[openssh-commits] [openssh] 03/03: Add script to lookup and pin Actions to hashes.
git+noreply at mindrot.org
git+noreply at mindrot.org
Mon Jun 22 20:42:38 AEST 2026
This is an automated email from the git hooks/post-receive script.
dtucker pushed a commit to branch master
in repository openssh.
commit 01404fa5da11ed08c6ebecd09aaa3ebfbd79f206
Author: Darren Tucker <dtucker at dtucker.net>
AuthorDate: Mon Jun 22 19:00:15 2026 +1000
Add script to lookup and pin Actions to hashes.
Update recently changed Cygwin Actions and pin remaining unpinned ones.
---
.github/pin_actions.sh | 33 +++++++++++++++++++++++++++++++++
.github/workflows/c-cpp.yml | 4 ++--
.github/workflows/cifuzz.yml | 6 +++---
.github/workflows/selfhosted.yml | 8 ++++----
.github/workflows/upstream.yml | 2 +-
.github/workflows/vm.yml | 32 ++++++++++++++++----------------
6 files changed, 59 insertions(+), 26 deletions(-)
diff --git a/.github/pin_actions.sh b/.github/pin_actions.sh
new file mode 100755
index 000000000..cb175f250
--- /dev/null
+++ b/.github/pin_actions.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+#
+# Look up specified version of Github Actions an pin to that specific
+# revision.
+#
+
+set -e
+
+github=https://github.com
+
+for workflow in workflows/*.yml; do
+ echo workflow: $workflow
+ sed 's/ - / /' ${workflow} | grep -v '^#' | awk '/uses:/ {print}' | \
+ while read line; do
+ action_ver=$(awk '{print $2}' <<<${line})
+ action=$(cut -f1 -d@ <<<${action_ver})
+ ver=$(cut -f2 -d@ <<<${action_ver})
+ intendedver=$(awk '{print $4}' <<<${line})
+ if [ -z "${intendedver}" ]; then
+ intendedver=${ver}
+ fi
+ case "${action}" in
+ google/oss-fuzz/*) actiondir=google/oss-fuzz ;;
+ *) actiondir="${action}" ;;
+ esac
+ if [ ! -d /tmp/${actiondir} ]; then
+ git clone ${github}/${actiondir} /tmp/${actiondir}
+ fi
+ hash=$(cd /tmp/${actiondir} && git rev-parse ${intendedver})
+ sed -i -e "s|uses: ${action}@.*|uses: ${action}@${hash} # ${intendedver}|" \
+ ${workflow}
+ done
+done
diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index 4ddaf0fc1..44be98e19 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -134,10 +134,10 @@ jobs:
- name: install cygwin
id: cygwin_install
if: ${{ startsWith(matrix.target, 'windows') }}
- uses: cygwin/cygwin-install-action at 4ef15ca7fd18a18f1000989fcfd968e06d146ce8 # master
+ uses: cygwin/cygwin-install-action at a3d72946b163026bbd0fa9a88379ccbda4bd86bb # master
env:
CYGWIN: "winsymlinks:native"
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: setup CI system
run: |
sh -c "timeout 1200 .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }} || .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}"
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index ab8b1c6e0..286b39c12 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -12,20 +12,20 @@ jobs:
steps:
- name: Build Fuzzers
id: build
- uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers at master
+ uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers at b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master
with:
oss-fuzz-project-name: 'openssh'
dry-run: false
language: c++
- name: Run Fuzzers
- uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers at master
+ uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers at b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master
with:
oss-fuzz-project-name: 'openssh'
fuzz-seconds: 600
dry-run: false
language: c++
- name: Upload Crash
- uses: actions/upload-artifact at main
+ uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
if: failure() && steps.build.outcome == 'success'
with:
name: artifacts
diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml
index 008fa60f8..d9f38472c 100644
--- a/.github/workflows/selfhosted.yml
+++ b/.github/workflows/selfhosted.yml
@@ -105,7 +105,7 @@ jobs:
- name: shutdown VM if running
if: env.VM == 'true'
run: vmshutdown
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: autoreconf
- name: startup VM
@@ -119,7 +119,7 @@ jobs:
- name: configure
run: vmrun ./.github/configure.sh ${{ matrix.config }}
# - name: save config
-# uses: actions/upload-artifact at main
+# uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
# with:
# name: ${{ matrix.target }}-${{ matrix.config }}-config
# path: config.h
@@ -135,7 +135,7 @@ jobs:
run: vmrun 'for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done'
- name: save logs
if: failure()
- uses: actions/upload-artifact at main
+ uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: ${{ matrix.target }}-${{ matrix.config }}-logs
path: |
@@ -184,7 +184,7 @@ jobs:
- name: bigendian interop - save logs
if: failure() && env.BIGENDIAN == 'true'
- uses: actions/upload-artifact at main
+ uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: ${{ matrix.target }}-${{ matrix.config }}-interop-logs
path: |
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 867573251..74a0bc8ba 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -36,7 +36,7 @@ jobs:
- name: shutdown VM if running
run: vmshutdown
working-directory: ${{ runner.temp }}
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: startup VM
run: vmstartup
working-directory: ${{ runner.temp }}
diff --git a/.github/workflows/vm.yml b/.github/workflows/vm.yml
index 2aaab0980..023528571 100644
--- a/.github/workflows/vm.yml
+++ b/.github/workflows/vm.yml
@@ -23,12 +23,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start DragonFlyBSD ${{ matrix.target }} VM
- uses: vmactions/dragonflybsd-vm at v1
+ uses: vmactions/dragonflybsd-vm at 4ba8127bd95c94b66fc4b885e37c99955ba308ea # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -86,12 +86,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start FreeBSD ${{ matrix.target }} VM
- uses: vmactions/freebsd-vm at v1
+ uses: vmactions/freebsd-vm at b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -168,12 +168,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start NetBSD ${{ matrix.target }} VM
- uses: vmactions/netbsd-vm at v1
+ uses: vmactions/netbsd-vm at 99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -243,12 +243,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OmniOS ${{ matrix.target }} VM
- uses: vmactions/omnios-vm at v1
+ uses: vmactions/omnios-vm at 7f2be0b927aad1a78498c8aeeac4c4ce1fabd322 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -300,12 +300,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OpenBSD ${{ matrix.target }} VM
- uses: vmactions/openbsd-vm at v1
+ uses: vmactions/openbsd-vm at 18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -349,7 +349,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: start OpenBSD VM
- uses: vmactions/openbsd-vm at v1
+ uses: vmactions/openbsd-vm at 18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
copyback: false
nat: |
@@ -371,7 +371,7 @@ jobs:
echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV
- name: check for cached sysupgrade
id: cache-sysupgrade
- uses: actions/cache at v4
+ uses: actions/cache at 0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
@@ -391,7 +391,7 @@ jobs:
rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/
- name: save sysupgrade to cache
if: steps.cache-sysupgrade.outputs.cache-hit != 'true'
- uses: actions/cache/save at v4
+ uses: actions/cache/save at 0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
@@ -431,7 +431,7 @@ jobs:
for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done
- name: save logs
if: failure()
- uses: actions/upload-artifact at main
+ uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: openbsd-current-upstream-logs
path: regress-logs/*.log
@@ -449,12 +449,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout at main
+ - uses: actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start Solaris ${{ matrix.target }} VM
- uses: vmactions/solaris-vm at v1
+ uses: vmactions/solaris-vm at d30dd6c228c8661ade859e36ead7660b9a62efcc # v1
with:
release: ${{ matrix.target }}
usesh: true
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list