From 4ed2a1f0aff4e297a91340f8e105ccbfc6ce85e5 Mon Sep 17 00:00:00 2001 From: jogerj <30559735+jogerj@users.noreply.github.com> Date: Sat, 5 Sep 2026 02:15:48 +0200 Subject: [PATCH] ci: pin GitHub Actions to commit SHAs and add Dependabot Pin every action reference to the full commit SHA that its current tag already resolves to, with the version kept in a trailing comment. No action changes version as a result of this commit -- including actions/setup-node in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the v6 used by the other workflows. Version bumps are left to Dependabot so they arrive as reviewable PRs. Add .github/dependabot.yml for the github-actions ecosystem: weekly on Monday, minor/patch grouped into a single PR (majors always get their own), "ci" commit prefix. tibdex/github-app-token is ignored to match iptv-org-database; it is archived upstream, so replacing it should be a considered migration rather than an automated bump. --- .github/dependabot.yml | 17 +++++++++++++++++ .github/workflows/check.yml | 4 ++-- .github/workflows/format.yml | 8 ++++---- .github/workflows/update.yml | 12 ++++++------ .github/workflows/validate_issue.yml | 6 +++--- .github/workflows/validate_label.yml | 4 ++-- 6 files changed, 34 insertions(+), 17 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..f35dd3a63f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,17 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + groups: + actions-minor-patch: + update-types: ["minor", "patch"] + commit-message: + prefix: "ci" + ignore: + # Held deliberately, matching iptv-org-database. The action is archived + # upstream, so moving off it should be a considered migration to + # actions/create-github-app-token, not an automated version bump. + - dependency-name: "tibdex/github-app-token" diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index fe5a2d770f..735ea11629 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -12,7 +12,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Get list of changed files id: files run: | @@ -24,7 +24,7 @@ jobs: fi echo "all_changed_files=$ALL_CHANGED_FILES" >> "$GITHUB_OUTPUT" echo "any_changed=$ANY_CHANGED" >> "$GITHUB_OUTPUT" - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 if: steps.files.outputs.any_changed == 'true' with: node-version: 22 diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml index a113411ca4..8baabc58e9 100644 --- a/.github/workflows/format.yml +++ b/.github/workflows/format.yml @@ -9,18 +9,18 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: tibdex/github-app-token@v1.8.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2 if: ${{ !env.ACT }} id: create-app-token with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 if: ${{ !env.ACT }} with: token: ${{ steps.create-app-token.outputs.token }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 22 cache: 'npm' diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml index 98791b753f..b16b0c200b 100644 --- a/.github/workflows/update.yml +++ b/.github/workflows/update.yml @@ -9,18 +9,18 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: tibdex/github-app-token@v1.8.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2 if: ${{ !env.ACT }} id: create-app-token with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 if: ${{ !env.ACT }} with: token: ${{ steps.create-app-token.outputs.token }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 22 cache: 'npm' @@ -60,7 +60,7 @@ jobs: if: ${{ !env.ACT && github.ref == 'refs/heads/master' }} run: git push - name: Deploy public playlists to GitHub Pages - uses: JamesIves/github-pages-deploy-action@4.1.1 + uses: JamesIves/github-pages-deploy-action@164583b9e44b4fc5910e78feb607ea7c98d3c7b9 # 4.1.1 if: ${{ !env.ACT && github.ref == 'refs/heads/master' }} with: repository-name: iptv-org/iptv @@ -72,7 +72,7 @@ jobs: commit-message: '[Bot] Deploy to GitHub Pages' clean: true - name: Move .api/streams.json to iptv-org/api - uses: JamesIves/github-pages-deploy-action@4.1.1 + uses: JamesIves/github-pages-deploy-action@164583b9e44b4fc5910e78feb607ea7c98d3c7b9 # 4.1.1 if: ${{ !env.ACT && github.ref == 'refs/heads/master' }} with: repository-name: iptv-org/api diff --git a/.github/workflows/validate_issue.yml b/.github/workflows/validate_issue.yml index 908d57eb34..62dcecc3a3 100644 --- a/.github/workflows/validate_issue.yml +++ b/.github/workflows/validate_issue.yml @@ -15,9 +15,9 @@ jobs: contains(github.event.issue.labels.*.name, 'streams:edit') steps: - name: Checkout repository code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: tibdex/github-app-token@v1.8.2 + - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2 if: ${{ !env.ACT }} id: create-app-token with: @@ -25,7 +25,7 @@ jobs: private_key: ${{ secrets.APP_PRIVATE_KEY }} - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 cache: 'npm' diff --git a/.github/workflows/validate_label.yml b/.github/workflows/validate_label.yml index 7d6096930c..0eda0e8a0c 100644 --- a/.github/workflows/validate_label.yml +++ b/.github/workflows/validate_label.yml @@ -12,9 +12,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: tibdex/github-app-token@v1.8.2 + - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2 if: ${{ !env.ACT }} id: create-app-token with: