supabase-postgres.git / summary / log / commit / refs
commit a17f610c3607369cedabbd72ef48b541be8237d2
Author: Etienne Stalmans <staaldraad@users.noreply.github.com>
Commit: GitHub <noreply@github.com>
Date: Thu Jan 22 15:50:21 2026 +0000
chore: pin all actions (#2013)
.github/actions/nix-install-ephemeral/action.yml | 4 ++--
.github/actions/nix-install-self-hosted/action.yml | 2 +-
.github/actions/shared-checkout/action.yml | 2 +-
.github/workflows/ami-release-nix-single.yml | 10 +++++-----
.github/workflows/ami-release-nix.yml | 14 +++++++-------
.github/workflows/base-image-nightly.yml | 6 +++---
.github/workflows/dockerhub-release-matrix.yml | 14 +++++++-------
.github/workflows/manual-docker-release.yml | 14 +++++++-------
.github/workflows/mirror-postgrest.yml | 2 +-
.github/workflows/mirror.yml | 8 ++++----
.github/workflows/nix-build.yml | 12 ++++++------
.github/workflows/nix-eval.yml | 4 ++--
.github/workflows/publish-migrations-prod.yml | 2 +-
.github/workflows/publish-migrations-staging.yml | 2 +-
.../workflows/publish-nix-pgupgrade-bin-flake-version.yml | 8 ++++----
.github/workflows/publish-nix-pgupgrade-scripts.yml | 8 ++++----
.github/workflows/qemu-image-build.yml | 10 +++++-----
.github/workflows/testinfra-ami-build.yml | 6 +++---
18 files changed, 64 insertions(+), 64 deletions(-)
diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml
index b30a31db..93496549 100644
--- a/.github/actions/nix-install-ephemeral/action.yml
+++ b/.github/actions/nix-install-ephemeral/action.yml
@@ -13,7 +13,7 @@ runs:
using: 'composite'
steps:
- name: aws-creds
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
if: ${{ inputs.push-to-cache == 'true' }}
with:
role-to-assume: ${{ env.DEV_AWS_ROLE }}
@@ -41,7 +41,7 @@ runs:
env:
NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }}
- name: Install nix
- uses: cachix/install-nix-action@v31
+ uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
with:
install_url: https://releases.nixos.org/nix/nix-2.32.2/install
extra_nix_config: |
diff --git a/.github/actions/nix-install-self-hosted/action.yml b/.github/actions/nix-install-self-hosted/action.yml
index 52e49db9..755d3669 100644
--- a/.github/actions/nix-install-self-hosted/action.yml
+++ b/.github/actions/nix-install-self-hosted/action.yml
@@ -10,7 +10,7 @@ runs:
using: 'composite'
steps:
- name: aws-creds
- uses: aws-actions/configure-aws-credentials@v4.3.1
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
disable-retry: true
aws-region: us-east-2
diff --git a/.github/actions/shared-checkout/action.yml b/.github/actions/shared-checkout/action.yml
index 59a236db..a490dd26 100644
--- a/.github/actions/shared-checkout/action.yml
+++ b/.github/actions/shared-checkout/action.yml
@@ -4,7 +4,7 @@ runs:
using: "composite"
steps:
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
ref: ${{ github.event.pull_request.head.sha || github.sha }}
diff --git a/.github/workflows/ami-release-nix-single.yml b/.github/workflows/ami-release-nix-single.yml
index e4d18a7e..ff23bddd 100644
--- a/.github/workflows/ami-release-nix-single.yml
+++ b/.github/workflows/ami-release-nix-single.yml
@@ -29,7 +29,7 @@ jobs:
ref: ${{ github.event.inputs.branch }}
- name: aws-creds
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -74,7 +74,7 @@ jobs:
tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" .
- name: configure aws credentials - staging
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -95,7 +95,7 @@ jobs:
aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
- name: configure aws credentials - prod
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
aws-region: "us-east-1"
@@ -116,7 +116,7 @@ jobs:
aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
- name: Create release
- uses: softprops/action-gh-release@v2
+ uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
with:
name: ${{ steps.process_release_version.outputs.version }}
tag_name: ${{ steps.process_release_version.outputs.version }}
@@ -124,7 +124,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index 76c56cd9..ec45a8c4 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -48,7 +48,7 @@ jobs:
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
- name: aws-creds
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -97,7 +97,7 @@ jobs:
tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" .
- name: configure aws credentials - staging
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -118,7 +118,7 @@ jobs:
aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
- name: configure aws credentials - prod
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
aws-region: "us-east-1"
@@ -139,14 +139,14 @@ jobs:
aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
- name: GitHub OIDC Auth
- uses: aws-actions/configure-aws-credentials@v4.1.0
+ uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
aws-region: ap-southeast-1
role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
role-session-name: shared-services-jump
- name: Assume destination role
- uses: aws-actions/configure-aws-credentials@v4.1.0
+ uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
aws-region: ap-southeast-1
role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512
@@ -185,7 +185,7 @@ jobs:
echo "Catalog uploaded to ${CATALOG_S3}"
- name: Create release
- uses: softprops/action-gh-release@v2
+ uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
with:
name: ${{ steps.process_release_version.outputs.version }}
tag_name: ${{ steps.process_release_version.outputs.version }}
@@ -193,7 +193,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/base-image-nightly.yml b/.github/workflows/base-image-nightly.yml
index 21654bb3..36f896e4 100644
--- a/.github/workflows/base-image-nightly.yml
+++ b/.github/workflows/base-image-nightly.yml
@@ -27,7 +27,7 @@ jobs:
ref: ${{ github.event.inputs.branch || 'develop' }}
- name: Configure AWS credentials
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -35,7 +35,7 @@ jobs:
role-duration-seconds: 7200
- name: Install nix
- uses: cachix/install-nix-action@v27
+ uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
with:
install_url: https://releases.nixos.org/nix/nix-2.29.1/install
extra_nix_config: |
@@ -66,7 +66,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml
index 3eb4a5b7..539d29d1 100644
--- a/.github/workflows/dockerhub-release-matrix.yml
+++ b/.github/workflows/dockerhub-release-matrix.yml
@@ -82,10 +82,10 @@ jobs:
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
- uses: ./.github/actions/nix-install-ephemeral
- run: docker context create builders
- - uses: docker/setup-buildx-action@v3
+ - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
with:
endpoint: builders
- - uses: docker/login-action@v2
+ - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -116,7 +116,7 @@ jobs:
echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
fi
- id: build
- uses: docker/build-push-action@v5
+ uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
with:
push: true
build-args: |
@@ -137,8 +137,8 @@ jobs:
- name: Checkout Repo
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
- uses: ./.github/actions/nix-install-ephemeral
- - uses: docker/setup-buildx-action@v3
- - uses: docker/login-action@v2
+ - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+ - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -164,7 +164,7 @@ jobs:
run: |
echo "${{ steps.output_version.outputs.result }}" >> results.txt # Append results
- name: Upload Results Artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: merge_results-${{ matrix.version }}
path: results.txt
@@ -203,7 +203,7 @@ jobs:
$"versions=$versions_str" | save --append $env.GITHUB_ENV
'
- name: Download Results Artifacts
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
pattern: merge_results-*
- name: Combine Results
diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml
index 4214225e..cbc296ef 100644
--- a/.github/workflows/manual-docker-release.yml
+++ b/.github/workflows/manual-docker-release.yml
@@ -79,10 +79,10 @@ jobs:
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
- uses: ./.github/actions/nix-install-ephemeral
- run: docker context create builders
- - uses: docker/setup-buildx-action@v3
+ - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
with:
endpoint: builders
- - uses: docker/login-action@v2
+ - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -125,7 +125,7 @@ jobs:
echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
fi
- id: build
- uses: docker/build-push-action@v5
+ uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
with:
push: true
build-args: |
@@ -146,8 +146,8 @@ jobs:
- name: Checkout Repo
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
- uses: ./.github/actions/nix-install-ephemeral
- - uses: docker/setup-buildx-action@v3
- - uses: docker/login-action@v2
+ - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+ - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -173,7 +173,7 @@ jobs:
run: |
echo "${{ steps.output_version.outputs.result }}" >> results.txt # Append results
- name: Upload Results Artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: merge_results-${{ matrix.version }}
path: results.txt
@@ -212,7 +212,7 @@ jobs:
$"versions=$versions_str" | save --append $env.GITHUB_ENV
'
- name: Download Results Artifacts
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
pattern: merge_results-*
- name: Combine Results
diff --git a/.github/workflows/mirror-postgrest.yml b/.github/workflows/mirror-postgrest.yml
index d649445b..6d2d0353 100644
--- a/.github/workflows/mirror-postgrest.yml
+++ b/.github/workflows/mirror-postgrest.yml
@@ -20,7 +20,7 @@ jobs:
- name: Checkout Repo
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
- id: args
- uses: mikefarah/yq@master
+ uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4.50.1
with:
cmd: yq '.postgrest_release' 'ansible/vars.yml'
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 28a06827..ea8b95bd 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -25,19 +25,19 @@ jobs:
id-token: write
steps:
- name: configure aws credentials
- uses: aws-actions/configure-aws-credentials@v2.2.0
+ uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
with:
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
aws-region: us-east-1
- - uses: docker/login-action@v2
+ - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
registry: public.ecr.aws
- - uses: docker/login-action@v2
+ - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- - uses: akhilerm/tag-push-action@v2.1.0
+ - uses: akhilerm/tag-push-action@85bf542f43f5f2060ef76262a67ee3607cb6db37 # v2.1.0
with:
src: docker.io/supabase/postgres:${{ inputs.version }}
dst: |
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 2b8945d6..509893eb 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -35,7 +35,7 @@ jobs:
steps:
- name: Checkout Repo
if: ${{ matrix.attr != '' }}
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix (ephemeral)
if: ${{ matrix.attr != '' && matrix.runs_on.group != 'self-hosted-runners-nix' }}
uses: ./.github/actions/nix-install-ephemeral
@@ -66,7 +66,7 @@ jobs:
steps:
- name: Checkout Repo
if: ${{ matrix.attr != '' }}
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix (ephemeral)
if: ${{ matrix.attr != '' && matrix.runs_on.group != 'self-hosted-runners-nix' }}
uses: ./.github/actions/nix-install-ephemeral
@@ -97,7 +97,7 @@ jobs:
steps:
- name: Checkout Repo
if: ${{ matrix.attr != '' }}
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix
if: ${{ matrix.attr != '' }}
uses: ./.github/actions/nix-install-self-hosted
@@ -120,7 +120,7 @@ jobs:
steps:
- name: Checkout Repo
if: ${{ matrix.attr != '' }}
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix
if: ${{ matrix.attr != '' }}
uses: ./.github/actions/nix-install-self-hosted
@@ -143,7 +143,7 @@ jobs:
steps:
- name: Checkout Repo
if: ${{ matrix.attr != '' }}
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix
if: ${{ matrix.attr != '' }}
uses: ./.github/actions/nix-install-ephemeral
@@ -171,7 +171,7 @@ jobs:
steps:
- name: Checkout Repo
if: ${{ matrix.attr != '' }}
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix
if: ${{ matrix.attr != '' }}
uses: ./.github/actions/nix-install-ephemeral
diff --git a/.github/workflows/nix-eval.yml b/.github/workflows/nix-eval.yml
index c8967a63..9960923f 100644
--- a/.github/workflows/nix-eval.yml
+++ b/.github/workflows/nix-eval.yml
@@ -23,7 +23,7 @@ jobs:
checks_matrix: ${{ steps.set-matrix.outputs.checks_matrix }}
steps:
- name: Checkout Repo
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Install nix
uses: ./.github/actions/nix-install-ephemeral
with:
@@ -35,7 +35,7 @@ jobs:
run: |
sudo mv /nix/var/nix/daemon-socket/socket /tmp
- name: Mount Nix cache disk
- uses: useblacksmith/stickydisk@v1
+ uses: useblacksmith/stickydisk@a652394bf1bf95399f406e648482b41fbd25c51f # v1
with:
key: ${{ github.repository }}-nix-cache-eval-${{ runner.os }}
path: /nix
diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml
index 81c686db..87946346 100644
--- a/.github/workflows/publish-migrations-prod.yml
+++ b/.github/workflows/publish-migrations-prod.yml
@@ -29,7 +29,7 @@ jobs:
working-directory: ${{ github.workspace }}/migrations/db/migrations
- name: configure aws credentials - prod
- uses: aws-actions/configure-aws-credentials@v1
+ uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
with:
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
aws-region: "ap-southeast-1"
diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml
index 82f01bcf..577478d7 100644
--- a/.github/workflows/publish-migrations-staging.yml
+++ b/.github/workflows/publish-migrations-staging.yml
@@ -22,7 +22,7 @@ jobs:
working-directory: ${{ github.workspace }}/migrations/db/migrations
- name: configure aws credentials - staging
- uses: aws-actions/configure-aws-credentials@v1
+ uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "ap-southeast-1"
diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
index 1e1b69b1..1db5f50c 100644
--- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
+++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
@@ -59,7 +59,7 @@ jobs:
tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
- name: configure aws credentials - staging
- uses: aws-actions/configure-aws-credentials@v1
+ uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -72,7 +72,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
@@ -108,7 +108,7 @@ jobs:
tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
- name: configure aws credentials - prod
- uses: aws-actions/configure-aws-credentials@v1
+ uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
with:
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
aws-region: "us-east-1"
@@ -121,7 +121,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml
index 029d7dea..09b0b039 100644
--- a/.github/workflows/publish-nix-pgupgrade-scripts.yml
+++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml
@@ -64,7 +64,7 @@ jobs:
tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts
- name: configure aws credentials - staging
- uses: aws-actions/configure-aws-credentials@v1
+ uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "us-east-1"
@@ -75,7 +75,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
@@ -115,7 +115,7 @@ jobs:
tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts
- name: configure aws credentials - prod
- uses: aws-actions/configure-aws-credentials@v1
+ uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
with:
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
aws-region: "us-east-1"
@@ -126,7 +126,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 0f474087..d9c98a75 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -98,14 +98,14 @@ jobs:
echo "version=$VERSION" >> $GITHUB_OUTPUT
- name: configure aws credentials - staging
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.CONTROL_PLANE_DEV_ROLE }}
aws-region: "us-east-1"
- name: Login to Amazon ECR
id: login-ecr-private-dev
- uses: aws-actions/amazon-ecr-login@v2
+ uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
- name: Build image
env:
@@ -124,14 +124,14 @@ jobs:
# TODO (darora): temporarily also push to prod account from here - add a guard to only publish proper tagged releases to prod?
- name: configure aws credentials - prod
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.CONTROL_PLANE_PROD_ROLE }}
aws-region: "us-east-1"
- name: Login to Amazon ECR
id: login-ecr-private-prod
- uses: aws-actions/amazon-ecr-login@v2
+ uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
- name: Push docker image to Amazon ECR
env:
@@ -144,7 +144,7 @@ jobs:
- name: Slack Notification on Failure
if: ${{ failure() }}
- uses: rtCamp/action-slack-notify@v2
+ uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
SLACK_USERNAME: 'gha-failures-notifier'
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index c208b43d..c071737e 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -62,7 +62,7 @@ jobs:
fi
- name: Configure AWS credentials
- uses: aws-actions/configure-aws-credentials@v4
+ uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
with:
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
aws-region: "ap-southeast-1"
@@ -79,13 +79,13 @@ jobs:
NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
- id: args
- uses: mikefarah/yq@master
+ uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4.50.1
with:
cmd: yq 'to_entries | map(select(.value|type == "!!str")) | map(.key + "=" + .value) | join("\n")' 'ansible/vars.yml'
- run: docker context create builders
- - uses: docker/setup-buildx-action@v3
+ - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
with:
endpoint: builders
[parent: 880813867873]