From 821a2809a8a37055f7e1c4f91d2b597334bc4fc6 Mon Sep 17 00:00:00 2001 From: dagecko Date: Tue, 31 Mar 2026 10:24:58 +0200 Subject: [PATCH 1/3] fix: extract inline secret from run block in ci.yml --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 705fd7bc4..2c30eb66a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -206,10 +206,12 @@ jobs: - name: Upload to Codacy run: | - CODACY_PROJECT_TOKEN=${{ secrets.CODACY_PROJECT_TOKEN }} \ + CODACY_PROJECT_TOKEN="${CODACY_PROJECT_TOKEN}" \ bash <(curl -Ls https://coverage.codacy.com/get.sh) report \ --force-coverage-parser go -r coverage.out + env: + CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} check-for-fixups: runs-on: ubuntu-latest if: github.ref != 'refs/heads/master' From 35db80f1509acec34083aad0ed1408e2f05eaaa1 Mon Sep 17 00:00:00 2001 From: dagecko Date: Mon, 30 Mar 2026 19:45:51 -0400 Subject: [PATCH 2/3] fix: pin 7 unpinned action(s) to commit SHAs --- .github/workflows/check-required-label.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/codespell.yml | 4 ++-- .github/workflows/release.yml | 2 +- .github/workflows/sponsors.yml | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/check-required-label.yml b/.github/workflows/check-required-label.yml index 8a2090da7..a7e1d97c7 100644 --- a/.github/workflows/check-required-label.yml +++ b/.github/workflows/check-required-label.yml @@ -8,7 +8,7 @@ jobs: check-required-label: runs-on: ubuntu-latest steps: - - uses: mheap/github-action-required-labels@v5 + - uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5 with: mode: exactly count: 1 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2c30eb66a..be810104e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -168,7 +168,7 @@ jobs: with: go-version: 1.25.x - name: Lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9 with: # If you change this, make sure to also update scripts/golangci-lint-shim.sh version: v2.4.0 diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index ef98d3f0c..8d7b4eb18 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -20,6 +20,6 @@ jobs: - name: Checkout uses: actions/checkout@v6 - name: Annotate locations with typos - uses: codespell-project/codespell-problem-matcher@v1 + uses: codespell-project/codespell-problem-matcher@b80729f885d32f78a716c2f107b4db1025001c42 # v1 - name: Codespell - uses: codespell-project/actions-codespell@v2 + uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9cd59863f..7c7a890c6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -152,7 +152,7 @@ jobs: go-version: 1.25.x - name: Run goreleaser - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6 with: distribution: goreleaser version: v2 diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml index cdb2ce24d..645e554de 100644 --- a/.github/workflows/sponsors.yml +++ b/.github/workflows/sponsors.yml @@ -13,13 +13,13 @@ jobs: uses: actions/checkout@v6 - name: Generate Sponsors 💖 - uses: JamesIves/github-sponsors-readme-action@v1.2.2 + uses: JamesIves/github-sponsors-readme-action@a2d75a8d58b117b19777a910e284ccb082aaf117 # v1.2.2 with: token: ${{ secrets.SPONSORS_TOKEN }} file: "README.md" - name: Create Pull Request 🚀 - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8 with: commit-message: "README.md: Update Sponsors" title: "README.md: Update Sponsors" From 82ff9495ed7252ecec1cfdb64a2c4df826a25716 Mon Sep 17 00:00:00 2001 From: Stefan Haller Date: Tue, 31 Mar 2026 10:52:04 +0200 Subject: [PATCH 3/3] Update all actions to their newest versions --- .github/workflows/codespell.yml | 4 ++-- .github/workflows/release.yml | 2 +- .github/workflows/sponsors.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 8d7b4eb18..27cbea555 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -20,6 +20,6 @@ jobs: - name: Checkout uses: actions/checkout@v6 - name: Annotate locations with typos - uses: codespell-project/codespell-problem-matcher@b80729f885d32f78a716c2f107b4db1025001c42 # v1 + uses: codespell-project/codespell-problem-matcher@9ba2c57125d4908eade4308f32c4ff814c184633 # v1.2.0 - name: Codespell - uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2 + uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7c7a890c6..eb18163f0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -152,7 +152,7 @@ jobs: go-version: 1.25.x - name: Run goreleaser - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6 + uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0 with: distribution: goreleaser version: v2 diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml index 645e554de..1b8f3fae0 100644 --- a/.github/workflows/sponsors.yml +++ b/.github/workflows/sponsors.yml @@ -13,7 +13,7 @@ jobs: uses: actions/checkout@v6 - name: Generate Sponsors 💖 - uses: JamesIves/github-sponsors-readme-action@a2d75a8d58b117b19777a910e284ccb082aaf117 # v1.2.2 + uses: JamesIves/github-sponsors-readme-action@2fd9142e765f755780202122261dc85e78459405 # v1.6.0 with: token: ${{ secrets.SPONSORS_TOKEN }} file: "README.md"