diff --git a/.github/workflows/cloud-init-image-for-cuttlefish.yaml b/.github/workflows/cloud-init-image-for-cuttlefish.yaml index ea1a0b71ad4..f886b73439c 100644 --- a/.github/workflows/cloud-init-image-for-cuttlefish.yaml +++ b/.github/workflows/cloud-init-image-for-cuttlefish.yaml @@ -5,7 +5,7 @@ on: paths: - 'cloud-init-image-for-cuttlefish/**' push: - branchs: + branches: - '**' permissions: @@ -21,7 +21,7 @@ jobs: working-directory: ./cloud-init-image-for-cuttlefish steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setting up build environment run: | apt-get update @@ -37,7 +37,7 @@ jobs: run: | ./gen_cidata_iso.sh - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: cloud-init-image-for-cuttlefish-artifacts path: cloud-init-image-for-cuttlefish/gigabyte-cidata.iso @@ -54,9 +54,9 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: cloud-init-image-for-cuttlefish-artifacts - name: Prepare test environment diff --git a/.github/workflows/gemini-dispatch.yml b/.github/workflows/gemini-dispatch.yaml similarity index 96% rename from .github/workflows/gemini-dispatch.yml rename to .github/workflows/gemini-dispatch.yaml index 5f10a5d25c7..9dfb0138636 100644 --- a/.github/workflows/gemini-dispatch.yml +++ b/.github/workflows/gemini-dispatch.yaml @@ -111,7 +111,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'review' }} - uses: './.github/workflows/gemini-review.yml' + uses: './.github/workflows/gemini-review.yaml' # zizmor: ignore[secrets-inherit] permissions: contents: 'read' id-token: 'write' @@ -124,7 +124,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'invoke' }} - uses: './.github/workflows/gemini-invoke.yml' + uses: './.github/workflows/gemini-invoke.yaml' # zizmor: ignore[secrets-inherit] permissions: contents: 'read' id-token: 'write' @@ -137,7 +137,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'approve' }} - uses: './.github/workflows/gemini-plan-execute.yml' + uses: './.github/workflows/gemini-plan-execute.yaml' # zizmor: ignore[secrets-inherit] permissions: contents: 'write' id-token: 'write' diff --git a/.github/workflows/gemini-invoke.yml b/.github/workflows/gemini-invoke.yaml similarity index 95% rename from .github/workflows/gemini-invoke.yml rename to .github/workflows/gemini-invoke.yaml index 396d7f23002..7565493e9c1 100644 --- a/.github/workflows/gemini-invoke.yml +++ b/.github/workflows/gemini-invoke.yaml @@ -36,11 +36,11 @@ jobs: permission-pull-requests: 'write' - name: 'Checkout Code' - uses: 'actions/checkout@v4' # ratchet:exclude + uses: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262' # v4 - name: 'Run Gemini CLI' id: 'run_gemini' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 env: TITLE: '${{ github.event.pull_request.title }}' DESCRIPTION: '${{ github.event.pull_request.body }}' diff --git a/.github/workflows/gemini-plan-execute.yml b/.github/workflows/gemini-plan-execute.yaml similarity index 96% rename from .github/workflows/gemini-plan-execute.yml rename to .github/workflows/gemini-plan-execute.yaml index 29f6da05351..b41a7f2d28b 100644 --- a/.github/workflows/gemini-plan-execute.yml +++ b/.github/workflows/gemini-plan-execute.yaml @@ -38,11 +38,11 @@ jobs: permission-pull-requests: 'write' - name: 'Checkout Code' - uses: 'actions/checkout@v4' # ratchet:exclude + uses: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262' # v4 - name: 'Run Gemini CLI' id: 'run_gemini' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 env: TITLE: '${{ github.event.pull_request.title }}' DESCRIPTION: '${{ github.event.pull_request.body }}' diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yaml similarity index 97% rename from .github/workflows/gemini-review.yml rename to .github/workflows/gemini-review.yaml index 80522f0bfeb..2f57f3251b8 100644 --- a/.github/workflows/gemini-review.yml +++ b/.github/workflows/gemini-review.yaml @@ -40,7 +40,7 @@ jobs: uses: 'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8' # ratchet:actions/checkout@v6 - name: 'Run Gemini pull request review' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 id: 'gemini_pr_review' env: GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}' @@ -113,7 +113,7 @@ jobs: ] prompt: '/pr-code-review' - name: 'Run Gemini security analysis review' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 id: 'gemini_security_analysis' env: GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}' diff --git a/.github/workflows/gigabyte-ampere-cloud-installer.yaml b/.github/workflows/gigabyte-ampere-cloud-installer.yaml index 713488a2403..d91e3fa5e4d 100644 --- a/.github/workflows/gigabyte-ampere-cloud-installer.yaml +++ b/.github/workflows/gigabyte-ampere-cloud-installer.yaml @@ -5,9 +5,12 @@ on: paths: - 'gigabyte-ampere-cloud-installer/**' push: - branchs: + branches: - '**' +permissions: + contents: read + jobs: build-cloud-installer-initramfs-job: runs-on: ubuntu-22.04-arm @@ -19,7 +22,7 @@ jobs: working-directory: ./gigabyte-ampere-cloud-installer steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setting up build environment run: | apt-get update @@ -39,7 +42,7 @@ jobs: export HOME=$GITHUB_WORKSPACE ./regenerate-initramfs.sh - name: Upload artifacts for initramfs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: gigabyte-ampere-cloud-installer-initramfs-artifacts path: gigabyte-ampere-cloud-installer/initrd.img-* @@ -55,9 +58,9 @@ jobs: working-directory: ./gigabyte-ampere-cloud-installer steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-initramfs-artifacts path: ./gigabyte-ampere-cloud-installer @@ -91,7 +94,7 @@ jobs: - name: Clean build directory run: ./lb_clean.sh - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: gigabyte-ampere-cloud-installer/live-image-arm64.iso.xz @@ -103,7 +106,7 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Use github CLI to search for run-id id: search-run env: @@ -113,13 +116,13 @@ jobs: echo "Found Run ID is : ${RUN_ID}" echo "target_id=$RUN_ID" >> $GITHUB_OUTPUT - name: Download artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: cloud-init-image-for-cuttlefish-artifacts run-id: ${{ steps.search-run.outputs.target_id }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: Reupload artifact for later test cases - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: gigabyte-cidata.iso @@ -138,14 +141,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -194,14 +197,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -252,14 +255,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -310,14 +313,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -370,14 +373,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -445,14 +448,14 @@ jobs: working-directory: ./gigabyte-ampere-cloud-installer steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer diff --git a/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml b/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml index 32ef8127919..ca4c4c3b53e 100644 --- a/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml +++ b/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml @@ -6,7 +6,7 @@ on: - '.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml' - 'gigabyte-ampere-cuttlefish-installer/**' push: - branchs: + branches: - '**' permissions: