Add link to the actual tag

2025-03-24 17:05:05 +01:00 · 2025-03-24 17:05:05 +01:00 · 5c732c6670
parent a2f85680d3
commit 5c732c6670
12 changed files with 41 additions and 13 deletions
--- a/.github/actions/setup-arc-e2e/action.yaml
+++ b/.github/actions/setup-arc-e2e/action.yaml
@ -36,6 +36,7 @@ runs:
        driver-opts: image=moby/buildkit:v0.10.6

    - name: Build controller image
+      # https://github.com/docker/build-push-action/releases/tag/v6.15.0
      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
      with:
        file: Dockerfile
@ -56,9 +57,9 @@ runs:

    - name: Get configure token
      id: config-token
+      # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
      with:
        application_id: ${{ inputs.app-id }}
        application_private_key: ${{ inputs.app-pk }}
        organization: ${{ inputs.target-org}}
-
--- a/.github/actions/setup-docker-environment/action.yaml
+++ b/.github/actions/setup-docker-environment/action.yaml
@ -24,15 +24,18 @@ runs:
      shell: bash

    - name: Set up QEMU
+      # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392

    - name: Set up Docker Buildx
+      # https://github.com/docker/setup-buildx-action/releases/tag/v3.10.0
      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
      with:
        version: latest

    - name: Login to DockerHub
      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.password != ''  }}
+      # https://github.com/docker/login-action/releases/tag/v3.4.0
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
      with:
        username: ${{ inputs.username }}
@ -40,6 +43,7 @@ runs:

    - name: Login to GitHub Container Registry
      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ghcr_password != ''  }}
+      # https://github.com/docker/login-action/releases/tag/v3.4.0
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
      with:
        registry: ghcr.io
--- a/.github/workflows/arc-publish-chart.yaml
+++ b/.github/workflows/arc-publish-chart.yaml
@ -45,6 +45,7 @@ jobs:
          fetch-depth: 0

      - name: Set up Helm
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
@ -63,6 +64,7 @@ jobs:
          python-version: "3.11"

      - name: Set up chart-testing
+        # https://github.com/helm/chart-testing-action/releases/tag/v2.7.0
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b

      - name: Run chart-testing (list-changed)
@ -79,6 +81,7 @@ jobs:

      - name: Create kind cluster
        if: steps.list-changed.outputs.changed == 'true'
+        # https://github.com/helm/kind-action/releases/tag/v1.12.0
        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3

      # We need cert-manager already installed in the cluster because we assume the CRDs exist
@ -145,6 +148,7 @@ jobs:

      - name: Get Token
        id: get_workflow_token
+        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
--- a/.github/workflows/arc-publish.yaml
+++ b/.github/workflows/arc-publish.yaml
@ -9,17 +9,17 @@ on:
  workflow_dispatch:
    inputs:
      release_tag_name:
-        description: 'Tag name of the release to publish'
+        description: "Tag name of the release to publish"
        required: true
      push_to_registries:
-        description: 'Push images to registries'
+        description: "Push images to registries"
        required: true
        type: boolean
        default: false

 permissions:
- contents: write
- packages: write
+  contents: write
+  packages: write

 env:
  TARGET_ORG: actions-runner-controller
@ -43,7 +43,7 @@ jobs:

      - uses: actions/setup-go@v5
        with:
-          go-version-file: 'go.mod'
+          go-version-file: "go.mod"

      - name: Install tools
        run: |
@ -73,6 +73,7 @@ jobs:

      - name: Get Token
        id: get_workflow_token
+        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
--- a/.github/workflows/arc-release-runners.yaml
+++ b/.github/workflows/arc-release-runners.yaml
@ -7,10 +7,10 @@ on:
  # are available to the workflow run
  push:
    branches:
-      - 'master'
+      - "master"
    paths:
-      - 'runner/VERSION'
-      - '.github/workflows/arc-release-runners.yaml'
+      - "runner/VERSION"
+      - ".github/workflows/arc-release-runners.yaml"

 env:
  # Safeguard to prevent pushing images to registeries after build
@ -39,6 +39,7 @@ jobs:

      - name: Get Token
        id: get_workflow_token
+        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
--- a/.github/workflows/arc-validate-chart.yaml
+++ b/.github/workflows/arc-validate-chart.yaml
@ -45,7 +45,7 @@ jobs:
          fetch-depth: 0

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
@ -73,6 +73,7 @@ jobs:
          python-version: "3.11"

      - name: Set up chart-testing
+        # https://github.com/helm/chart-testing-action/releases/tag/v2.7.0
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b

      - name: Run chart-testing (list-changed)
@ -88,6 +89,7 @@ jobs:
          ct lint --config charts/.ci/ct-config.yaml

      - name: Create kind cluster
+        # https://github.com/helm/kind-action/releases/tag/v1.12.0
        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
        if: steps.list-changed.outputs.changed == 'true'

--- a/.github/workflows/gha-publish-chart.yaml
+++ b/.github/workflows/gha-publish-chart.yaml
@ -72,6 +72,7 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up QEMU
+        # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392

      - name: Set up Docker Buildx
@ -84,6 +85,7 @@ jobs:
          driver-opts: image=moby/buildkit:v0.10.6

      - name: Login to GitHub Container Registry
+        # https://github.com/docker/login-action/releases/tag/v3.4.0
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
        with:
          registry: ghcr.io
@ -91,6 +93,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push controller image
+        # https://github.com/docker/build-push-action/releases/tag/v6.15.0
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
        with:
          file: Dockerfile
@ -140,7 +143,7 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
@ -188,7 +191,7 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
--- a/.github/workflows/gha-validate-chart.yaml
+++ b/.github/workflows/gha-validate-chart.yaml
@ -41,7 +41,7 @@ jobs:
          fetch-depth: 0

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
@ -52,6 +52,7 @@ jobs:
          python-version: "3.11"

      - name: Set up chart-testing
+        # https://github.com/helm/chart-testing-action/releases/tag/v2.7.0
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b

      - name: Run chart-testing (list-changed)
@ -74,6 +75,7 @@ jobs:
          version: latest

      - name: Build controller image
+        # https://github.com/docker/build-push-action/releases/tag/v6.15.0
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
        if: steps.list-changed.outputs.changed == 'true'
        with:
@ -89,6 +91,7 @@ jobs:
          cache-to: type=gha,mode=max

      - name: Create kind cluster
+        # https://github.com/helm/kind-action/releases/tag/v1.12.0
        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
        if: steps.list-changed.outputs.changed == 'true'
        with:
--- a/.github/workflows/global-publish-canary.yaml
+++ b/.github/workflows/global-publish-canary.yaml
@ -59,6 +59,7 @@ jobs:

      - name: Get Token
        id: get_workflow_token
+        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
@ -93,6 +94,7 @@ jobs:
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
+        # https://github.com/docker/login-action/releases/tag/v3.4.0
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
        with:
          registry: ghcr.io
@ -110,15 +112,18 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up QEMU
+        # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392

      - name: Set up Docker Buildx
+        # https://github.com/docker/setup-buildx-action/releases/tag/v3.10.0
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
        with:
          version: latest

      # Unstable builds - run at your own risk
      - name: Build and Push
+        # https://github.com/docker/build-push-action/releases/tag/v6.15.0
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
        with:
          context: .
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@ -48,6 +48,7 @@ jobs:
          go-version-file: "go.mod"
          cache: false
      - name: golangci-lint
+        # https://github.com/golangci/golangci-lint-action/releases/tag/v6.5.2
        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84
        with:
          only-new-issues: true
--- a/acceptance/pipelines/eks-integration-tests.yaml
+++ b/acceptance/pipelines/eks-integration-tests.yaml
@ -13,6 +13,7 @@ jobs:
    runs-on: ["self-hosted", "Linux"]
    steps:
      - name: Test aws-actions/configure-aws-credentials Action
+        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
        with:
          aws-region: ${{ env.AWS_REGION }}
@ -29,6 +30,7 @@ jobs:
        - /var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token
    steps:
      - name: Test aws-actions/configure-aws-credentials Action in container
+        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
        with:
          aws-region: ${{ env.AWS_REGION }}
--- a/acceptance/pipelines/runner-integration-tests.yaml
+++ b/acceptance/pipelines/runner-integration-tests.yaml
@ -59,6 +59,7 @@ jobs:
  setup-ruby-test:
    runs-on: ["self-hosted", "Linux"]
    steps:
+      # https://github.com/ruby/setup-ruby/releases/tag/v1.227.0
      - uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f
        with:
          ruby-version: 3.0