Skip to content

Commit f7a80c4

Browse files
lucasssvazlucasssvaz
committed
ci(workflows): Lock actions to commits and improve readability
1 parent ea4be13 commit f7a80c4

22 files changed

+146
-116
lines changed

‎.github/workflows/allboards.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515

1616
steps:
1717
- name: Checkout repository
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1919
with:
2020
ref: ${{ github.event.client_payload.branch }}
2121

@@ -32,13 +32,13 @@ jobs:
3232

3333
steps:
3434
- name: Checkout repository
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636
with:
3737
ref: ${{ github.event.client_payload.branch }}
3838

3939
- run: npm install
4040
- name: Setup jq
41-
uses: dcarbone/install-jq-action@v1.0.1
41+
uses: dcarbone/install-jq-action@e397bd87438d72198f81efd21f876461183d383a # v3.0.1
4242

4343
- id: set-test-chunks
4444
name: Set Chunks
@@ -64,7 +64,7 @@ jobs:
6464

6565
steps:
6666
- name: Checkout repository
67-
uses: actions/checkout@v4
67+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6868
with:
6969
ref: ${{ github.event.client_payload.branch }}
7070

@@ -74,7 +74,7 @@ jobs:
7474
FQBN: ${{ toJSON(matrix.chunk) }}
7575

7676
- name: Compile sketch
77-
uses: P-R-O-C-H-Y/compile-sketches@main
77+
uses: P-R-O-C-H-Y/compile-sketches@a62f069b92dc8f5053da4ac439ea6d1950cf6379 # main
7878
with:
7979
platforms: |
8080
${{ env.REPOSITORY }}

‎.github/workflows/boards.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ jobs:
2222
steps:
2323
# This step makes the contents of the repository available to the workflow
2424
- name: Checkout repository
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2626

2727
- name: Setup jq
28-
uses: dcarbone/install-jq-action@v1.0.1
28+
uses: dcarbone/install-jq-action@e397bd87438d72198f81efd21f876461183d383a # v3.0.1
2929

3030
- name: Get board name
3131
run: bash .github/scripts/find_new_boards.sh ${{ github.repository }} ${{github.base_ref}}
@@ -47,7 +47,7 @@ jobs:
4747
steps:
4848
# This step makes the contents of the repository available to the workflow
4949
- name: Checkout repository
50-
uses: actions/checkout@v4
50+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5151

5252
- name: Check if build.board is uppercase
5353
run: |
@@ -60,7 +60,7 @@ jobs:
6060
fi
6161
6262
- name: Get libs cache
63-
uses: actions/cache@v4
63+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 # v4.2.3
6464
with:
6565
key: libs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package/package_esp32_index.template.json', 'tools/get.py') }}
6666
path: |
@@ -73,7 +73,7 @@ jobs:
7373
./tools/xtensa-*
7474
7575
- name: Compile sketch
76-
uses: P-R-O-C-H-Y/compile-sketches@main
76+
uses: P-R-O-C-H-Y/compile-sketches@a62f069b92dc8f5053da4ac439ea6d1950cf6379 # main
7777
with:
7878
platforms: |
7979
${{ env.REPOSITORY }}

‎.github/workflows/build_py_tools.yml

+14-5
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
all_changed_files: ${{ steps.verify-changed-files.outputs.all_changed_files }}
1919
steps:
2020
- name: Checkout repository
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2222
with:
2323
fetch-depth: 2
2424
ref: ${{ github.event.pull_request.head.ref }}
@@ -30,7 +30,7 @@ jobs:
3030
echo "Make sure you are using a branch inside the repository and not a fork."
3131
3232
- name: Verify Python Tools Changed
33-
uses: tj-actions/changed-files@v41
33+
uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
3434
id: verify-changed-files
3535
with:
3636
fetch_depth: "2"
@@ -40,6 +40,7 @@ jobs:
4040
tools/espota.py
4141
tools/gen_esp32part.py
4242
tools/gen_insights_package.py
43+
4344
- name: List all changed files
4445
shell: bash
4546
run: |
@@ -88,25 +89,30 @@ jobs:
8889
for tool in ${{ env.CHANGED_TOOLS }}; do
8990
echo "tool $tool was changed"
9091
done
92+
9193
- name: Checkout repository
92-
uses: actions/checkout@v4
94+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9395
with:
9496
token: ${{ secrets.TOOLS_UPLOAD_PAT }}
9597
ref: ${{ github.event.pull_request.head.ref }}
98+
9699
- name: Set up Python 3.8
97-
uses: actions/setup-python@master
100+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.0.4
98101
with:
99102
python-version: 3.8
103+
100104
- name: Install dependencies
101105
run: |
102106
python -m pip install --upgrade pip
103107
pip install pyinstaller requests
108+
104109
- name: Build with PyInstaller
105110
shell: bash
106111
run: |
107112
for tool in ${{ env.CHANGED_TOOLS }}; do
108113
pyinstaller --distpath ./${{ env.DISTPATH }} -F --icon=.github/pytools/espressif.ico tools/$tool.py
109114
done
115+
110116
- name: Sign binaries
111117
if: matrix.os == 'windows-latest'
112118
env:
@@ -119,12 +125,14 @@ jobs:
119125
{
120126
./.github/pytools/Sign-File.ps1 -Path ./${{ env.DISTPATH }}/$node.exe
121127
}
128+
122129
- name: Test binaries
123130
shell: bash
124131
run: |
125132
for tool in ${{ env.CHANGED_TOOLS }}; do
126133
./${{ env.DISTPATH }}/$tool${{ matrix.EXTEN }} -h
127134
done
135+
128136
- name: Push binary to tools
129137
if: matrix.os == 'windows-latest'
130138
env:
@@ -135,8 +143,9 @@ jobs:
135143
cp -f ./${{ env.DISTPATH }}/$tool.exe tools/$tool.exe
136144
done
137145
bash .github/scripts/upload_py_tools.sh "${{ env.CHANGED_TOOLS }}"
146+
138147
- name: Archive artifact
139-
uses: actions/upload-artifact@master
148+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
140149
with:
141150
name: ${{ env.DISTPATH }}
142151
path: ${{ env.DISTPATH }}

‎.github/workflows/dangerjs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Check out PR head
15-
uses: actions/checkout@v4
15+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616
with:
1717
ref: ${{ github.event.pull_request.head.sha }}
1818

1919
- name: DangerJS pull request linter
20-
uses: espressif/shared-github-dangerjs@v1
20+
uses: espressif/shared-github-dangerjs@fb17367fd3e8ff7412603b8e946d9b19ffdb2d7f # v1
2121
env:
2222
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2323
with:

‎.github/workflows/docs_build.yml

+6-3
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,16 @@ jobs:
2121
run:
2222
shell: bash
2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2525
with:
2626
submodules: true
27-
- uses: actions/setup-python@v5
27+
28+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.0.4
2829
with:
2930
cache-dependency-path: docs/requirements.txt
3031
cache: "pip"
3132
python-version: "3.10"
33+
3234
- name: Build
3335
run: |
3436
sudo apt update
@@ -38,8 +40,9 @@ jobs:
3840
cd ./docs
3941
PATH=/home/runner/.local/bin:$PATH pip3 install -r requirements.txt --prefer-binary
4042
PATH=/home/runner/.local/bin:$PATH SPHINXOPTS="-W" build-docs -l en
43+
4144
- name: Archive Docs
42-
uses: actions/upload-artifact@v4
45+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
4346
with:
4447
name: docs
4548
path: docs

‎.github/workflows/docs_deploy.yml

+5-2
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,17 @@ jobs:
2626
run: |
2727
echo "Release workflow failed. Exiting..."
2828
exit 1
29-
- uses: actions/checkout@v4
29+
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3031
with:
3132
submodules: true
32-
- uses: actions/setup-python@v5
33+
34+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.0.4
3335
with:
3436
cache-dependency-path: docs/requirements.txt
3537
cache: "pip"
3638
python-version: "3.10"
39+
3740
- name: Deploy Documentation
3841
env:
3942
# Deploy to production server

‎.github/workflows/gh-pages.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,9 @@ jobs:
1515
name: Build GitHub Pages
1616
runs-on: ubuntu-latest
1717
steps:
18-
- uses: actions/checkout@v4
18+
- name: Checkout repository
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
1921
- name: Copy Files
2022
env:
2123
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/lib.yml

+8-7
Original file line numberDiff line numberDiff line change
@@ -62,10 +62,10 @@ jobs:
6262
steps:
6363
# This step makes the contents of the repository available to the workflow
6464
- name: Checkout repository
65-
uses: actions/checkout@v4
65+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6666

6767
- name: Compile sketch
68-
uses: P-R-O-C-H-Y/compile-sketches@main
68+
uses: P-R-O-C-H-Y/compile-sketches@a62f069b92dc8f5053da4ac439ea6d1950cf6379 # main
6969
with:
7070
platforms: |
7171
${{ env.REPOSITORY }}
@@ -80,7 +80,7 @@ jobs:
8080
- --warnings="all"
8181
8282
- name: Upload artifact
83-
uses: actions/upload-artifact@v4
83+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8484
with:
8585
name: ${{ env.SKETCHES_REPORTS_ARTIFACT_NAME }}-${{ matrix.target }}
8686
path: ${{ env.SKETCHES_REPORTS_PATH }}
@@ -92,7 +92,7 @@ jobs:
9292
steps:
9393
# Check out repository
9494
- name: Checkout repository
95-
uses: actions/checkout@v4
95+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
9696
with:
9797
token: ${{ env.GITHUB_TOKEN }}
9898
fetch-depth: "0"
@@ -102,14 +102,14 @@ jobs:
102102

103103
# This step is needed to get the size data produced by the compile jobs
104104
- name: Download sketches reports artifact
105-
uses: actions/download-artifact@v4
105+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
106106
with:
107107
pattern: ${{ env.SKETCHES_REPORTS_ARTIFACT_NAME }}-*
108108
merge-multiple: true
109109
path: ${{ env.SKETCHES_REPORTS_PATH }}
110110

111111
- name: Report results
112-
uses: P-R-O-C-H-Y/report-size-deltas@main
112+
uses: P-R-O-C-H-Y/report-size-deltas@4a79caa6dcc3579024293638b97156106edc588e # main
113113
with:
114114
sketches-reports-source: ${{ env.SKETCHES_REPORTS_PATH }}
115115
destination-file: ${{ env.RESULT_LIBRARY_TEST_FILE }}
@@ -136,8 +136,9 @@ jobs:
136136
env:
137137
PR_NUM: ${{ github.event.number }}
138138
run: echo $PR_NUM > pr_num.txt
139+
139140
- name: Upload PR number
140-
uses: actions/upload-artifact@v4
141+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
141142
with:
142143
name: pr_number
143144
path: ./pr_num.txt

‎.github/workflows/pre-commit-status.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Report success
20-
uses: actions/github-script@v7
20+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
2121
with:
2222
script: |
2323
const owner = '${{ github.repository_owner }}';
@@ -43,7 +43,7 @@ jobs:
4343
runs-on: ubuntu-latest
4444
steps:
4545
- name: Report pending
46-
uses: actions/github-script@v7
46+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
4747
with:
4848
script: |
4949
const owner = '${{ github.repository_owner }}';

‎.github/workflows/pre-commit.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Checkout latest commit
26-
uses: actions/checkout@v4
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2727
with:
2828
fetch-depth: 2
2929

@@ -34,7 +34,7 @@ jobs:
3434
GH_TOKEN: ${{ github.token }}
3535

3636
- name: Set up Python 3
37-
uses: actions/setup-python@v5
37+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.0.4
3838
with:
3939
cache-dependency-path: tools/pre-commit/requirements.txt
4040
cache: "pip"
@@ -46,7 +46,7 @@ jobs:
4646
echo "PY_HASH=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
4747
4848
- name: Restore pre-commit cache
49-
uses: actions/cache/restore@v4
49+
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
5050
id: restore-cache
5151
with:
5252
path: |
@@ -58,13 +58,13 @@ jobs:
5858

5959
- name: Get changed files
6060
id: changed-files
61-
uses: tj-actions/changed-files@v42.0.2
61+
uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
6262

6363
- name: Run pre-commit hooks in changed files
6464
run: pre-commit run --color=always --show-diff-on-failure --files ${{ steps.changed-files.outputs.all_changed_files }}
6565

6666
- name: Save pre-commit cache
67-
uses: actions/cache/save@v4
67+
uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
6868
if: ${{ always() && steps.restore-cache.outputs.cache-hit != 'true' }}
6969
continue-on-error: true
7070
with:
@@ -73,7 +73,7 @@ jobs:
7373
key: ${{ steps.restore-cache.outputs.cache-primary-key }}
7474

7575
- name: Push changes using pre-commit-ci-lite
76-
uses: pre-commit-ci/lite-action@v1.1.0
76+
uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
7777
# Only push changes in PRs
7878
if: ${{ always() && github.event_name == 'pull_request' }}
7979
with:

‎.github/workflows/publishlib.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,12 @@ jobs:
4444
4545
- name: Read the pr_num file
4646
id: pr_num_reader
47-
uses: juliangruber/read-file-action@v1
47+
uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1.1.7
4848
with:
4949
path: ./artifacts/workflows/pr_num.txt
5050

5151
- name: Report results
52-
uses: P-R-O-C-H-Y/report-size-deltas@libs
52+
uses: P-R-O-C-H-Y/report-size-deltas@256d1f13e4195cd7fd436d2f959e6dc4d5e4b406 # libs
5353
with:
5454
sketches-reports-source: ${{ env.SKETCHES_REPORTS_PATH }}
5555
github-token: ${{ env.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)