From 3d417d38d4a6e688372dab6d2e64f4481bdfe373 Mon Sep 17 00:00:00 2001 From: dagecko Date: Fri, 3 Apr 2026 20:26:52 -0400 Subject: [PATCH] fix: pin 19 unpinned action(s),extract 2 unsafe expression(s) to env vars (#7435) * fix: pin 19 unpinned action(s),extract 2 unsafe expression(s) to env vars * fix: correct SHA pins for rust-toolchain and esigner-codesign * fix: correct SHA pins for rust-toolchain and esigner-codesign --------- Co-authored-by: Danglewood <85772166+deeleeramone@users.noreply.github.com> --- .github/workflows/build-desktop-osx64.yml | 4 ++-- .github/workflows/build-desktop-osxARM.yml | 4 ++-- .github/workflows/build-desktop-win64.yml | 10 +++++----- .github/workflows/draft-release.yml | 2 +- .github/workflows/general-linting.yml | 6 ++++-- .github/workflows/gh-branch-name-check.yml | 2 +- .github/workflows/gh-pr-labels.yml | 4 ++-- .github/workflows/release-desktop.yml | 6 ++++-- .github/workflows/test-unit-desktop-osx64.yml | 2 +- .github/workflows/test-unit-desktop-osxARM.yml | 2 +- .github/workflows/test-unit-desktop-win64.yml | 2 +- .github/workflows/test-unit-desktop-winARM.yml | 2 +- 12 files changed, 25 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build-desktop-osx64.yml b/.github/workflows/build-desktop-osx64.yml index 70d99c18f6a..d2d592ce83b 100644 --- a/.github/workflows/build-desktop-osx64.yml +++ b/.github/workflows/build-desktop-osx64.yml @@ -28,7 +28,7 @@ jobs: uses: actions/checkout@v6 - name: Import Code Signing Certificate - uses: apple-actions/import-codesign-certs@v6 + uses: apple-actions/import-codesign-certs@fe74d46e82474f87e1ba79832ad28a4013d0e33a # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} @@ -64,7 +64,7 @@ jobs: run: npm install -g @cyclonedx/cyclonedx-npm - name: install Rust stable - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master with: targets: "x86_64-apple-darwin" diff --git a/.github/workflows/build-desktop-osxARM.yml b/.github/workflows/build-desktop-osxARM.yml index 67be0794a0e..3a6c1fc04f8 100644 --- a/.github/workflows/build-desktop-osxARM.yml +++ b/.github/workflows/build-desktop-osxARM.yml @@ -28,7 +28,7 @@ jobs: uses: actions/checkout@v6 - name: Import Code Signing Certificate - uses: apple-actions/import-codesign-certs@v6 + uses: apple-actions/import-codesign-certs@fe74d46e82474f87e1ba79832ad28a4013d0e33a # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} APPLE_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} @@ -64,7 +64,7 @@ jobs: run: npm install -g @cyclonedx/cyclonedx-npm - name: install Rust stable - uses: dtolnay/rust-toolchain@v1 + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: stable targets: "aarch64-apple-darwin" diff --git a/.github/workflows/build-desktop-win64.yml b/.github/workflows/build-desktop-win64.yml index 96167dac276..462b5f64ccf 100644 --- a/.github/workflows/build-desktop-win64.yml +++ b/.github/workflows/build-desktop-win64.yml @@ -86,7 +86,7 @@ jobs: run: New-Item -ItemType Directory -Force -Path "${{ github.workspace }}/desktop/temp-sign-dlls" - name: Sign libcrypto DLL - uses: sslcom/esigner-codesign@develop + uses: sslcom/esigner-codesign@cf5f6c1d38ad10f47e3ed9aca873f429b1a8d85b # v1.3.2 with: command: sign username: ${{ secrets.ESIGNER_USERNAME }} @@ -98,7 +98,7 @@ jobs: malware_block: false - name: Sign libssl DLL - uses: sslcom/esigner-codesign@develop + uses: sslcom/esigner-codesign@cf5f6c1d38ad10f47e3ed9aca873f429b1a8d85b # v1.3.2 with: command: sign username: ${{ secrets.ESIGNER_USERNAME }} @@ -126,7 +126,7 @@ jobs: run: npm install -g @cyclonedx/cyclonedx-npm - name: Set up Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master - name: Cache cargo registry uses: actions/cache@v5 @@ -183,7 +183,7 @@ jobs: run: New-Item -ItemType Directory -Force -Path "${{ github.workspace }}/desktop/temp-sign" - name: Sign the executable - uses: sslcom/esigner-codesign@develop + uses: sslcom/esigner-codesign@cf5f6c1d38ad10f47e3ed9aca873f429b1a8d85b # v1.3.2 with: command: sign username: ${{ secrets.ESIGNER_USERNAME }} @@ -218,7 +218,7 @@ jobs: run: New-Item -ItemType Directory -Force -Path "${{ github.workspace }}/desktop/signed-installer" - name: Sign Installer - uses: sslcom/esigner-codesign@v1.3.2 + uses: sslcom/esigner-codesign@cf5f6c1d38ad10f47e3ed9aca873f429b1a8d85b # v1.3.2 with: command: sign username: ${{ secrets.ESIGNER_USERNAME }} diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml index 9ea17afcce2..90a9d394a9f 100644 --- a/.github/workflows/draft-release.yml +++ b/.github/workflows/draft-release.yml @@ -66,7 +66,7 @@ jobs: echo "assets_path=./release_assets" >> $GITHUB_OUTPUT - name: Create VERSIONED release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 with: tag_name: ${{ steps.extract_version.outputs.versioned_tag }} name: ${{ steps.extract_version.outputs.release_name }} diff --git a/.github/workflows/general-linting.yml b/.github/workflows/general-linting.yml index fa04d2edbab..93aa9d54838 100644 --- a/.github/workflows/general-linting.yml +++ b/.github/workflows/general-linting.yml @@ -47,9 +47,11 @@ jobs: if: github.event_name == 'pull_request' run: | # "Checking PR diff" - echo "diff_files=$(git diff --diff-filter=d --name-only origin/${{ github.base_ref }}...${{ github.head_ref }} | grep -E '^(openbb_platform|cli)/.*\.py$' | grep -v 'openbb_platform/core/openbb/package' | grep -v 'integration' | grep -v 'tests' | xargs)" >> $GITHUB_ENV + echo "diff_files=$(git diff --diff-filter=d --name-only origin/${{ github.base_ref }}...${HEAD_REF} | grep -E '^(openbb_platform|cli)/.*\.py$' | grep -v 'openbb_platform/core/openbb/package' | grep -v 'integration' | grep -v 'tests' | xargs)" >> $GITHUB_ENV echo $diff_files + env: + HEAD_REF: ${{ github.head_ref }} - uses: actions/cache@v5 with: path: ~/.cache/pip @@ -94,7 +96,7 @@ jobs: - name: json-yaml-validate id: json-yaml-validate - uses: GrantBirki/json-yaml-validate@v4 + uses: GrantBirki/json-yaml-validate@9bbaa8474e3af4e91f25eda8ac194fdc30564d96 # v4 with: yaml_exclude_regex: "construct.yaml" use_gitignore: false diff --git a/.github/workflows/gh-branch-name-check.yml b/.github/workflows/gh-branch-name-check.yml index c1daab84c0e..3fe6f926188 100644 --- a/.github/workflows/gh-branch-name-check.yml +++ b/.github/workflows/gh-branch-name-check.yml @@ -23,7 +23,7 @@ jobs: - name: Get branch names. id: branch-names - uses: tj-actions/branch-names@v9 + uses: tj-actions/branch-names@5250492686b253f06fa55861556d1027b067aeb5 # v9 - name: Show Output result for source-branch and target-branch run: | diff --git a/.github/workflows/gh-pr-labels.yml b/.github/workflows/gh-pr-labels.yml index 93ba7ebf036..3973335cac0 100644 --- a/.github/workflows/gh-pr-labels.yml +++ b/.github/workflows/gh-pr-labels.yml @@ -16,13 +16,13 @@ jobs: # mode: minimum # count: 1 # labels: "guides, bug, build, docker, docs, feat XS, feat S, feat M, feat L, feat XL, help wanted, refactor, tests, dependencies, release" - - uses: mheap/github-action-required-labels@v5 + - uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5 with: mode: exactly count: 0 labels: "do not merge" - name: 🏷️ Label OpenBB Platform PRs - uses: srvaroa/labeler@master + uses: srvaroa/labeler@e8fbb2561481ef6e711a770f0234e9379dc76892 # master env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index 763cac15748..5157b22cfed 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -25,9 +25,11 @@ jobs: if [ "${{ github.event_name }}" == "release" ]; then echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT else - echo "tag=${{ github.event.inputs.tag_name }}" >> $GITHUB_OUTPUT + echo "tag=${INPUT_TAG_NAME}" >> $GITHUB_OUTPUT fi + env: + INPUT_TAG_NAME: ${{ github.event.inputs.tag_name }} - name: Download release artifacts from published release run: | mkdir -p artifacts @@ -146,7 +148,7 @@ jobs: cat latest.json - name: Create ODP release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 with: tag_name: ODP name: ODP Desktop (Latest Stable) diff --git a/.github/workflows/test-unit-desktop-osx64.yml b/.github/workflows/test-unit-desktop-osx64.yml index 02d92feb51b..d11781f9f96 100644 --- a/.github/workflows/test-unit-desktop-osx64.yml +++ b/.github/workflows/test-unit-desktop-osx64.yml @@ -28,7 +28,7 @@ jobs: node-version: lts/* - name: Set up Rust - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: stable profile: minimal diff --git a/.github/workflows/test-unit-desktop-osxARM.yml b/.github/workflows/test-unit-desktop-osxARM.yml index d82c9b7259c..8e4a5620a61 100644 --- a/.github/workflows/test-unit-desktop-osxARM.yml +++ b/.github/workflows/test-unit-desktop-osxARM.yml @@ -28,7 +28,7 @@ jobs: node-version: lts/* - name: Set up Rust - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: stable profile: minimal diff --git a/.github/workflows/test-unit-desktop-win64.yml b/.github/workflows/test-unit-desktop-win64.yml index 8ee8b76151f..2d71c396cfd 100644 --- a/.github/workflows/test-unit-desktop-win64.yml +++ b/.github/workflows/test-unit-desktop-win64.yml @@ -60,7 +60,7 @@ jobs: node-version: lts/* - name: Set up Rust - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: stable profile: minimal diff --git a/.github/workflows/test-unit-desktop-winARM.yml b/.github/workflows/test-unit-desktop-winARM.yml index a494fad837f..74a6c7fcaf2 100644 --- a/.github/workflows/test-unit-desktop-winARM.yml +++ b/.github/workflows/test-unit-desktop-winARM.yml @@ -60,7 +60,7 @@ jobs: node-version: lts/* - name: Set up Rust - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: stable profile: minimal