From: Dmitry Misharov Date: Mon, 31 Mar 2025 15:15:42 +0000 (+0200) Subject: pin GitHub Actions revisions from untrusted vendors X-Git-Tag: openssl-3.3.5~80 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=594190e39cfd1c7da4b03639209fa76c1b6503c8;p=thirdparty%2Fopenssl.git pin GitHub Actions revisions from untrusted vendors Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický (Merged from https://github.com/openssl/openssl/pull/27212) --- diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0fe118231dc..4d30e01c4c6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -150,7 +150,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -159,21 +159,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -624,7 +624,7 @@ jobs: sudo apt-get update sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install cpanm and Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d #v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -666,7 +666,7 @@ jobs: uses: actions/setup-python@v5.3.0 with: python-version: ${{ matrix.PYTHON }} - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: toolchain: ${{ matrix.RUST }} - name: get cpu info @@ -686,7 +686,7 @@ jobs: run: ./config --banner=Configured --strict-warnings enable-external-tests && perl configdata.pm --dump - name: make run: make -s -j4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 - name: get cpu info run: | cat /proc/cpuinfo diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml index 90d72dde741..3f32587a1b8 100644 --- a/.github/workflows/coveralls.yml +++ b/.github/workflows/coveralls.yml @@ -50,7 +50,7 @@ jobs: sudo apt-get -yq install lcov sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d #v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -76,7 +76,7 @@ jobs: --exclude "/usr/include/*" -o ./lcov.info - name: Coveralls upload - uses: coverallsapp/github-action@v2.3.2 + uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b #v2.3.6 with: github-token: ${{ secrets.github_token }} git-branch: ${{ matrix.branches.branch }} diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml index a404cdd013d..8972a6d68da 100644 --- a/.github/workflows/os-zoo.yml +++ b/.github/workflows/os-zoo.yml @@ -141,11 +141,11 @@ jobs: ref: ${{ matrix.branch }} - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -158,7 +158,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -192,7 +192,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -201,21 +201,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index a09644dd7d3..ce7e727f908 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 with: arch: ${{ matrix.platform.arch }} - name: install nasm @@ -50,7 +50,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -84,7 +84,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -96,7 +96,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -120,7 +120,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -132,7 +132,7 @@ jobs: working-directory: _build run: nmake # verbose, so no /S here - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -167,7 +167,7 @@ jobs: steps: # Checkout before cygwin can mess with PATH... - uses: actions/checkout@v4 - - uses: cygwin/cygwin-install-action@master + - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 #v5 with: packages: perl git make gcc-core - name: Check repo diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml index e520521888e..0cb09c7a7c2 100644 --- a/.github/workflows/windows_comp.yml +++ b/.github/workflows/windows_comp.yml @@ -25,11 +25,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get zstd @@ -45,7 +45,7 @@ jobs: working-directory: _build run: nmake - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -70,11 +70,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get brotli @@ -90,7 +90,7 @@ jobs: working-directory: _build run: nmake - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/