From f5dc1c1ad32d1df08ceb40f590d1b1952dbb4a2d Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 23 Sep 2026 12:50:09 +0000
Subject: [PATCH] Add dependabot config and pin GitHub Actions to a commit SHA (#1073)
---
.github/workflows/deploy.yml | 34 +++++++++++++++++-----------------
1 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4178010..34cfeb1 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -54,7 +54,7 @@
run: |
sudo apt-get update
sudo apt-get install -y rpm
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
submodules: recursive
@@ -82,7 +82,7 @@
# not start new workflow runs, so this cannot loop; a PAT would break that.
- name: Download the launchers built by the triggering Build run
continue-on-error: true
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: windows-exe-11
run-id: ${{ github.event.workflow_run.id }}
@@ -176,7 +176,7 @@
done
echo "::warning title=Could not refresh the launcher binaries::$BRANCH kept moving under this job. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them."
- name: Set up Java for publishing to Maven Central Repository OSS
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
distribution: 'temurin'
@@ -184,7 +184,7 @@
server-username: MAVEN_USERNAME
server-password: MAVEN_PASSWORD
- name: Cache Maven packages
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -214,22 +214,22 @@
continue-on-error: true
run: mvn javadoc:aggregate
- name: Upload artifacts OpenDJ Server
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Server
path: opendj-server-legacy/target/package/*.zip
- name: Upload artifacts OpenDJ SDK Toolkit
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ SDK Toolkit
path: opendj-ldap-toolkit/target/*.zip
- name: Upload artifacts OpenDJ Debian Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Debian Package
path: opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb
- name: Upload artifacts OpenDJ RPM Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ RPM Package
path: opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm
@@ -237,7 +237,7 @@
# Build run (windows-latest-11 artifact) instead of rebuilding it here.
- name: Download Windows build artifact (contains the MSI)
continue-on-error: true
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: windows-latest-11
run-id: ${{ github.event.workflow_run.id }}
@@ -245,7 +245,7 @@
path: windows-build
- name: Upload artifacts OpenDJ MSI Package
continue-on-error: true
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ MSI Package
path: windows-build/opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi
@@ -253,27 +253,27 @@
# continue-on-error) instead of warning and publishing nothing.
if-no-files-found: error
- name: Upload artifacts OpenDJ Docker Packages
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Docker Packages
path: opendj-packages/opendj-docker/target/Dockerfile.zip
- name: Upload artifacts OpenDJ Openshift template
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Openshift template
path: opendj-packages/opendj-openshift-template/*.yaml
- name: Upload artifacts OpenDJ Doc Generated Reference
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Doc Generated References
path: opendj-doc-generated-ref/target/*.zip
- name: Upload artifacts OpenDJ DSML Gateway
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ DSML Gateway
path: opendj-dsml-servlet/target/*.war
- name: Upload artifacts OpenDJ Commons REST LDAP Gateway
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Commons REST LDAP Gateway
path: opendj-rest2ldap-servlet/target/*.war
@@ -282,7 +282,7 @@
git config --global user.name "Open Identity Platform Community"
git config --global user.email "open-identity-platform-opendj@googlegroups.com"
cd ..
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
continue-on-error: true
with:
repository: ${{ github.repository }}.wiki
@@ -302,7 +302,7 @@
git commit -a -m "upload docs after deploy ${{ github.sha }}"
git push --quiet --force
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
continue-on-error: true
with:
repository: OpenIdentityPlatform/doc.openidentityplatform.org
--
Gitblit v1.10.0