58c8ae0b2 100644 --- a/.github/workflows/cache-cleanup.yml +++ b/.github/workflows/cache-cleanup.yml @@ -15,7 +15,7 @@ jobs: contents: read steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Cleanup run: | diff --git a/.github/workflows/core-release.yml b/.github/workflows/core-release.yml index 8d313e6b1..dda079be5 100644 --- a/.github/workflows/core-release.yml +++ b/.github/workflows/core-release.yml @@ -11,7 +11,7 @@ jobs: create-release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive @@ -40,7 +40,7 @@ jobs: needs: [create-release] runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive @@ -72,7 +72,7 @@ jobs: - renderer: vulkan runner: { os: ubuntu-24.04-arm, arch: arm64 } steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive @@ -106,11 +106,11 @@ jobs: - run: | git config --system core.longpaths true - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 - name: Build mbgl-core for Windows run: | diff --git a/.github/workflows/gh-pages-android-api.yml b/.github/workflows/gh-pages-android-api.yml index f42cc8835..faeba8c7f 100644 --- a/.github/workflows/gh-pages-android-api.yml +++ b/.github/workflows/gh-pages-android-api.yml @@ -15,9 +15,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout 🛎️ - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4 with: distribution: "temurin" java-version: "17" @@ -26,7 +26,7 @@ jobs: run: ./gradlew dokkaGenerate - name: Deploy 🚀 - uses: JamesIves/github-pages-deploy-action@v4.7.3 + uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8 # v4.7.3 with: branch: gh-pages folder: platform/android/MapLibreAndroid/build/dokka/html diff --git a/.github/workflows/gh-pages-android-examples.yml b/.github/workflows/gh-pages-android-examples.yml index 047d7be2b..caef000cd 100644 --- a/.github/workflows/gh-pages-android-examples.yml +++ b/.github/workflows/gh-pages-android-examples.yml @@ -17,13 +17,13 @@ jobs: shell: bash steps: - name: Checkout 🛎️ - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Generate documentation run: make mkdocs-build - name: Deploy 🚀 - uses: JamesIves/github-pages-deploy-action@v4.7.3 + uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8 # v4.7.3 with: branch: gh-pages folder: platform/android/site diff --git a/.github/workflows/gh-pages-cpp-api.yml b/.github/workflows/gh-pages-cpp-api.yml index bfcfcd904..9100c49c5 100644 --- a/.github/workflows/gh-pages-cpp-api.yml +++ b/.github/workflows/gh-pages-cpp-api.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout 🛎️ - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: true @@ -20,7 +20,7 @@ jobs: run: doxygen - name: Deploy 🚀 - uses: JamesIves/github-pages-deploy-action@v4.7.3 + uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8 # v4.7.3 with: branch: gh-pages folder: docs/doxygen/html diff --git a/.github/workflows/gh-pages-docc.yml b/.github/workflows/gh-pages-docc.yml index e6273d821..ff534d0e4 100644 --- a/.github/workflows/gh-pages-docc.yml +++ b/.github/workflows/gh-pages-docc.yml @@ -20,10 +20,10 @@ jobs: runs-on: macos-latest steps: - name: Checkout 🛎️ - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -41,7 +41,7 @@ jobs: cd build zip -r docs.zip docs/ - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: docc-docs path: build/docs.zip @@ -52,10 +52,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout 🛎️ - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Download DocC docs artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: docc-docs path: build @@ -67,7 +67,7 @@ jobs: rm docs.zip - name: Deploy DocC documentation (main) 🚀 - uses: JamesIves/github-pages-deploy-action@v4.7.3 + uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8 # v4.7.3 with: branch: gh-pages folder: build/docs diff --git a/.github/workflows/gh-pages-mdbook.yml b/.github/workflows/gh-pages-mdbook.yml index 9948868f8..ec6bdbcb9 100644 --- a/.github/workflows/gh-pages-mdbook.yml +++ b/.github/workflows/gh-pages-mdbook.yml @@ -16,10 +16,10 @@ jobs: name: Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: extractions/setup-just@v3 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 + - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3 - name: Setup mdBook - uses: peaceiris/actions-mdbook@v2 + uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2 - name: Install Dependencies shell: bash run: sudo apt-get install -y libwayland-dev libxkbcommon-dev # Required for winit @@ -29,7 +29,7 @@ jobs: working-directory: docs/mdbook shell: bash run: mdbook build - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: book path: docs/mdbook/book/ @@ -40,15 +40,15 @@ jobs: name: Deploy runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Download book - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: book path: artifacts/book - name: Deploy - uses: JamesIves/github-pages-deploy-action@v4.7.3 + uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8 # v4.7.3 with: branch: gh-pages folder: artifacts/book diff --git a/.github/workflows/ios-ci.yml b/.github/workflows/ios-ci.yml index 4d8701cf0..bc9ac860b 100644 --- a/.github/workflows/ios-ci.yml +++ b/.github/workflows/ios-ci.yml @@ -38,14 +38,14 @@ jobs: outputs: should_skip: ${{ github.event_name != 'workflow_dispatch' && steps.changed-files-yaml.outputs.ios_any_modified != 'true' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive - name: Get all iOS files that have changed if: github.event_name != 'workflow_dispatch' id: changed-files-yaml - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 with: files_yaml_from_source_file: .github/changed-files.yml @@ -72,13 +72,13 @@ jobs: working-directory: platform/ios shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 - name: Cache Bazel - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: key: ${{ runner.os }}-bazel-${{ hashFiles('.bazelversion', '.bazelrc', 'WORKSPACE', 'WORKSPACE.bazel', 'MODULE.bazel') }} restore-keys: | @@ -141,7 +141,7 @@ jobs: zip -r "$render_test_app_dir"/RenderTest.xctest.zip RenderTest.xctest echo render_test_artifacts_dir="$render_test_app_dir" >> "$GITHUB_ENV" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ios-render-test retention-days: 3 @@ -168,7 +168,7 @@ jobs: zip -r "$ios_cpp_test_app_dir"/CppUnitTests.xctest.zip CppUnitTests.xctest echo ios_cpp_test_artifacts_dir="$ios_cpp_test_app_dir" >> "$GITHUB_ENV" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ios-cpp-unit-tests retention-days: 3 @@ -189,7 +189,7 @@ jobs: - name: Upload size test as artifact (Bloaty) if: github.event_name == 'pull_request' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ios-size-test-files retention-days: 3 @@ -200,7 +200,7 @@ jobs: - name: Configure AWS Credentials if: github.ref == 'refs/heads/main' && vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -229,14 +229,14 @@ jobs: working-directory: platform/ios shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 - name: VERSION file changed id: version-file-ios-changed - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 with: files: platform/ios/VERSION @@ -247,7 +247,7 @@ jobs: (github.event_name == 'push' && steps.version-file-ios-changed.outputs.any_changed == 'true') run: echo make_release=true >> "$GITHUB_ENV" - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 if: env.make_release with: node-version-file: ".nvmrc" @@ -293,7 +293,7 @@ jobs: cat changelog_for_version.md - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -320,7 +320,7 @@ jobs: - name: Release (GitHub) if: env.make_release id: github_release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2 with: name: ios-v${{ env.version }} files: | @@ -334,7 +334,7 @@ jobs: # needed to trigger workflow for Swift Package Index release - name: Generate token if: env.make_release - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2 id: generate_token with: app-id: ${{ secrets.MAPLIBRE_NATIVE_BOT_APP_ID }} @@ -378,7 +378,7 @@ jobs: runs-on: macos-14 if: needs.pre_job.outputs.should_skip != 'true' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 diff --git a/.github/workflows/ios-device-test.yml b/.github/workflows/ios-device-test.yml index 93890f13a..2b06977c3 100644 --- a/.github/workflows/ios-device-test.yml +++ b/.github/workflows/ios-device-test.yml @@ -21,16 +21,16 @@ jobs: runs-on: ubuntu-22.04 if: github.repository_owner == 'maplibre' && github.event.workflow_run.conclusion == 'success' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Generate token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2 id: generate_token with: app-id: ${{ secrets.MAPLIBRE_NATIVE_BOT_APP_ID }} private-key: ${{ secrets.MAPLIBRE_NATIVE_BOT_PRIVATE_KEY }} - - uses: LouisBrunner/checks-action@v2.0.0 + - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0 id: create_check with: token: ${{ steps.generate_token.outputs.token }} @@ -45,12 +45,12 @@ jobs: - name: Check if test files exist (otherwise the parent workflow was skipped) id: check_files - uses: andstor/file-existence-action@v3.0.0 + uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0 with: files: "${{ matrix.test.xcTestFile }}, ${{ matrix.test.ipaFile }}" - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -74,13 +74,13 @@ jobs: - name: Generate another token (previous one could have expired) if: always() - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2 id: generate_token_2 with: app-id: ${{ secrets.MAPLIBRE_NATIVE_BOT_APP_ID }} private-key: ${{ secrets.MAPLIBRE_NATIVE_BOT_PRIVATE_KEY }} - - uses: LouisBrunner/checks-action@v2.0.0 + - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0 if: always() with: token: ${{ steps.generate_token_2.outputs.token }} diff --git a/.github/workflows/ios-release-cocoapods.yml b/.github/workflows/ios-release-cocoapods.yml index 1d2f0add2..6d4c595be 100644 --- a/.github/workflows/ios-release-cocoapods.yml +++ b/.github/workflows/ios-release-cocoapods.yml @@ -14,7 +14,7 @@ jobs: working-directory: platform/ios runs-on: macos-14 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: fetch-depth: 0 diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml index 3b7a79409..7568437a8 100644 --- a/.github/workflows/linux-ci.yml +++ b/.github/workflows/linux-ci.yml @@ -33,7 +33,7 @@ jobs: outputs: should_skip: ${{ github.event_name != 'workflow_dispatch' && steps.changed-files.outputs.linux_any_modified != 'true' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive @@ -41,7 +41,7 @@ jobs: if: github.event_name != 'workflow_dispatch' id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 with: files_yaml_from_source_file: .github/changed-files.yml @@ -65,13 +65,13 @@ jobs: rust: true runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3 with: languages: cpp @@ -93,7 +93,7 @@ jobs: - name: Configure AWS Credentials if: vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -142,7 +142,7 @@ jobs: - name: Upload mbgl-render as artifact if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.event_name == 'pull_request' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: mbgl-render path: | @@ -150,7 +150,7 @@ jobs: - name: Upload mbgl-benchmark-runner as artifact if: matrix.variant.renderer == 'opengl' && !matrix.variant.rust && github.event_name == 'pull_request' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: mbgl-benchmark-runner path: | @@ -165,7 +165,7 @@ jobs: # CodeQL - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3 with: category: "/language:cpp" @@ -192,7 +192,7 @@ jobs: - name: Upload render test result if: always() && steps.render_test.outcome == 'failure' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: render-test-result-${{ matrix.variant.renderer }} path: | @@ -211,7 +211,7 @@ jobs: linux-coverage: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 @@ -220,14 +220,14 @@ jobs: run: .github/scripts/install-linux-deps - name: Cache Bazel - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: key: ${{ runner.os }}-bazel-${{ hashFiles('.bazelversion', '.bazelrc', 'WORKSPACE', 'WORKSPACE.bazel', 'MODULE.bazel') }} restore-keys: | ${{ runner.os }}-bazel- path: ~/.cache/bazel - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: '.nvmrc' @@ -247,7 +247,7 @@ jobs: echo coverage_report="$(bazel info output_path)"/_coverage/_coverage_report.dat >> "$GITHUB_ENV" - name: Upload coverage report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: coverage-report path: ${{ env.coverage_report }} diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml index 46b4a6dcb..81d00548b 100644 --- a/.github/workflows/macos-ci.yml +++ b/.github/workflows/macos-ci.yml @@ -57,13 +57,13 @@ jobs: shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 - name: Cache Bazel - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: key: ${{ runner.os }}-bazel-${{ hashFiles('.bazelversion', '.bazelrc', 'WORKSPACE', 'WORKSPACE.bazel', 'MODULE.bazel') }} restore-keys: | diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml index 7c116279e..590068fdc 100644 --- a/.github/workflows/node-ci.yml +++ b/.github/workflows/node-ci.yml @@ -95,7 +95,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: true fetch-depth: 0 @@ -136,7 +136,7 @@ jobs: /usr/sbin/update-ccache-symlinks - name: Use Node.js from nvmrc - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: 'platform/node/.nvmrc' @@ -146,7 +146,7 @@ jobs: - name: Set up msvc dev cmd (Windows) if: runner.os == 'Windows' - uses: ilammy/msvc-dev-cmd@v1 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 # Fixes an issue with the image causing builds to fail - https://github.com/actions/runner-images/issues/8598 - name: Remove Strawberry Perl from PATH (Windows) @@ -159,7 +159,7 @@ jobs: - name: Setup cmake # linux arm not supported https://github.com/jwlawson/actions-setup-cmake/issues/79 if: ${{contains(runner.name, 'GitHub Actions') && matrix.runs-on != 'ubuntu-22.04-arm' }} - uses: jwlawson/actions-setup-cmake@v2 + uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be # v2 with: cmake-version: '3.31' @@ -169,7 +169,7 @@ jobs: - name: Set up ccache (MacOS/Linux) if: runner.os == 'MacOS' || runner.os == 'Linux' - uses: hendrikmuhs/ccache-action@v1 + uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1 # v1 with: key: ${{ matrix.runs-on }}-${{ env.BUILDTYPE }}-${{ github.job }}-${{ github.ref }}-${{ github.sha }}-${{ github.head_ref }} restore-keys: | @@ -179,7 +179,7 @@ jobs: - name: Set up ccache (Windows) if: runner.os == 'Windows' - uses: hendrikmuhs/ccache-action@v1 + uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1 # v1 with: variant: "sccache" key: ${{ matrix.runs-on }}-${{ env.BUILDTYPE }}-${{ github.job }}-${{ github.ref }}-${{ github.sha }}-${{ github.head_ref }} @@ -189,7 +189,7 @@ jobs: ${{ matrix.runs-on }}-${{ env.BUILDTYPE }}-${{ github.job }} - name: Cache cmake-node-module deps - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: # downloaded with platform/node/cmake/module.cmake path: build/headers @@ -220,7 +220,7 @@ jobs: - name: Restore vcpkg binary cache if: runner.os == 'Windows' - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: ${{ github.workspace }}\platform\windows\vendor\vcpkg\archives key: vcpkg-${{ env.VCPKG_COMMIT_ID }} @@ -257,7 +257,7 @@ jobs: - name: Upload render test artifacts (MacOS) if: runner.os == 'MacOS' && steps.render_tests.outcome == 'failure' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: render-query-test-results_${{ runner.os }}_${{ matrix.arch }} path: metrics/macos-xcode11-release-style.html diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml index 7d52fd5df..3f6870d16 100644 --- a/.github/workflows/node-release.yml +++ b/.github/workflows/node-release.yml @@ -13,12 +13,12 @@ jobs: run: shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: fetch-depth: 0 - name: Use Node.js from nvmrc - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: 'platform/node/.nvmrc' @@ -65,7 +65,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: true fetch-depth: 0 @@ -106,7 +106,7 @@ jobs: /usr/sbin/update-ccache-symlinks - name: Use Node.js from nvmrc - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: 'platform/node/.nvmrc' @@ -116,7 +116,7 @@ jobs: - name: Set up msvc dev cmd (Windows) if: runner.os == 'Windows' - uses: ilammy/msvc-dev-cmd@v1 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 # Fixes an issue with the image causing builds to fail - https://github.com/actions/runner-images/issues/8598 - name: Remove Strawberry Perl from PATH (Windows) @@ -128,7 +128,7 @@ jobs: - name: Setup cmake if: ${{contains(runner.name, 'GitHub Actions')}} - uses: jwlawson/actions-setup-cmake@v2 + uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be # v2 with: cmake-version: '3.31' @@ -138,7 +138,7 @@ jobs: - name: Set up ccache (MacOS/Linux) if: runner.os == 'MacOS' || runner.os == 'Linux' - uses: hendrikmuhs/ccache-action@v1 + uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1 # v1 with: key: ${{ matrix.runs-on }}-${{ env.BUILDTYPE }}-${{ github.job }}-${{ github.ref }}-${{ github.sha }}-${{ github.head_ref }} restore-keys: | @@ -148,7 +148,7 @@ jobs: - name: Set up ccache (Windows) if: runner.os == 'Windows' - uses: hendrikmuhs/ccache-action@v1 + uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1 # v1 with: variant: "sccache" key: ${{ matrix.runs-on }}-${{ env.BUILDTYPE }}-${{ github.job }}-${{ github.ref }}-${{ github.sha }}-${{ github.head_ref }} @@ -158,7 +158,7 @@ jobs: ${{ matrix.runs-on }}-${{ env.BUILDTYPE }}-${{ github.job }} - name: Cache cmake-node-module deps - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: # downloaded with platform/node/cmake/module.cmake path: build/headers @@ -187,7 +187,7 @@ jobs: - name: Restore vcpkg cache (Windows) if: runner.os == 'Windows' - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: | ${{ github.workspace }}/platform/windows/vendor/vcpkg @@ -249,18 +249,18 @@ jobs: shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: fetch-depth: 0 - name: Use Node.js from nvmrc - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: 'platform/node/.nvmrc' - name: Get version id: package-version - uses: martinbeentjes/npm-get-version-action@v1.3.1 + uses: martinbeentjes/npm-get-version-action@3cf273023a0dda27efcd3164bdfb51908dd46a5b # v1.3.1 with: path: platform/node @@ -287,7 +287,7 @@ jobs: - name: Update Release Notes id: update_release_notes - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/pr-bloaty-ios.yml b/.github/workflows/pr-bloaty-ios.yml index cccfd4a60..d8ed573fa 100644 --- a/.github/workflows/pr-bloaty-ios.yml +++ b/.github/workflows/pr-bloaty-ios.yml @@ -19,13 +19,13 @@ jobs: outputs: should_skip: ${{ steps.parent_workflow.outputs.was_skipped_or_cancelled }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: sparse-checkout: | .github .nvmrc - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: '.nvmrc' @@ -44,11 +44,11 @@ jobs: if: needs.pre_job.outputs.should_skip == 'false' runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Cache Bloaty id: cache-bloaty - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: bloaty/build/bloaty key: bloaty-${{ env.bloaty_sha }} @@ -82,7 +82,7 @@ jobs: - name: Configure AWS Credentials if: vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -103,7 +103,7 @@ jobs: } >> message.md - name: Leave a comment with Bloaty results - uses: marocchino/sticky-pull-request-comment@v2 + uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2 with: number: ${{ steps.get-pr-number.outputs.pr-number }} header: bloaty-ios diff --git a/.github/workflows/pr-linux-tests.yml b/.github/workflows/pr-linux-tests.yml index 178024db6..8a2790da1 100644 --- a/.github/workflows/pr-linux-tests.yml +++ b/.github/workflows/pr-linux-tests.yml @@ -22,13 +22,13 @@ jobs: outputs: should_skip: ${{ steps.parent_workflow.outputs.was_skipped_or_cancelled }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: sparse-checkout: | .github .nvmrc - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: '.nvmrc' @@ -47,7 +47,7 @@ jobs: if: needs.pre_job.outputs.should_skip == 'false' runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - uses: ./.github/actions/get-pr-number id: get-pr-number @@ -67,7 +67,7 @@ jobs: - name: Cache Bloaty id: cache-bloaty - uses: actions/cache@v4 + uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: bloaty/build/bloaty key: bloaty-${{ env.bloaty_sha }} @@ -92,7 +92,7 @@ jobs: - name: Configure AWS Credentials if: github.ref == 'refs/heads/main' && vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -125,7 +125,7 @@ jobs: } >> message.md - name: Leave a comment with Bloaty results - uses: marocchino/sticky-pull-request-comment@v2 + uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2 with: number: ${{ steps.get-pr-number.outputs.pr-number }} header: bloaty @@ -136,7 +136,7 @@ jobs: if: needs.pre_job.outputs.should_skip == 'false' runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: true @@ -166,7 +166,7 @@ jobs: - name: Configure AWS Credentials if: github.ref == 'refs/heads/main' && vars.OIDC_AWS_ROLE_TO_ASSUME - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4 with: aws-region: us-west-2 role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }} @@ -186,7 +186,7 @@ jobs: } >> message.md - name: Leave a comment with Benchmark results - uses: marocchino/sticky-pull-request-comment@v2 + uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2 with: number: ${{ steps.get-pr-number.outputs.pr-number }} header: benchmark diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml index 6c70f3d49..279d06e98 100644 --- a/.github/workflows/qt-ci.yml +++ b/.github/workflows/qt-ci.yml @@ -99,7 +99,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: path: source fetch-depth: 0 @@ -125,7 +125,7 @@ jobs: - name: Install compiler (Linux) id: install_compiler if: runner.os == 'Linux' - uses: rlalik/setup-cpp-compiler@master + uses: rlalik/setup-cpp-compiler@e312c52f6d9664049d97c75ab084c895d9733c0c # master with: compiler: ${{ matrix.compiler }} @@ -158,21 +158,21 @@ jobs: - name: Setup Xcode if: runner.os == 'macOS' - uses: maxim-lobanov/setup-xcode@v1 + uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1 with: xcode-version: latest-stable - name: Setup MSVC if: matrix.qt_arch == 'win64_msvc2022_64' - uses: ilammy/msvc-dev-cmd@v1 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 with: arch: ${{ matrix.compiler_type }} - name: Setup ninja - uses: seanmiddleditch/gha-setup-ninja@v6 + uses: seanmiddleditch/gha-setup-ninja@3b1f8f94a2f8254bd26914c4ab9474d4f0015f67 # v6 - name: Download Qt - uses: jurplel/install-qt-action@v4 + uses: jurplel/install-qt-action@d325aaf2a8baeeda41ad0b5d39f84a6af9bcf005 # v4 with: aqtversion: ==3.1.* version: ${{ env.QT_VERSION }} @@ -183,7 +183,7 @@ jobs: extra: --base https://mirrors.ocf.berkeley.edu/qt/ - name: Set up ccache - uses: hendrikmuhs/ccache-action@v1 + uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1 # v1 with: key: Qt_${{ matrix.name }}_${{ matrix.qt_version }} max-size: 200M @@ -233,7 +233,7 @@ jobs: - name: Run tests (Linux) if: runner.os == 'Linux' - uses: coactions/setup-xvfb@v1 + uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1 with: run: ctest --output-on-failure working-directory: build diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml index dcc6ce627..a71f2ba8b 100644 --- a/.github/workflows/rust-ci.yaml +++ b/.github/workflows/rust-ci.yaml @@ -24,23 +24,23 @@ jobs: - os: windows-latest - os: ubuntu-latest steps: - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@020705266844b275b711684191e11281be48860c # v2 with: { tool: just } - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - run: just -v ci-test msrv: name: Rust tests MSRV (Minimal Supported Rust Version) runs-on: ubuntu-latest steps: - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@020705266844b275b711684191e11281be48860c # v2 with: { tool: just } - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - name: Read crate metadata id: metadata run: echo "rust-version=$(sed -ne 's/rust-version *= *\"\(.*\)\"/\1/p' Cargo.toml)" >> "$GITHUB_OUTPUT" - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable with: toolchain: ${{ steps.metadata.outputs.rust-version }} - run: just ci-test-msrv diff --git a/.github/workflows/typecheck-scripts.yml b/.github/workflows/typecheck-scripts.yml index e19cdd22e..6bbf60c0d 100644 --- a/.github/workflows/typecheck-scripts.yml +++ b/.github/workflows/typecheck-scripts.yml @@ -9,7 +9,7 @@ jobs: typecheck-scripts: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - run: | npm install diff --git a/.github/workflows/upload-coverage.yml b/.github/workflows/upload-coverage.yml index 21a3b9ba1..9e18797b9 100644 --- a/.github/workflows/upload-coverage.yml +++ b/.github/workflows/upload-coverage.yml @@ -12,13 +12,13 @@ jobs: outputs: should_run: ${{ !steps.parent_workflow.outputs.was_skipped_or_cancelled }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: sparse-checkout: | .github .nvmrc - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version-file: '.nvmrc' @@ -37,7 +37,7 @@ jobs: if: needs.pre_job.outputs.should_run == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 - uses: ./.github/actions/download-workflow-run-artifact with: @@ -46,7 +46,7 @@ jobs: - name: Upload coverage report if: '!cancelled()' - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5 with: override_commit: ${{ github.event.workflow_run.head_sha }} override_pr: ${{ github.event.workflow_run.pull_requests[0].number }} diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml index 421a130d5..ea0e51436 100644 --- a/.github/workflows/windows-ci.yml +++ b/.github/workflows/windows-ci.yml @@ -35,7 +35,7 @@ jobs: - run: | git config --system core.longpaths true - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive fetch-depth: 0 @@ -43,7 +43,7 @@ jobs: - name: Get all Windows files that have changed if: github.event_name != 'workflow_dispatch' id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 with: files_yaml_from_source_file: .github/changed-files.yml @@ -60,7 +60,7 @@ jobs: - run: | git config --system core.longpaths true - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: sparse-checkout: | platform/windows/vendor @@ -73,7 +73,7 @@ jobs: - name: Restore vcpkg binary cache id: vcpkg-cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: ${{ github.workspace }}\platform\windows\vendor\vcpkg\archives key: vcpkg-${{ env.VCPKG_COMMIT_ID }} @@ -85,7 +85,7 @@ jobs: git submodule sync --recursive git submodule update --init --force --depth=1 --recursive platform/windows/vendor/vcpkg - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 if: steps.vcpkg-cache.outputs.cache-hit != 'true' - name: Acquire/Build Maplibre Native Core Dependencies @@ -99,7 +99,7 @@ jobs: - name: Save vcpkg binary cache if: steps.vcpkg-cache.outputs.cache-hit != 'true' - uses: actions/cache/save@v4 + uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: ${{ github.workspace }}\platform\windows\vendor\vcpkg\archives key: vcpkg-${{ env.VCPKG_COMMIT_ID }} @@ -115,18 +115,18 @@ jobs: - run: | git config --system core.longpaths true - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3 with: languages: cpp - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 - - uses: mozilla-actions/sccache-action@v0.0.9 + - uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9 - name: Initialize sccache run: | @@ -139,7 +139,7 @@ jobs: Add-Content -Path $env:GITHUB_ENV -Value "VCPKG_COMMIT_ID=${vcpkg_commit_id}" - name: Restore vcpkg binary cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4 with: path: ${{ github.workspace }}\platform\windows\vendor\vcpkg\archives key: vcpkg-${{ env.VCPKG_COMMIT_ID }} @@ -163,7 +163,7 @@ jobs: # CodeQL - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3 with: category: "/language:cpp" @@ -227,7 +227,7 @@ jobs: - name: Upload render test result if: always() && steps.render_test.outcome == 'failure' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: render-test-result-${{ matrix.renderer }} path: | @@ -251,11 +251,11 @@ jobs: git config --system core.longpaths true git config --system core.autocrlf input - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 with: submodules: recursive - - uses: msys2/setup-msys2@v2 + - uses: msys2/setup-msys2@40677d36a502eb2cf0fb808cc9dec31bf6152638 # v2 with: msystem: ${{ matrix.msystem }} update: true @@ -274,11 +274,11 @@ jobs: libuv:p - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3 with: languages: cpp - - uses: mozilla-actions/sccache-action@v0.0.9 + - uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9 - name: Initialize sccache run: | @@ -303,7 +303,7 @@ jobs: # CodeQL - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3 with: category: "/language:cpp" @@ -367,7 +367,7 @@ jobs: - name: Upload render test result if: always() && steps.render_test.outcome == 'failure' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: render-test-result-${{ matrix.renderer }} path: |