feat: Pin sub-actions to full commit SHAs (#175 )

Pin sub-actions to full commit SHAs (#175 )
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rlespinasse <1280212+rlespinasse@users.noreply.github.com>
2026-05-18 05:05:02 +00:00 · 2026-02-04 10:46:51 +01:00 · 2026-02-04 10:37:36 +01:00 · 2025-11-26 00:49:56 +01:00 · 2025-10-19 23:37:27 +02:00 · 2025-08-29 17:32:02 +02:00
5 changed files with 25 additions and 24 deletions
--- a/.github/workflows/check-variables.yml
+++ b/.github/workflows/check-variables.yml
@@ -17,7 +17,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Load environment variables for testing
        uses: rlespinasse/github-slug-action@v5
@@ -102,7 +102,7 @@ jobs:

      - name: Create issue for mismatches
        if: steps.compare.outputs.has_mismatches == 'true' && github.event_name != 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -15,7 +15,7 @@ jobs:
      statuses: write
    steps:
      - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          # Full git history is needed to get a proper
          # list of changed files within `super-linter`
@@ -25,6 +25,7 @@ jobs:
        uses: super-linter/super-linter@v8
        env:
          VALIDATE_ALL_CODEBASE: false
+          VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
          VALIDATE_JSCPD: false
          VALIDATE_MARKDOWN_PRETTIER: false
          VALIDATE_YAML_PRETTIER: false
--- a/.github/workflows/v5-tests-and-release.yml
+++ b/.github/workflows/v5-tests-and-release.yml
@@ -11,7 +11,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Load this action from HEAD
        uses: ./
@@ -94,7 +94,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: this-action
          ref: ${{ github.ref }}
@@ -122,7 +122,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Load this action from HEAD
        uses: ./
@@ -207,7 +207,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: this-action
          ref: ${{ github.ref }}
@@ -230,7 +230,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      # Test 1
      - name: Using correct short length
@@ -269,7 +269,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: this-action
          ref: ${{ github.ref }}
@@ -323,7 +323,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      # Test 1
      - name: Using correct slug max length
@@ -395,7 +395,7 @@ jobs:
      - input-slug-maxlength
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Release this GitHub Action
        uses: rlespinasse/release-that@v1
        with:
--- a/README.md
+++ b/README.md
@@ -269,10 +269,10 @@ In Chinese :cn:
 [git-revparse]: https://git-scm.com/docs/git-rev-parse#Documentation/git-rev-parse.txt---shortlength
 [git-core-abbrev]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-coreabbrev

-[default-environment-variables]: https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+[default-environment-variables]: https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
 [dependabot]: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
 [webhooks-and-events]: https://docs.github.com/en/developers/webhooks-and-events/webhook-events-and-payloads
-[naming-conventions]: https://docs.github.com/en/actions/reference/environment-variables#naming-conventions-for-environment-variables
+[naming-conventions]: https://docs.github.com/en/actions/reference/workflows-and-actions/variables#naming-conventions-for-configuration-variables

 [article-1]: https://esensconsulting.medium.com/mettre-en-place-une-ci-cd-angular-avec-github-actions-netlify-ca0b59b99ed8
 [article-2]: https://michaelheap.com/github-slug-action/
--- a/action.yml
+++ b/action.yml
@@ -27,42 +27,42 @@ runs:
        INPUT_SHORT_LENGTH: ${{ inputs.short-length }}

    # From Environment Variables
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_REPOSITORY
        value: ${{ github.repository }}
        prefix: ${{ inputs.prefix }}
        slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_REF
        prefix: ${{ inputs.prefix }}
        slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_HEAD_REF
        prefix: ${{ inputs.prefix }}
        slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_BASE_REF
        prefix: ${{ inputs.prefix }}
        slug-maxlength: ${{ inputs.slug-maxlength }}

    # From Specific values
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_EVENT_REF
        value: ${{ github.event.ref }}
        prefix: ${{ inputs.prefix }}
        slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_REF_NAME
        value: ${{ github.ref_name }}
        prefix: ${{ inputs.prefix }}
        slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_REF_POINT
        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
@@ -82,7 +82,7 @@ runs:
          echo "::set-output name=github-repository-owner-part::${ownerpart}"
        fi
      shell: bash
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_REPOSITORY_OWNER_PART
        value: ${{ steps.get-github-repository-owner-part.outputs.github-repository-owner-part }}
@@ -97,7 +97,7 @@ runs:
          echo "::set-output name=github-repository-name-part::${namepart}"
        fi
      shell: bash
-    - uses: rlespinasse/slugify-value@v1.4.0
+    - uses: rlespinasse/slugify-value@a4879db1eb3db9bbee01dca36f98a8236c2b8239 # v1.4.0
      with:
        key: GITHUB_REPOSITORY_NAME_PART
        value: ${{ steps.get-github-repository-name-part.outputs.github-repository-name-part }}
@@ -105,13 +105,13 @@ runs:
        slug-maxlength: ${{ inputs.slug-maxlength }}

    # From sha
-    - uses: rlespinasse/shortify-git-revision@v1.6.0
+    - uses: rlespinasse/shortify-git-revision@c90ba7007ef6c152254d10b9f1a327966ab13077 # v1.6.0
      with:
        name: GITHUB_SHA
        short-on-error: true
        length: ${{ steps.prefligth.outputs.PREFLIGHT_SHORT_LENGTH }}
        prefix: ${{ inputs.prefix }}
-    - uses: rlespinasse/shortify-git-revision@v1.6.0
+    - uses: rlespinasse/shortify-git-revision@c90ba7007ef6c152254d10b9f1a327966ab13077 # v1.6.0
      with:
        name: GITHUB_EVENT_PULL_REQUEST_HEAD_SHA
        revision: ${{ github.event.pull_request.head.sha }}
Author	SHA1	Message	Date
Romain Lespinasse	9e7def6155	feat: Pin sub-actions to full commit SHAs (#175 )	2026-02-04 10:46:51 +01:00
Copilot	e8d233181c	Pin sub-actions to full commit SHAs (#175 ) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rlespinasse <1280212+rlespinasse@users.noreply.github.com>	2026-02-04 10:37:36 +01:00
dependabot[bot]	6f7a8d2348	feat: bump actions/checkout from 5 to 6 (#172 )	2025-11-26 00:49:56 +01:00
dependabot[bot]	ac4a3a2668	feat: bump actions/github-script from 7 to 8 (#170 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Romain Lespinasse <romain.lespinasse@gmail.com>	2025-10-19 23:37:27 +02:00
Romain Lespinasse	6772bda8f6	docs: fix moved links (#168 )	2025-08-29 17:32:02 +02:00
dependabot[bot]	846af0aca2	build(deps): bump actions/checkout from 4 to 5 in the dependencies group (#167 )	2025-08-20 19:16:48 +02:00