diff --git a/.github/actions/setup-nix/action.yaml b/.github/actions/setup-nix/action.yaml index b8f35b3ee..1f41aaf05 100644 --- a/.github/actions/setup-nix/action.yaml +++ b/.github/actions/setup-nix/action.yaml @@ -11,10 +11,10 @@ inputs: runs: using: composite steps: - - uses: cachix/install-nix-action@v23 + - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25 with: install_url: https://releases.nixos.org/nix/nix-2.13.3/install - - uses: cachix/cachix-action@v12 + - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14 with: name: postgrest authToken: ${{ inputs.authToken }} diff --git a/.github/scripts/arm/docker-env/Dockerfile b/.github/scripts/arm/docker-env/Dockerfile index b94fcaaee..d0a39a91b 100644 --- a/.github/scripts/arm/docker-env/Dockerfile +++ b/.github/scripts/arm/docker-env/Dockerfile @@ -1,6 +1,6 @@ # PostgREST docker hub image -FROM ubuntu:focal AS postgrest +FROM ubuntu:jammy@sha256:f9d633ff6640178c2d0525017174a688e2c1aef28f0a0130b26bd5554491f0da AS postgrest RUN apt-get update -y \ && apt install -y --no-install-recommends libpq-dev zlib1g-dev jq gcc libnuma-dev \ diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 56a2176b4..581fa5765 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -116,7 +116,7 @@ jobs: - name: Check static executable run: postgrest-check-static result/bin/postgrest - name: Save built executable as artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: postgrest-linux-static-x64 path: result/bin/postgrest @@ -125,7 +125,7 @@ jobs: - name: Build Docker image run: nix-build -A docker.image --out-link postgrest-docker.tar.gz - name: Save built Docker image as artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: postgrest-docker-x64 path: postgrest-docker.tar.gz @@ -178,7 +178,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: Stack working files cache - uses: actions/cache@v3 + uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4 with: path: ${{ matrix.cache }} key: ${{ runner.os }}-${{ hashFiles('stack.yaml.lock') }} @@ -188,7 +188,7 @@ jobs: - name: Build with Stack run: stack build --local-bin-path result --copy-bins - name: Save built executable as artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: ${{ matrix.artifact }} path: | @@ -208,7 +208,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: .github/get_cirrusci_freebsd - name: Save executable as artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: postgrest-freebsd-x64 path: postgrest @@ -234,7 +234,7 @@ jobs: run: | cp cabal.project.non-nix cabal.project - name: Cache - uses: actions/cache@v3 + uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4 with: path: ~/.cabal key: ${{ runner.os }}-${{ matrix.ghc }}-${{ hashFiles('**/*.cabal') }}-${{ hashFiles('**/cabal.project') }} @@ -301,7 +301,7 @@ jobs: - name: Extract downloaded binaries run: tar -xvf result.tar.xz && rm result.tar.xz - name: Save aarch64 executable as artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: postgrest-ubuntu-aarch64 path: result/postgrest @@ -362,7 +362,7 @@ jobs: echo "Relevant extract from CHANGELOG.md:" cat CHANGES.md - name: Save CHANGES.md as artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: release-changes path: CHANGES.md @@ -380,7 +380,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: Download all artifacts - uses: actions/download-artifact@v3 + uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4 with: path: artifacts - name: Create release bundle with archives for all builds @@ -410,7 +410,7 @@ jobs: artifacts/postgrest-windows-x64/postgrest.exe - name: Save release bundle - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: release-bundle path: release-bundle @@ -449,7 +449,7 @@ jobs: with: tools: release - name: Download Docker image - uses: actions/download-artifact@v3 + uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4 with: name: postgrest-docker-x64 - name: Publish images on Docker Hub diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 3319799f9..cdd8a2c4c 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -15,8 +15,8 @@ jobs: name: Build docs runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: cachix/install-nix-action@v22 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25 - run: nix-env -f docs/default.nix -iA build - run: postgrest-docs-build @@ -24,8 +24,8 @@ jobs: name: Run spellcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: cachix/install-nix-action@v22 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25 - run: nix-env -f docs/default.nix -iA spellcheck - run: postgrest-docs-spellcheck @@ -33,8 +33,8 @@ jobs: name: Run dictcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: cachix/install-nix-action@v22 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25 - run: nix-env -f docs/default.nix -iA dictcheck - run: postgrest-docs-dictcheck @@ -43,8 +43,8 @@ jobs: if: github.base_ref == 'main' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: cachix/install-nix-action@v22 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25 - run: nix-env -f docs/default.nix -iA linkcheck - run: postgrest-docs-linkcheck diff --git a/.github/workflows/loadtest.yaml b/.github/workflows/loadtest.yaml index 9a2e83aa8..26146dc9e 100644 --- a/.github/workflows/loadtest.yaml +++ b/.github/workflows/loadtest.yaml @@ -27,7 +27,7 @@ jobs: postgrest-loadtest-against main postgrest-loadtest-report > loadtest/loadtest.md - name: Upload report - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4 with: name: loadtest.md path: loadtest/loadtest.md diff --git a/.github/workflows/report.yaml b/.github/workflows/report.yaml index 4305a3bdf..ce5782b56 100644 --- a/.github/workflows/report.yaml +++ b/.github/workflows/report.yaml @@ -22,7 +22,7 @@ jobs: name: loadtest.md path: artifacts - name: Upload to GitHub Checks - uses: LouisBrunner/checks-action@v1.6.2 + uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} sha: ${{ github.event.workflow_run.head_sha }}