diff --git a/.github/actions/generate-builder/action.yml b/.github/actions/generate-builder/action.yml index b158ac9736..c57f0f45fb 100644 --- a/.github/actions/generate-builder/action.yml +++ b/.github/actions/generate-builder/action.yml @@ -34,7 +34,7 @@ runs: using: "composite" steps: - name: Checkout the Go builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: repository: "${{ inputs.repository }}" ref: "${{ inputs.ref }}" @@ -62,7 +62,7 @@ runs: run: ./.github/actions/generate-builder/generate-builder.sh - name: Compute sha256 of builder - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@869ca2ccfe0cab8dee38ea6654ceac5823c1934d id: compute with: path: "${{ inputs.binary }}" diff --git a/.github/actions/secure-download-artifact/action.yml b/.github/actions/secure-download-artifact/action.yml index aa862566a5..24efbd3e8a 100644 --- a/.github/actions/secure-download-artifact/action.yml +++ b/.github/actions/secure-download-artifact/action.yml @@ -36,7 +36,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: path: "${{ inputs.path }}" diff --git a/.github/actions/secure-upload-artifact/action.yml b/.github/actions/secure-upload-artifact/action.yml index 3fa9061cd5..636834a910 100644 --- a/.github/actions/secure-upload-artifact/action.yml +++ b/.github/actions/secure-upload-artifact/action.yml @@ -18,7 +18,7 @@ runs: steps: - name: Compute binary hash id: compute-digest - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: path: "${{ inputs.path }}" diff --git a/.github/workflows/builder_go_slsa3.yml b/.github/workflows/builder_go_slsa3.yml index b5fb8f8857..1340cdf866 100644 --- a/.github/workflows/builder_go_slsa3.yml +++ b/.github/workflows/builder_go_slsa3.yml @@ -68,7 +68,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@869ca2ccfe0cab8dee38ea6654ceac5823c1934d detect-env: outputs: @@ -95,7 +95,7 @@ jobs: steps: - name: Generate builder id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -128,12 +128,12 @@ jobs: needs: [builder, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -166,12 +166,12 @@ jobs: needs: [builder, build-dry, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -217,7 +217,7 @@ jobs: - name: Upload generated binary id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" @@ -238,7 +238,7 @@ jobs: go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -290,14 +290,14 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download binary - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" sha256: "${{ needs.build.outputs.go-binary-sha256 }}" - name: Download provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ needs.provenance.outputs.go-provenance-name }}" path: "${{ needs.provenance.outputs.go-provenance-name }}" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index c7a79f3479..37f8bef175 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -44,7 +44,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@2ca79b6fa8d3ec278944088b4aa5f46912db5d63 # tag=v2.1.18 + uses: github/codeql-action/init@f5d217be74900c6ac8fbbe53f3c10376ba4e64da # tag=v2.1.19 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -57,7 +57,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@2ca79b6fa8d3ec278944088b4aa5f46912db5d63 # tag=v2.1.18 + uses: github/codeql-action/autobuild@f5d217be74900c6ac8fbbe53f3c10376ba4e64da # tag=v2.1.19 # Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -70,4 +70,4 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2ca79b6fa8d3ec278944088b4aa5f46912db5d63 # tag=v2.1.18 + uses: github/codeql-action/analyze@f5d217be74900c6ac8fbbe53f3c10376ba4e64da # tag=v2.1.19 diff --git a/.github/workflows/generator_container_slsa3.yml b/.github/workflows/generator_container_slsa3.yml index 8a94f5353c..afc36b71fd 100644 --- a/.github/workflows/generator_container_slsa3.yml +++ b/.github/workflows/generator_container_slsa3.yml @@ -57,7 +57,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@869ca2ccfe0cab8dee38ea6654ceac5823c1934d # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -81,7 +81,7 @@ jobs: packages: write steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -91,7 +91,7 @@ jobs: # NOTE: We are using the generic generator. directory: "${{ env.BUILDER_DIR }}" - - uses: sigstore/cosign-installer@09a077b27eb1310dcfb21981bee195b30ce09de0 # tag=v2.5.0 + - uses: sigstore/cosign-installer@b3413d484cc23cf8778c3d2aa361568d4eb54679 # tag=v2.5.1 - name: Login env: UNTRUSTED_IMAGE: "${{ inputs.image }}" diff --git a/.github/workflows/generator_generic_slsa3.yml b/.github/workflows/generator_generic_slsa3.yml index b7454f19b9..72243bc65a 100644 --- a/.github/workflows/generator_generic_slsa3.yml +++ b/.github/workflows/generator_generic_slsa3.yml @@ -69,7 +69,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@869ca2ccfe0cab8dee38ea6654ceac5823c1934d # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -93,7 +93,7 @@ jobs: actions: read steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -148,7 +148,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download the provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@bd5d98277f41bbe5ef9f7a4fd7e0031c9b8aef68 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@869ca2ccfe0cab8dee38ea6654ceac5823c1934d with: name: "${{ inputs.attestation-name }}" path: "${{ inputs.attestation-name }}" diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 475913737c..d4320d01f3 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -57,6 +57,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@2ca79b6fa8d3ec278944088b4aa5f46912db5d63 # tag=v2.1.18 + uses: github/codeql-action/upload-sarif@f5d217be74900c6ac8fbbe53f3c10376ba4e64da # tag=v2.1.19 with: sarif_file: results.sarif