OpenCHAMI / ochami / 39824001633
93%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 207
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 92.573%. Remained the same
39824001633

push

github

web-flow 
ci: pin GitHub Actions to commit SHAs (#212)

* ci: pin GitHub Actions to commit SHAs

Most workflow steps referenced external actions by mutable major tags
such as actions/checkout@v7. A tag can be moved upstream, changing the
code CI executes without any change to this repository, including in
release jobs that hold publishing and attestation permissions.

Pin every remaining tag-based reference to a full 40-character commit
SHA with an exact release comment, matching the pattern scorecard.yaml
and coverage.yaml already use. Each SHA is the commit its major tag
pointed to when pinned, cross-checked against the exact release tag at
that commit, so CI runs the same code as before:

  actions/checkout                   v7.0.1
  actions/setup-go                   v7.0.0
  actions/setup-node                 v7.1.0
  docker/setup-buildx-action         v4.4.1
  docker/login-action                v4.6.0
  goreleaser/goreleaser-action       v7.3.0
  golangci/golangci-lint-action      v9.3.0
  actions/attest-build-provenance    v4.2.2
  github/codeql-action/upload-sarif  v4.39.1

The actions/checkout SHA is the same one scorecard.yaml already pins.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

* build(renovate): pin GitHub Actions digests

Neither config:recommended nor the inherited OpenCHAMI preset enables
digest pinning for GitHub Actions, so a newly added tag-based uses:
reference would stay unpinned until someone noticed by hand.

Extend helpers:pinGitHubActionDigests so Renovate pins new references to
commit SHAs. For references already pinned as "@<sha> # vX.Y.Z", the
github-actions manager reads the release comment as the current version
and updates the SHA and comment together.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

* test(conventions): require pinned actions

Pinning the workflows once doesn't keep them pinned: a later change can
reintroduce a tag-based reference, and nothing in CI w... (continued)

12938 of 13976 relevant lines covered (92.57%)

541.13 hits per line

Jobs
ID Job ID Ran Files Coverage
1 39824001633.1 207
92.57
GitHub Action Run
Source Files on build 39824001633