Skip to content

ci: pin GitHub Actions to full commit SHAs to prevent supply-chain attacks #3611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
XananasX7 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: pin GitHub Actions to full commit SHAs to prevent supply-chain attacks #3611

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/check_tflite_files.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
runs-on: ubuntu-latest
name: Check PR Modifies TfLite Files
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/generate_integration_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
- uses: bazel-contrib/setup-bazel@0.18.0
with:
bazelisk-cache: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/log_binary_size_pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
(github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci:test')) ||
github.event_name == 'schedule'
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
fetch-depth: 0
token: ${{ secrets.TFLM_BOT_REPO_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pypi_build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
pypi-build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
token: ${{ secrets.TFLM_BOT_REPO_TOKEN }}
- name: Build Wheel 3.10
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/suite_cortex_m.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- name: Install dependencies
Expand All @@ -60,7 +60,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- name: Test
Expand All @@ -81,7 +81,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- name: Install dependencies
Expand All @@ -101,7 +101,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- name: Install dependencies
Expand All @@ -120,7 +120,7 @@ jobs:
timeout-minutes: 60
name: Cortex-M Generic (Arm Clang)
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- uses: actions/setup-python@v6
Expand Down Expand Up @@ -149,7 +149,7 @@ jobs:
timeout-minutes: 60
name: Cortex-M Corstone 300 (Arm Clang)
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- uses: actions/setup-python@v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/suite_hexagon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
timeout-minutes: 60
name: Hexagon Build Test
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/suite_riscv.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- name: Test
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/suite_xtensa.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
timeout-minutes: 60
name: Vision P6 Build
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -43,7 +43,7 @@ jobs:
timeout-minutes: 60
name: Hifi5 Unit Tests
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -62,7 +62,7 @@ jobs:
timeout-minutes: 60
name: Hifi5 Unit Tests with Compression
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -81,7 +81,7 @@ jobs:
timeout-minutes: 60
name: Hifi3z Unit Tests
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -100,7 +100,7 @@ jobs:
timeout-minutes: 60
name: Hifi3z Unit Tests with Compression
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -121,7 +121,7 @@ jobs:
timeout-minutes: 60
name: Fusion F1 Unit Tests
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -140,7 +140,7 @@ jobs:
timeout-minutes: 60
name: Vision P6 Unit Tests
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand All @@ -159,7 +159,7 @@ jobs:
timeout-minutes: 60
name: Hifimini Unit Tests
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- run: rm -rf .git
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
- uses: actions/setup-python@v6
with:
python-version: '3.10'
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
token: ${{ secrets.TFLM_BOT_REPO_TOKEN }}
- uses: bazel-contrib/setup-bazel@0.18.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test_bazel.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
script: test_bazel_with_compression_asan.sh
name: ${{ matrix.name }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- uses: bazel-contrib/setup-bazel@0.18.0
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/test_hosted.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
container:
image: ghcr.io/tflm-bot/tflm-ci:0.6.7
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- uses: bazel-contrib/setup-bazel@0.18.0
Expand All @@ -30,7 +30,7 @@ jobs:
runs-on: windows-x86-n2-16
timeout-minutes: 60
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- uses: actions/setup-python@v6
Expand All @@ -53,7 +53,7 @@ jobs:
timeout-minutes: 60
name: Windows Bazel
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- uses: actions/setup-python@v6
Expand Down Expand Up @@ -91,7 +91,7 @@ jobs:
timeout-minutes: 60
name: Windows Makefile
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- uses: msys2/setup-msys2@v2
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test_makefile.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
script: test_x86_no_tflite_static_memory.sh
name: ${{ matrix.name }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- name: Test
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test_misc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
container:
image: ghcr.io/tflm-bot/tflm-ci:0.6.7
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- name: Check
Expand All @@ -29,7 +29,7 @@ jobs:
image: ghcr.io/tflm-bot/tflm-ci:0.6.7
name: C++ Build Warnings
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha || github.ref }}
- uses: bazel-contrib/setup-bazel@0.18.0
Expand All @@ -49,7 +49,7 @@ jobs:
container:
image: ghcr.io/tflm-bot/tflm-ci:0.6.7
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- uses: bazel-contrib/setup-bazel@0.18.0
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test_windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
timeout-minutes: 60
name: Windows Bazel
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- uses: actions/setup-python@v6
Expand Down Expand Up @@ -51,7 +51,7 @@ jobs:
timeout-minutes: 60
name: Windows Makefile
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ inputs.trigger-sha }}
- uses: msys2/setup-msys2@v2
Expand Down
Loading