From a189a34f88fe01f1e2da83bc0078c701ef74a225 Mon Sep 17 00:00:00 2001 From: Robert Hebel Date: Thu, 6 Aug 2026 10:20:54 +0200 Subject: [PATCH 1/2] chore(ci): pin 3rd party github actions --- .github/workflows/dependabot-merge.yml | 4 +- .github/workflows/deploy-gh-pages.yml | 53 ------------------------- .github/workflows/docker-build-push.yml | 10 ++--- .github/workflows/release.yml | 4 +- 4 files changed, 9 insertions(+), 62 deletions(-) delete mode 100644 .github/workflows/deploy-gh-pages.yml diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml index 24b57041df7..5f85d539162 100644 --- a/.github/workflows/dependabot-merge.yml +++ b/.github/workflows/dependabot-merge.yml @@ -14,7 +14,7 @@ jobs: # will not occur. - name: Dependabot metadata id: dependabot-metadata - uses: dependabot/fetch-metadata@v3.1.0 + uses: dependabot/fetch-metadata@7a4b92f93a688100997537756415299e15fc2431 with: github-token: "${{ secrets.GITHUB_TOKEN }}" # Here the PR gets approved. @@ -27,7 +27,7 @@ jobs: # Finally, tell dependabot to merge the PR if all checks are successful - name: Instruct dependabot to squash & merge if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }} - uses: mshick/add-pr-comment@v3 + uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 with: repo-token: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }} allow-repeats: true diff --git a/.github/workflows/deploy-gh-pages.yml b/.github/workflows/deploy-gh-pages.yml deleted file mode 100644 index ea72aaf26d2..00000000000 --- a/.github/workflows/deploy-gh-pages.yml +++ /dev/null @@ -1,53 +0,0 @@ -# inspired by https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ -name: Deploy SwaggerEditor to GitHub Pages - -on: - workflow_run: - workflows: ["SwaggerEditor build", "SwaggerEditor nightly build"] - types: - - completed - branches: [main] - -jobs: - - deploy: - if: > - github.event.workflow_run.event == 'push' && - github.event.workflow_run.conclusion == 'success' - name: Deploy SwaggerEditor to GitHub Pages - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v7 - with: - ref: main - - name: 'Download build artifact' - uses: actions/github-script@v9 - with: - script: | - const allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.payload.workflow_run.id, - }); - const matchArtifact = allArtifacts.data.artifacts.filter((artifact) => { - return artifact.name == "build" - })[0]; - const download = await github.rest.actions.downloadArtifact({ - owner: context.repo.owner, - repo: context.repo.repo, - artifact_id: matchArtifact.id, - archive_format: 'zip', - }); - const fs = require('fs'); - fs.writeFileSync('${{github.workspace}}/build.zip', Buffer.from(download.data)); - - run: | - mkdir deploy-dir - unzip build.zip -d deploy-dir - - name: Deploy 🚀 - uses: JamesIves/github-pages-deploy-action@v4.8.0 - with: - token: ${{ secrets.GITHUB_TOKEN }} - branch: gh-pages # The branch the action should deploy to. - folder: deploy-dir # The folder the action should deploy. - clean: true # Automatically remove deleted files from the deploy branch diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml index 6d7c3ed27af..e8961e5c6c8 100644 --- a/.github/workflows/docker-build-push.yml +++ b/.github/workflows/docker-build-push.yml @@ -60,19 +60,19 @@ jobs: echo "RELEASED_VERSION=$RELEASED_VERSION" >> $GITHUB_ENV - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@288220e341e5c445ddb6d73e19a57a9012ceca88 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@5b9cf3909b54a280b6df6eee035755eb1f2fd611 - name: Log in to DockerHub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: username: ${{ secrets.DOCKERHUB_SB_USERNAME }} password: ${{ secrets.DOCKERHUB_SB_PASSWORD }} - name: Build docker image and push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@9b5c9c8d06fe26aec48c0a61bc597f93f56cdebc with: context: . push: true @@ -81,7 +81,7 @@ jobs: tags: swaggerapi/swagger-editor:latest,swaggerapi/swagger-editor:v${{ env.RELEASED_VERSION }} - name: Build unprivileged docker image and push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@9b5c9c8d06fe26aec48c0a61bc597f93f56cdebc with: context: . file: Dockerfile.unprivileged diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4da84518f4a..015651958f8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: node-version-file: .nvmrc - name: Determine the next release version - uses: cycjimmy/semantic-release-action@v6 + uses: cycjimmy/semantic-release-action@71b2ac36ece276d61489147b9d5de3cf0d13fad8 with: semantic_version: v24.2.3 dry_run: true @@ -58,7 +58,7 @@ jobs: - name: Semantic Release id: semantic - uses: cycjimmy/semantic-release-action@v6 + uses: cycjimmy/semantic-release-action@71b2ac36ece276d61489147b9d5de3cf0d13fad8 with: dry_run: false extra_plugins: | From 4e9941c05f98d2eea51dbab3906380a68a5e493f Mon Sep 17 00:00:00 2001 From: Robert Hebel Date: Thu, 6 Aug 2026 13:51:53 +0200 Subject: [PATCH 2/2] chore(ci): pin 3rd party github actions --- .github/workflows/docker-build-push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml index e8961e5c6c8..7595f3674bb 100644 --- a/.github/workflows/docker-build-push.yml +++ b/.github/workflows/docker-build-push.yml @@ -72,7 +72,7 @@ jobs: password: ${{ secrets.DOCKERHUB_SB_PASSWORD }} - name: Build docker image and push - uses: docker/build-push-action@9b5c9c8d06fe26aec48c0a61bc597f93f56cdebc + uses: docker/build-push-action@b9769986761dfcf8828a58eadbd440d1738476f9 with: context: . push: true @@ -81,7 +81,7 @@ jobs: tags: swaggerapi/swagger-editor:latest,swaggerapi/swagger-editor:v${{ env.RELEASED_VERSION }} - name: Build unprivileged docker image and push - uses: docker/build-push-action@9b5c9c8d06fe26aec48c0a61bc597f93f56cdebc + uses: docker/build-push-action@b9769986761dfcf8828a58eadbd440d1738476f9 with: context: . file: Dockerfile.unprivileged