migrate tag-based references to commit SHA-based references for github workflows (#30509)

2025-03-18 11:32:39 +01:00
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -3,9 +3,9 @@ name: "CodeQL"
 on:
  pull_request:
    # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [master]
  schedule:
-    - cron: '30 5,17 * * *'
+    - cron: "30 5,17 * * *"

 permissions:
  contents: read
@@ -13,7 +13,7 @@ permissions:
 jobs:
  analyze:
    permissions:
-      security-events: write  # for github/codeql-action/autobuild to send a status report
+      security-events: write # for github/codeql-action/autobuild to send a status report
    name: Analyze
    if: github.repository_owner == 'mattermost'
    runs-on: ubuntu-latest
@@ -21,38 +21,37 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        language: [ 'go', 'javascript' ]
+        language: ["go", "javascript"]

    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3.28.11
-      with:
-        languages: ${{ matrix.language }}
-        debug: false
-        config-file: ./.github/codeql/codeql-config.yml
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        with:
+          languages: ${{ matrix.language }}
+          debug: false
+          config-file: ./.github/codeql/codeql-config.yml

-    - name: Build JavaScript
-      uses: github/codeql-action/autobuild@v3.28.11
-      if: ${{ matrix.language  == 'javascript' }}
+      - name: Build JavaScript
+        uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        if: ${{ matrix.language  == 'javascript' }}

-    - name: Setup go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: server/go.mod
-      if: ${{ matrix.language == 'go' }}
+      - name: Setup go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: server/go.mod
+        if: ${{ matrix.language == 'go' }}

+      - name: Build Golang
+        run: |
+          cd server
+          make setup-go-work
+          make build-linux-amd64
+        if: ${{ matrix.language == 'go' }}

-    - name: Build Golang
-      run: |
-        cd server
-        make setup-go-work
-        make build-linux-amd64
-      if: ${{ matrix.language == 'go' }}
-
-    # Perform Analysis
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3.28.11
+      # Perform Analysis
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
--- a/.github/workflows/esrupgrade-common.yml
+++ b/.github/workflows/esrupgrade-common.yml
@@ -89,7 +89,7 @@ jobs:
          # We skip the very last line, which simply contains the date of the dump
          head -n -1 ${DUMP_SERVER_NAME} | gzip > ${DUMP_SERVER_NAME}.gz
      - name: Upload dump
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: upgraded-dump-server
          path: ${{ env.DUMP_SERVER_NAME }}.gz
@@ -134,7 +134,7 @@ jobs:
          # We skip the very last line, which simply contains the date of the dump
          head -n -1 ${DUMP_SCRIPT_NAME} | gzip > ${DUMP_SCRIPT_NAME}.gz
      - name: Upload dump
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: upgraded-dump-script
          path: ${{ env.DUMP_SCRIPT_NAME }}.gz
@@ -145,7 +145,7 @@ jobs:
      - esr-upgrade-script
    steps:
      - name: Retrieve dumps
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
      - name: Diff dumps
        run: |
          gzip -d upgraded-dump-server/${DUMP_SERVER_NAME}.gz
@@ -153,7 +153,7 @@ jobs:
          diff upgraded-dump-server/$DUMP_SERVER_NAME upgraded-dump-script/$DUMP_SCRIPT_NAME > $DIFF_NAME
      - name: Upload diff
        if: failure() # Upload the diff only if the previous step failed; i.e., if the diff is non-empty
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: dumps-diff
          path: ${{ env.DIFF_NAME }}
--- a/.github/workflows/mmctl-test-template.yml
+++ b/.github/workflows/mmctl-test-template.yml
@@ -31,9 +31,9 @@ jobs:
      - name: Store required variables for publishing results
        run: |
          echo "${{ inputs.name }}" > server/test-name
-          echo "${{ github.event.pull_request.number }}" > server/pr-number        
+          echo "${{ github.event.pull_request.number }}" > server/pr-number
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: server/go.sum
--- a/.github/workflows/server-ci-template.yml
+++ b/.github/workflows/server-ci-template.yml
@@ -19,7 +19,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -44,7 +44,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -69,7 +69,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -92,7 +92,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -117,7 +117,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -144,7 +144,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -195,7 +195,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -220,7 +220,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
@@ -288,7 +288,7 @@ jobs:
        id: go
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: |
--- a/.github/workflows/server-test-template.yml
+++ b/.github/workflows/server-test-template.yml
@@ -29,7 +29,7 @@ jobs:
        working-directory: ./server
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Setup Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: ${{ steps.go.outputs.GO_VERSION }}
          cache-dependency-path: server/go.sum
@@ -77,4 +77,4 @@ jobs:
            server/gotestsum.json
            server/report.xml
            server/test-name
-            server/pr-number
+            server/pr-number