From 6a141c311aebdc9db9478a852b349f1bf9966538 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 17:45:19 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++ .github/workflows/ci.yaml | 30 +++++++++---------- .github/workflows/main.yaml | 36 +++++++++++------------ .github/workflows/update_grid_driver.yaml | 12 ++++---- 4 files changed, 50 insertions(+), 39 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2c48305 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 405fe1a..29482a3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -16,7 +16,7 @@ jobs: - config_key: cuda_lts image_repo: aks-gpu-cuda-lts steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Load CUDA config @@ -32,11 +32,11 @@ jobs: echo "CUDA_VERSION=$cuda_version" echo "cuda_version=$cuda_version" >> "$GITHUB_OUTPUT" - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Set up Docker to use containerd - uses: docker/setup-docker-action@v5 + uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0 with: daemon-config: | { @@ -46,7 +46,7 @@ jobs: } } - name: Cache Docker layers - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ github.sha }} @@ -55,7 +55,7 @@ jobs: - name: Generate timestamp id: timestamp run: echo "timestamp=$(date +'%Y%m%d%H%M%S')" >> "$GITHUB_OUTPUT" - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 with: bump_each_commit: false version_format: "${{ steps.load_config.outputs.cuda_version }}-${{ steps.timestamp.outputs.timestamp }}" @@ -94,7 +94,7 @@ jobs: - config_key: cuda_lts image_repo: aks-gpu-cuda-lts-arm64 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Load CUDA config @@ -110,9 +110,9 @@ jobs: echo "CUDA_VERSION=$cuda_version" echo "cuda_version=$cuda_version" >> "$GITHUB_OUTPUT" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Cache Docker layers - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ github.sha }} @@ -121,7 +121,7 @@ jobs: - name: Generate timestamp id: timestamp run: echo "timestamp=$(date +'%Y%m%d%H%M%S')" >> "$GITHUB_OUTPUT" - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 with: bump_each_commit: false version_format: "${{ steps.load_config.outputs.cuda_version }}-${{ steps.timestamp.outputs.timestamp }}" @@ -160,7 +160,7 @@ jobs: - config_key: grid_v20 image_repo: aks-gpu-grid-v20 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Load GRID config @@ -183,9 +183,9 @@ jobs: echo "grid_version=$grid_version" >> "$GITHUB_OUTPUT" echo "grid_url=$grid_url" >> "$GITHUB_OUTPUT" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Cache Docker layers - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ steps.load_config.outputs.grid_version }}-${{ github.sha }} @@ -194,7 +194,7 @@ jobs: - name: Generate timestamp id: timestamp run: echo "timestamp=$(date +'%Y%m%d%H%M%S')" >> "$GITHUB_OUTPUT" - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 with: bump_each_commit: false version_format: "${{ steps.load_config.outputs.grid_version }}-${{ steps.timestamp.outputs.timestamp }}" @@ -228,7 +228,7 @@ jobs: lint-and-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Shellcheck prebake scripts run: shellcheck -S warning install.sh entrypoint.sh - name: Install bats diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index ece9c14..8a859a2 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -19,7 +19,7 @@ jobs: - config_key: cuda_lts image_repo: aks-gpu-cuda-lts steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Load CUDA config @@ -35,11 +35,11 @@ jobs: echo "CUDA_VERSION=$cuda_version" echo "cuda_version=$cuda_version" >> "$GITHUB_OUTPUT" - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Set up Docker to use containerd - uses: docker/setup-docker-action@v5 + uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0 with: daemon-config: | { @@ -49,7 +49,7 @@ jobs: } } - name: Cache Docker layers - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ github.sha }} @@ -58,7 +58,7 @@ jobs: - name: Generate timestamp id: timestamp run: echo "timestamp=$(date +'%Y%m%d%H%M%S')" >> "$GITHUB_OUTPUT" - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 with: bump_each_commit: false version_format: "${{ steps.load_config.outputs.cuda_version }}-${{ steps.timestamp.outputs.timestamp }}" @@ -71,7 +71,7 @@ jobs: echo "version is $VERSION" echo "version is $VERSION_TAG" - name: 'Azure CLI login' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -105,7 +105,7 @@ jobs: - config_key: cuda_lts image_repo: aks-gpu-cuda-lts-arm64 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Load CUDA config @@ -121,9 +121,9 @@ jobs: echo "CUDA_VERSION=$cuda_version" echo "cuda_version=$cuda_version" >> "$GITHUB_OUTPUT" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Cache Docker layers - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ github.sha }} @@ -132,7 +132,7 @@ jobs: - name: Generate timestamp id: timestamp run: echo "timestamp=$(date +'%Y%m%d%H%M%S')" >> "$GITHUB_OUTPUT" - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 with: bump_each_commit: false version_format: "${{ steps.load_config.outputs.cuda_version }}-${{ steps.timestamp.outputs.timestamp }}" @@ -145,7 +145,7 @@ jobs: echo "version is $VERSION" echo "version is $VERSION_TAG" - name: 'Azure CLI login' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -179,7 +179,7 @@ jobs: - config_key: grid_v20 image_repo: aks-gpu-grid-v20 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Load GRID config @@ -202,19 +202,19 @@ jobs: echo "grid_version=$grid_version" >> "$GITHUB_OUTPUT" echo "grid_url=$grid_url" >> "$GITHUB_OUTPUT" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Generate timestamp id: timestamp run: echo "timestamp=$(date +'%Y%m%d%H%M%S')" >> "$GITHUB_OUTPUT" - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 - name: Cache Docker layers - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ steps.load_config.outputs.grid_version }}-${{ github.sha }} restore-keys: | ${{ runner.os }}-buildx-${{ matrix.image_repo }}-${{ steps.load_config.outputs.grid_version }} - - uses: paulhatch/semantic-version@v6.0.2 + - uses: paulhatch/semantic-version@9f72830310d5ed81233b641ee59253644cd8a8fc # v6.0.2 with: bump_each_commit: false version_format: "${{ steps.load_config.outputs.grid_version }}-${{ steps.timestamp.outputs.timestamp }}" @@ -227,7 +227,7 @@ jobs: echo "version is $VERSION" echo "version is $VERSION_TAG" - name: 'Azure CLI login' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/update_grid_driver.yaml b/.github/workflows/update_grid_driver.yaml index 23b4360..906e178 100644 --- a/.github/workflows/update_grid_driver.yaml +++ b/.github/workflows/update_grid_driver.yaml @@ -13,10 +13,10 @@ jobs: runs-on: ubuntu-latest environment: test steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.x' @@ -41,7 +41,7 @@ jobs: - name: Azure login if: steps.git-check.outputs.changes == 'true' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_KV_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_KV_TENANT_ID }} @@ -50,7 +50,7 @@ jobs: - name: Get assistant app private key id: get-private-key if: steps.git-check.outputs.changes == 'true' - uses: azure/cli@v3 + uses: azure/cli@9eb25b8360668fb0ecbafa808d40e2197b2f5f52 # v3.0.0 env: AZURE_KV_NAME: ${{ secrets.AZURE_KV_NAME }} APP_PRIVATE_KEY_SECRET_NAME: ${{ secrets.APP_PRIVATE_KEY_SECRET_NAME }} @@ -65,7 +65,7 @@ jobs: - name: Generate GitHub token if: steps.git-check.outputs.changes == 'true' id: generate-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ vars.APP_ID }} private-key: ${{ steps.get-private-key.outputs.private-key }} @@ -73,7 +73,7 @@ jobs: - name: Create pull request if: steps.git-check.outputs.changes == 'true' - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ steps.generate-token.outputs.token }} commit-message: 'chore: update NVIDIA GRID driver version to ${{ steps.git-check.outputs.new_version }}'