From: Darren Tucker Date: Mon, 22 Jun 2026 09:00:15 +0000 (+1000) Subject: Add script to lookup and pin Actions to hashes. X-Git-Tag: V_10_4_P1~69 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=01404fa5da11ed08c6ebecd09aaa3ebfbd79f206;p=thirdparty%2Fopenssh-portable.git Add script to lookup and pin Actions to hashes. Update recently changed Cygwin Actions and pin remaining unpinned ones. --- diff --git a/.github/pin_actions.sh b/.github/pin_actions.sh new file mode 100755 index 000000000..cb175f250 --- /dev/null +++ b/.github/pin_actions.sh @@ -0,0 +1,33 @@ +#!/bin/sh +# +# Look up specified version of Github Actions an pin to that specific +# revision. +# + +set -e + +github=https://github.com + +for workflow in workflows/*.yml; do + echo workflow: $workflow + sed 's/ - / /' ${workflow} | grep -v '^#' | awk '/uses:/ {print}' | \ + while read line; do + action_ver=$(awk '{print $2}' <<<${line}) + action=$(cut -f1 -d@ <<<${action_ver}) + ver=$(cut -f2 -d@ <<<${action_ver}) + intendedver=$(awk '{print $4}' <<<${line}) + if [ -z "${intendedver}" ]; then + intendedver=${ver} + fi + case "${action}" in + google/oss-fuzz/*) actiondir=google/oss-fuzz ;; + *) actiondir="${action}" ;; + esac + if [ ! -d /tmp/${actiondir} ]; then + git clone ${github}/${actiondir} /tmp/${actiondir} + fi + hash=$(cd /tmp/${actiondir} && git rev-parse ${intendedver}) + sed -i -e "s|uses: ${action}@.*|uses: ${action}@${hash} # ${intendedver}|" \ + ${workflow} + done +done diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index 4ddaf0fc1..44be98e19 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -134,10 +134,10 @@ jobs: - name: install cygwin id: cygwin_install if: ${{ startsWith(matrix.target, 'windows') }} - uses: cygwin/cygwin-install-action@4ef15ca7fd18a18f1000989fcfd968e06d146ce8 # master + uses: cygwin/cygwin-install-action@a3d72946b163026bbd0fa9a88379ccbda4bd86bb # master env: CYGWIN: "winsymlinks:native" - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: setup CI system run: | sh -c "timeout 1200 .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }} || .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}" diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index ab8b1c6e0..286b39c12 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -12,20 +12,20 @@ jobs: steps: - name: Build Fuzzers id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master with: oss-fuzz-project-name: 'openssh' dry-run: false language: c++ - name: Run Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master with: oss-fuzz-project-name: 'openssh' fuzz-seconds: 600 dry-run: false language: c++ - name: Upload Crash - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main if: failure() && steps.build.outcome == 'success' with: name: artifacts diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 008fa60f8..d9f38472c 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -105,7 +105,7 @@ jobs: - name: shutdown VM if running if: env.VM == 'true' run: vmshutdown - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: autoreconf - name: startup VM @@ -119,7 +119,7 @@ jobs: - name: configure run: vmrun ./.github/configure.sh ${{ matrix.config }} # - name: save config -# uses: actions/upload-artifact@main +# uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main # with: # name: ${{ matrix.target }}-${{ matrix.config }}-config # path: config.h @@ -135,7 +135,7 @@ jobs: run: vmrun 'for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done' - name: save logs if: failure() - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main with: name: ${{ matrix.target }}-${{ matrix.config }}-logs path: | @@ -184,7 +184,7 @@ jobs: - name: bigendian interop - save logs if: failure() && env.BIGENDIAN == 'true' - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main with: name: ${{ matrix.target }}-${{ matrix.config }}-interop-logs path: | diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml index 867573251..74a0bc8ba 100644 --- a/.github/workflows/upstream.yml +++ b/.github/workflows/upstream.yml @@ -36,7 +36,7 @@ jobs: - name: shutdown VM if running run: vmshutdown working-directory: ${{ runner.temp }} - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: startup VM run: vmstartup working-directory: ${{ runner.temp }} diff --git a/.github/workflows/vm.yml b/.github/workflows/vm.yml index 2aaab0980..023528571 100644 --- a/.github/workflows/vm.yml +++ b/.github/workflows/vm.yml @@ -23,12 +23,12 @@ jobs: config: [default] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: sh -c autoreconf - name: start DragonFlyBSD ${{ matrix.target }} VM - uses: vmactions/dragonflybsd-vm@v1 + uses: vmactions/dragonflybsd-vm@4ba8127bd95c94b66fc4b885e37c99955ba308ea # v1 with: release: ${{ matrix.target }} usesh: true @@ -86,12 +86,12 @@ jobs: config: [default] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: sh -c autoreconf - name: start FreeBSD ${{ matrix.target }} VM - uses: vmactions/freebsd-vm@v1 + uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1 with: release: ${{ matrix.target }} usesh: true @@ -168,12 +168,12 @@ jobs: config: [default] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: sh -c autoreconf - name: start NetBSD ${{ matrix.target }} VM - uses: vmactions/netbsd-vm@v1 + uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1 with: release: ${{ matrix.target }} usesh: true @@ -243,12 +243,12 @@ jobs: config: [default] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: sh -c autoreconf - name: start OmniOS ${{ matrix.target }} VM - uses: vmactions/omnios-vm@v1 + uses: vmactions/omnios-vm@7f2be0b927aad1a78498c8aeeac4c4ce1fabd322 # v1 with: release: ${{ matrix.target }} usesh: true @@ -300,12 +300,12 @@ jobs: config: [default] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: sh -c autoreconf - name: start OpenBSD ${{ matrix.target }} VM - uses: vmactions/openbsd-vm@v1 + uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1 with: release: ${{ matrix.target }} usesh: true @@ -349,7 +349,7 @@ jobs: runs-on: ubuntu-latest steps: - name: start OpenBSD VM - uses: vmactions/openbsd-vm@v1 + uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1 with: copyback: false nat: | @@ -371,7 +371,7 @@ jobs: echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV - name: check for cached sysupgrade id: cache-sysupgrade - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }} path: /tmp/_sysupgrade/ @@ -391,7 +391,7 @@ jobs: rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/ - name: save sysupgrade to cache if: steps.cache-sysupgrade.outputs.cache-hit != 'true' - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }} path: /tmp/_sysupgrade/ @@ -431,7 +431,7 @@ jobs: for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done - name: save logs if: failure() - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main with: name: openbsd-current-upstream-logs path: regress-logs/*.log @@ -449,12 +449,12 @@ jobs: config: [default] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main - name: autoreconf run: sh -c autoreconf - name: start Solaris ${{ matrix.target }} VM - uses: vmactions/solaris-vm@v1 + uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1 with: release: ${{ matrix.target }} usesh: true