From f5dc1c1ad32d1df08ceb40f590d1b1952dbb4a2d Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 23 Sep 2026 12:50:09 +0000
Subject: [PATCH] Add dependabot config and pin GitHub Actions to a commit SHA (#1073)
---
.github/workflows/docker-scan.yml | 4
.github/workflows/codeql.yml | 10 +-
.github/workflows/deploy.yml | 34 +++++-----
.github/workflows/release.yml | 24 ++++----
.github/workflows/build.yml | 58 +++++++++---------
.github/dependabot.yml | 28 +++++++++
.github/workflows/benchmark.yml | 10 +-
7 files changed, 98 insertions(+), 70 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..98caa0c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,28 @@
+# The contents of this file are subject to the terms of the Common Development and
+# Distribution License (the License). You may not use this file except in compliance with the
+# License.
+#
+# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+# specific language governing permission and limitations under the License.
+#
+# When distributing Covered Software, include this CDDL Header Notice in each file and include
+# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+# Header, with the fields enclosed by brackets [] replaced by your own identifying
+# information: "Portions copyright [year] [name of copyright owner]".
+#
+# Copyright 2026 3A Systems, LLC.
+version: 2
+updates:
+ # Keeps the SHA-pinned third-party actions in .github/workflows up to date: Dependabot
+ # bumps the commit hash and the trailing "# vX.Y.Z" version comment together.
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ groups:
+ # One pull request per week for all action updates instead of one per action.
+ github-actions:
+ patterns: ["*"]
+ labels:
+ - "ci"
+ - "dependencies"
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 402fb34..dce2f79 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -75,10 +75,10 @@
SAMPLE_FILTER: '^(?!ADMIN_CONNECT).*'
HEAP: -Xms1g -Xmx2g
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Cache JMeter
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/jmeter
key: jmeter-${{ env.JMETER }}
@@ -258,7 +258,7 @@
- name: Upload JMeter reports
if: always()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: jmeter-reports
path: |
@@ -270,7 +270,7 @@
- name: Upload OpenLDAP logs
if: always()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: logs-openldap
path: logs/openldap/
@@ -279,7 +279,7 @@
- name: Upload OpenDJ logs
if: always()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: logs-opendj
path: logs/opendj/
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ad914f0..604e3ff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,17 +52,17 @@
run: |
sudo apt-get update
sudo apt-get install -y rpm
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
submodules: recursive
- name: Java ${{ matrix.Java }} (${{ matrix.os }})
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: ${{ matrix.java }}
distribution: 'zulu'
- name: Cache Maven packages
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -91,7 +91,7 @@
# so a byte-for-byte gate would fire without a source change.
- name: Upload Windows exe artifacts
if: runner.os == 'Windows'
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: windows-exe-${{ matrix.java }}
retention-days: 5
@@ -413,7 +413,7 @@
opendj-server-legacy\target\package\opendj\bat\windows-service.bat --disableService
- name: Upload artifacts OpenDJ Server
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ matrix.os }}-${{ matrix.java }}
retention-days: 5
@@ -440,11 +440,11 @@
ports:
- 5000:5000
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
sparse-checkout: .github/benchmark
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ubuntu-latest-11
- name: Get latest release version
@@ -528,7 +528,7 @@
scanners: vuln
cache: false
- name: Upload Trivy report to GitHub Security
- uses: github/codeql-action/upload-sarif@v4
+ uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
# upload even if a preceding step failed, but not without a report to upload
if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
with:
@@ -536,7 +536,7 @@
# distinct from the docker-scan.yml categories, which track the published images
category: trivy-build-default
- name: Cache JMeter
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/jmeter
key: jmeter-5.6.3
@@ -548,7 +548,7 @@
"PDB" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
- name: Upload benchmark artifacts (PDB vs JE)
if: always()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: benchmark-pdb-vs-je
path: |
@@ -567,7 +567,7 @@
"Release" openidentityplatform/opendj:latest
- name: Upload benchmark artifacts
if: always()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: benchmark-build-vs-release
path: |
@@ -591,11 +591,11 @@
ports:
- 5000:5000
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
sparse-checkout: .github/benchmark
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ubuntu-latest-11
- name: Get latest release version
@@ -680,7 +680,7 @@
scanners: vuln
cache: false
- name: Upload Trivy report to GitHub Security
- uses: github/codeql-action/upload-sarif@v4
+ uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
# upload even if a preceding step failed, but not without a report to upload
if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
with:
@@ -688,7 +688,7 @@
# distinct from the docker-scan.yml categories, which track the published images
category: trivy-build-alpine
- name: Cache JMeter
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/jmeter
key: jmeter-5.6.3
@@ -700,7 +700,7 @@
"Release-alpine" openidentityplatform/opendj:alpine
- name: Upload benchmark artifacts
if: always()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: benchmark-build-vs-release-alpine
path: |
@@ -716,9 +716,9 @@
needs: build-maven
runs-on: 'ubuntu-latest'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ubuntu-latest-11
- name: Clean-room install + SysV start/stop (debian:12 container)
@@ -798,9 +798,9 @@
needs: build-maven
runs-on: 'ubuntu-latest'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ubuntu-latest-11
- name: Install and start/stop in Rocky Linux 9
@@ -849,9 +849,9 @@
needs: build-maven
runs-on: 'ubuntu-latest'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ubuntu-latest-11
- name: Download released 5.1.2 deb
@@ -899,9 +899,9 @@
needs: build-maven
runs-on: 'ubuntu-latest'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ubuntu-latest-11
- name: Download released 5.1.2 rpm
@@ -1033,17 +1033,17 @@
# Only for .github/scripts/wait-server-stopped.ps1 and the MSI authoring the guard
# step below reads, and it has to come first: checkout cleans the workspace the
# artifact is unpacked into. Sparse because those two are the entire reason for it.
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
sparse-checkout: |
.github/scripts
opendj-packages/opendj-msi/opendj-msi-standard/resources/msi
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: windows-latest-11
- name: Set up Java
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: '25'
distribution: 'zulu'
@@ -1227,11 +1227,11 @@
contents: read
steps:
- name: Download artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: windows-latest-11
- name: Set up Java
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: '25'
distribution: 'zulu'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3dff709..210a692 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -80,12 +80,12 @@
steps:
- name: Checkout repository
- uses: actions/checkout@v7
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
- name: Initialize CodeQL
- uses: github/codeql-action/init@v4
+ uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
@@ -120,13 +120,13 @@
# --- Java manual build (only used if the java entry is set to 'manual')
# - name: Set up JDK 11
# if: matrix.language == 'java-kotlin'
- # uses: actions/setup-java@v5
+ # uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
# with:
# java-version: '11'
# distribution: 'zulu'
# - name: Cache Maven packages
# if: matrix.language == 'java-kotlin'
- # uses: actions/cache@v6
+ # uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
# with:
# path: ~/.m2/repository
# key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -139,6 +139,6 @@
# ---------------------------------------------------------------------
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4
+ uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
with:
category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4178010..34cfeb1 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -54,7 +54,7 @@
run: |
sudo apt-get update
sudo apt-get install -y rpm
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
submodules: recursive
@@ -82,7 +82,7 @@
# not start new workflow runs, so this cannot loop; a PAT would break that.
- name: Download the launchers built by the triggering Build run
continue-on-error: true
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: windows-exe-11
run-id: ${{ github.event.workflow_run.id }}
@@ -176,7 +176,7 @@
done
echo "::warning title=Could not refresh the launcher binaries::$BRANCH kept moving under this job. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them."
- name: Set up Java for publishing to Maven Central Repository OSS
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
distribution: 'temurin'
@@ -184,7 +184,7 @@
server-username: MAVEN_USERNAME
server-password: MAVEN_PASSWORD
- name: Cache Maven packages
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -214,22 +214,22 @@
continue-on-error: true
run: mvn javadoc:aggregate
- name: Upload artifacts OpenDJ Server
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Server
path: opendj-server-legacy/target/package/*.zip
- name: Upload artifacts OpenDJ SDK Toolkit
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ SDK Toolkit
path: opendj-ldap-toolkit/target/*.zip
- name: Upload artifacts OpenDJ Debian Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Debian Package
path: opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb
- name: Upload artifacts OpenDJ RPM Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ RPM Package
path: opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm
@@ -237,7 +237,7 @@
# Build run (windows-latest-11 artifact) instead of rebuilding it here.
- name: Download Windows build artifact (contains the MSI)
continue-on-error: true
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: windows-latest-11
run-id: ${{ github.event.workflow_run.id }}
@@ -245,7 +245,7 @@
path: windows-build
- name: Upload artifacts OpenDJ MSI Package
continue-on-error: true
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ MSI Package
path: windows-build/opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi
@@ -253,27 +253,27 @@
# continue-on-error) instead of warning and publishing nothing.
if-no-files-found: error
- name: Upload artifacts OpenDJ Docker Packages
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Docker Packages
path: opendj-packages/opendj-docker/target/Dockerfile.zip
- name: Upload artifacts OpenDJ Openshift template
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Openshift template
path: opendj-packages/opendj-openshift-template/*.yaml
- name: Upload artifacts OpenDJ Doc Generated Reference
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Doc Generated References
path: opendj-doc-generated-ref/target/*.zip
- name: Upload artifacts OpenDJ DSML Gateway
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ DSML Gateway
path: opendj-dsml-servlet/target/*.war
- name: Upload artifacts OpenDJ Commons REST LDAP Gateway
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: OpenDJ Commons REST LDAP Gateway
path: opendj-rest2ldap-servlet/target/*.war
@@ -282,7 +282,7 @@
git config --global user.name "Open Identity Platform Community"
git config --global user.email "open-identity-platform-opendj@googlegroups.com"
cd ..
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
continue-on-error: true
with:
repository: ${{ github.repository }}.wiki
@@ -302,7 +302,7 @@
git commit -a -m "upload docs after deploy ${{ github.sha }}"
git push --quiet --force
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
continue-on-error: true
with:
repository: OpenIdentityPlatform/doc.openidentityplatform.org
diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml
index 3393658..933aeab 100644
--- a/.github/workflows/docker-scan.yml
+++ b/.github/workflows/docker-scan.yml
@@ -37,7 +37,7 @@
matrix:
tag: [ 'latest', 'alpine' ]
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Scan openidentityplatform/opendj:${{ matrix.tag }} (Trivy)
# unlike the build.yml gate, unfixed CVEs are reported too: surfacing them in
# already-released images is the point of this workflow
@@ -51,7 +51,7 @@
scanners: vuln
cache: false
- name: Upload report to GitHub Security
- uses: github/codeql-action/upload-sarif@v4
+ uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
# upload even if a preceding step failed, but not without a report to upload
if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5fc05b..06336a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,12 +50,12 @@
run: |
sudo apt-get update
sudo apt-get install -y rpm
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
submodules: recursive
- name: Set up Java for publishing to Maven Central Repository OSS
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
distribution: 'temurin'
@@ -63,7 +63,7 @@
server-username: MAVEN_USERNAME
server-password: MAVEN_PASSWORD
- name: Cache Maven packages
- uses: actions/cache@v5
+ uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -93,7 +93,7 @@
# built on Windows), so it does not have to rebuild opendj-server-legacy.
- name: Upload the server zip for the MSI job
continue-on-error: true
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: release-server-zip
retention-days: 1
@@ -120,7 +120,7 @@
target/checkout/opendj-doc-generated-ref/target/*.zip
target/checkout/opendj-dsml-servlet/target/*.war
target/checkout/opendj-rest2ldap-servlet/target/*.war
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
continue-on-error: true
with:
repository: ${{ github.repository }}.wiki
@@ -143,7 +143,7 @@
git push --quiet --force
git push --quiet --force origin ${{ github.event.inputs.releaseVersion }}
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
continue-on-error: true
with:
repository: OpenIdentityPlatform/doc.openidentityplatform.org
@@ -174,12 +174,12 @@
needs:
- release-maven
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
ref: ${{ github.event.inputs.releaseVersion }}
submodules: recursive
- name: Set up Java
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
java-version: '11'
distribution: 'temurin'
@@ -188,7 +188,7 @@
# and saving that under the key build-maven restores from would seed every later
# Windows build with it.
- name: Cache Maven packages
- uses: actions/cache/restore@v5
+ uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -204,7 +204,7 @@
wix --version
wix extension add -g WixToolset.UI.wixext/5.0.2 || true
- name: Download the server zip built by release-maven
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-server-zip
path: server-zip
@@ -246,7 +246,7 @@
contents: read
packages: write
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
ref: ${{ github.event.inputs.releaseVersion }}
fetch-depth: 1
@@ -298,7 +298,7 @@
contents: read
packages: write
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
ref: ${{ github.event.inputs.releaseVersion }}
fetch-depth: 1
--
Gitblit v1.10.0