Skip to content

Commit 6dcafea

Browse files
data-douserCopilot
data-douser
and
Copilot
authored
Pin actions to full-length commit SHA refs (#341)
* Pin actions to full-length commit SHA refs * Update .github/instructions/github_workflows_yaml.instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 9ca6e1a commit 6dcafea

File tree

10 files changed

+65
-33
lines changed

10 files changed

+65
-33
lines changed

‎.github/instructions/github_workflows_yaml.instructions.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
applyTo: '.github/{actions,workflows}/*.{yml,yaml}'
3+
description: 'Instructions for editing GitHub Actions workflows for this repository.'
4+
---
5+
6+
# Copilot Instructions for `.github/{actions,workflows}/*.{yml,yaml}` files
7+
8+
## PURPOSE
9+
10+
This file contains instructions for working with GitHub Actions YAML files in the `.github/actions/` and `.github/workflows/` directories of the `codeql-sap-js` repository.
11+
12+
## REQUIREMENTS
13+
14+
- **ALWAYS pin ALL external GitHub Actions to full-length commit SHAs, never to tags or branch names — including GitHub-maintained `actions/*` actions.** Add a trailing comment with the original tag for readability (e.g., `uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6`). To resolve a tag to its commit SHA, run `git ls-remote https://github.com/OWNER/REPO.git refs/tags/TAG^{}` (or `refs/heads/BRANCH` for branch-based refs).
15+
- ALWAYS use the principle of least privilege, and explicitly set `permissions` for workflows.
16+
- ALWAYS use valid YAML syntax and follow GitHub Actions workflow conventions.
17+
- ALWAYS follow best practices for GitHub Actions workflows including security, efficiency, and maintainability.
18+
- ALWAYS use descriptive names for workflows, jobs, and steps that clearly explain their purpose.
19+
20+
## PREFERENCES
21+
22+
- PREFER explicit permissions declarations using the `permissions` key for security.
23+
- PREFER descriptive step names that include the workflow context (e.g., "Tag - Checkout repository").
24+
- PREFER matrix strategies for testing multiple versions when applicable.
25+
- PREFER adding summary outputs using `$GITHUB_STEP_SUMMARY` for better workflow visibility.
26+
27+
## CONSTRAINTS
28+
29+
- **NEVER reference an external GitHub Action by tag or branch name (e.g., `@v6`, `@main`). ALWAYS use the full 40-character commit SHA with a `# tag` comment.**
30+
- NEVER use overly broad permissions.
31+
- NEVER leave any trailing whitespace on any line.
32+
- NEVER use deprecated GitHub Actions or workflow syntax.

‎.github/workflows/cds-extractor-dist-bundle.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ jobs:
2222

2323
steps:
2424
- name: Checkout repository
25-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626

2727
- name: Setup Node.js
28-
uses: actions/setup-node@v6
28+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
2929
with:
3030
node-version: '20'
3131
cache: 'npm'

‎.github/workflows/code_scanning.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,15 @@ jobs:
2727

2828
steps:
2929
- name: Checkout repository
30-
uses: actions/checkout@v6
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3131

3232
- name: Extract CodeQL bundle version from qlt.conf.json
3333
run: |
3434
echo "BUNDLE_VERSION=$(jq .CodeQLCLIBundle qlt.conf.json -r)" >> $GITHUB_ENV
3535
3636
- name: Initialize CodeQL
3737
id: initialize-codeql
38-
uses: github/codeql-action/init@v4
38+
uses: github/codeql-action/init@256d634097be96e792d6764f9edaefc4320557b1 # v4
3939
env:
4040
# Add our custom extractor to the CodeQL search path
4141
CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"init":["--search-path","${{ github.workspace }}/extractors:${{ github.workspace }}"]}}'
@@ -55,19 +55,19 @@ jobs:
5555
5656
- name: Perform CodeQL Analysis
5757
id: analyze
58-
uses: github/codeql-action/analyze@v4
58+
uses: github/codeql-action/analyze@256d634097be96e792d6764f9edaefc4320557b1 # v4
5959
env:
6060
LGTM_INDEX_XML_MODE: all
6161
LGTM_INDEX_FILETYPES: ".json:JSON"
6262
# Add our CodeQL workspace to the path to search for packs to then resolve the MaD locally
6363
CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"run-queries":["--additional-packs","${{ github.workspace }}/javascript/frameworks/xsjs/ext:${{ github.workspace }}/javascript/frameworks/cap/ext:${{ github.workspace }}/javascript/frameworks/ui5/ext"],"interpret-results":["--additional-packs","${{ github.workspace }}/javascript/frameworks/xsjs/ext:${{ github.workspace }}/javascript/frameworks/cap/ext:${{ github.workspace }}/javascript/frameworks/ui5/ext"]}}'
6464

6565
- name: Setup Python
66-
uses: actions/setup-python@v5
66+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
6767
with:
6868
python-version: "3.10"
6969

70-
- uses: actions/cache@v4
70+
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
7171
with:
7272
path: ~/.cache/pip
7373
key: ${{ runner.os }}-pip
@@ -84,7 +84,7 @@ jobs:
8484
8585
- name: Upload sarif change
8686
if: steps.validate.outcome != 'success'
87-
uses: actions/upload-artifact@v6
87+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
8888
with:
8989
name: sarif
9090
path: |

‎.github/workflows/codeql-ql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,5 @@ permissions:
1212

1313
jobs:
1414
codeql:
15-
uses: advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml@main
15+
uses: advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml@a0e88ede84d03cd069b01d18540db7fc86c52cf8 # main
1616
secrets: inherit

‎.github/workflows/ql-unit-tests-linux.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,11 @@ jobs:
2020
matrix: ${{ steps.export-unit-test-matrix.outputs.matrix }}
2121
steps:
2222
- name: Checkout repository
23-
uses: actions/checkout@v6
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2424

2525
- name: Install QLT
2626
id: install-qlt
27-
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main
27+
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@177984f7fc369b131c844b3a50d8d1e9a8e5223b # main
2828
with:
2929
qlt-version: 'latest'
3030
add-to-path: true
@@ -45,11 +45,11 @@ jobs:
4545

4646
steps:
4747
- name: Checkout repository
48-
uses: actions/checkout@v6
48+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4949

5050
- name: Install QLT
5151
id: install-qlt
52-
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main
52+
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@177984f7fc369b131c844b3a50d8d1e9a8e5223b # main
5353
with:
5454
qlt-version: 'latest'
5555
add-to-path: true
@@ -80,7 +80,7 @@ jobs:
8080
qlt query run install-packs
8181
8282
- name: Setup Node.js for CDS compilation
83-
uses: actions/setup-node@v6
83+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
8484
with:
8585
node-version: '20'
8686
cache: 'npm'
@@ -123,7 +123,7 @@ jobs:
123123
--work-dir $RUNNER_TMP
124124
125125
- name: Upload test results
126-
uses: actions/upload-artifact@v6
126+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
127127
with:
128128
name: test-results-${{ runner.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}
129129
path: |
@@ -137,18 +137,18 @@ jobs:
137137
steps:
138138

139139
- name: Checkout repository
140-
uses: actions/checkout@v6
140+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
141141

142142
- name: Install QLT
143143
id: install-qlt
144-
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main
144+
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@177984f7fc369b131c844b3a50d8d1e9a8e5223b # main
145145
with:
146146
qlt-version: 'latest'
147147
add-to-path: true
148148

149149

150150
- name: Collect test results
151-
uses: actions/download-artifact@v7
151+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
152152

153153
- name: Validate test results
154154
run: |

‎.github/workflows/ql-unit-tests-windows.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969

7070
steps:
7171
- name: Checkout repository
72-
uses: actions/checkout@v6
72+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7373

7474
- name: Setup CodeQL CLI
7575
id: setup-codeql
@@ -155,7 +155,7 @@ jobs:
155155
Write-Host "QL pack installation complete"
156156
157157
- name: Setup Node.js for CDS compilation
158-
uses: actions/setup-node@v6
158+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
159159
with:
160160
node-version: '20'
161161
cache: 'npm'
@@ -287,7 +287,7 @@ jobs:
287287
288288
- name: Upload test results
289289
if: ${{ always() }}
290-
uses: actions/upload-artifact@v6
290+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
291291
with:
292292
name: windows-test-results-${{ matrix.test_suite }}
293293
path: |
@@ -296,7 +296,7 @@ jobs:
296296

297297
- name: Upload CAP test artifacts
298298
if: ${{ always() && (matrix.test_suite == 'cap-models' || matrix.test_suite == 'cap-queries') }}
299-
uses: actions/upload-artifact@v6
299+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
300300
with:
301301
name: windows-cap-debug-${{ matrix.test_suite }}
302302
path: |
@@ -311,10 +311,10 @@ jobs:
311311
runs-on: ubuntu-latest
312312
steps:
313313
- name: Checkout repository
314-
uses: actions/checkout@v6
314+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
315315

316316
- name: Download test results
317-
uses: actions/download-artifact@v7
317+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
318318
with:
319319
pattern: windows-test-results-*
320320
path: test-results/

‎.github/workflows/release-codeql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
echo "release_name=${VERSION#v}" >> $GITHUB_OUTPUT
5757
5858
- name: CodeQL - Checkout tag
59-
uses: actions/checkout@v6
59+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6060
with:
6161
ref: refs/tags/${{ steps.version.outputs.version }}
6262

@@ -101,7 +101,7 @@ jobs:
101101
run: ./scripts/bundle-packs.sh --output-dir dist-packs
102102

103103
- name: CodeQL - Upload pack artifacts
104-
uses: actions/upload-artifact@v6
104+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
105105
with:
106106
name: codeql-pack-bundles-${{ steps.version.outputs.version }}
107107
path: dist-packs/*.tar.gz

‎.github/workflows/release-tag.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242

4343
steps:
4444
- name: Tag - Checkout repository
45-
uses: actions/checkout@v6
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4646
with:
4747
fetch-depth: 0
4848
fetch-tags: true
@@ -149,7 +149,7 @@ jobs:
149149
150150
- name: Tag - Setup Node.js for CDS compilation
151151
if: steps.needs-creation.outputs.needed == 'true'
152-
uses: actions/setup-node@v6
152+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
153153
with:
154154
node-version: '20'
155155
cache: 'npm'

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ jobs:
130130

131131
steps:
132132
- name: Release - Download CodeQL pack artifacts
133-
uses: actions/download-artifact@v7
133+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
134134
with:
135135
name: codeql-pack-bundles-${{ needs.resolve-version.outputs.version }}
136136
path: dist-packs

‎.github/workflows/update-codeql.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929

3030
steps:
3131
- name: Detect - Checkout repository
32-
uses: actions/checkout@v6
32+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3333

3434
- name: Detect - Check latest CodeQL CLI version
3535
id: check-version
@@ -102,7 +102,7 @@ jobs:
102102

103103
steps:
104104
- name: Update - Checkout repository
105-
uses: actions/checkout@v6
105+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
106106

107107
- name: Update - Update version in all files
108108
run: |
@@ -130,7 +130,7 @@ jobs:
130130
run: ./scripts/upgrade-packs.sh
131131

132132
- name: Update - Setup Node.js for CDS compilation
133-
uses: actions/setup-node@v6
133+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
134134
with:
135135
node-version: '20'
136136
cache: 'npm'
@@ -153,7 +153,7 @@ jobs:
153153
-- javascript/
154154
155155
- name: Update - Create Pull Request
156-
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
156+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
157157
with:
158158
title: 'Upgrade CodeQL CLI dependency to ${{ needs.detect-update.outputs.version }}'
159159
body: |

0 commit comments

Comments
 (0)