chore(ci): Pin action dependencies by digest #11395
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Josh-Walker-GM
added
release:chore
Josh-Walker-GM
added
changesets-ok
dac09
added a commit
to dac09/redwood
that referenced
this pull request
Aug 30, 2024
…edwood into feat/prisma-extension-crud-extra * 'feat/prisma-extension-crud-extra' of github.com:dac09/redwood: feat(codegen): support sdl generation for model with compound id (redwoodjs#8556) chore(ci): Follow up to workflow permissions (redwoodjs#11397) chore(deps): Bump 'loader-utils' within docs (redwoodjs#11396) chore(ci): Pin action dependencies by digest (redwoodjs#11395) chore(ci): More workflow permission changes (redwoodjs#11394) chore(ci): Add permissions to some workflows/jobs (redwoodjs#11393) Add OSSF scorecard action to our CI (redwoodjs#11392) chore(rsc): Rename rsf -> rsa (redwoodjs#11391) few Flightcontrol template & doc updates (redwoodjs#11383) chore(jobs tests): Fix a couple of TS issues (redwoodjs#11389)
dac09
added a commit
to dac09/redwood
that referenced
this pull request
Sep 2, 2024
…ads-storage * 'main' of github.com:redwoodjs/redwood: (32 commits) chore(uploads): Reorganise, change uploads package to storage (redwoodjs#11411) fix(cli-helpers): Don't add spaces around `=` for env vars (redwoodjs#11414) feat(uploads): Increase default fastify body limit to 100MB (redwoodjs#11412) chore: Rebuild fixture (redwoodjs#11413) chore(rsc): Refactor: Rename RscFetcher -> RscRoutes (redwoodjs#11409) chore(test-project): Update postcss to 8.4.42 (redwoodjs#11408) chore(rsc): Rename rscFetch to rscFetchRoutes and hardcode the rscId (redwoodjs#11407) feat(rsc): Initial support for RSA rerender (redwoodjs#11406) chore(router): Switch to experimental types (redwoodjs#11405) chore(router): Make React a normal dependency (redwoodjs#11404) feat(rsc): Return flight from RSAs (redwoodjs#11403) rscRequestHandler.ts: Make BASE_PATH naming match client.ts (redwoodjs#11401) fix(template): api type declaration merging for scripts (redwoodjs#11367) RSC: Disable client side flight caching for now (redwoodjs#11400) chore(fixtures): Use proper name for AuthLayout component (redwoodjs#11399) feat(storage): Add support for createMany, updateMany and upsert (redwoodjs#11390) feat(codegen): support sdl generation for model with compound id (redwoodjs#8556) chore(ci): Follow up to workflow permissions (redwoodjs#11397) chore(deps): Bump 'loader-utils' within docs (redwoodjs#11396) chore(ci): Pin action dependencies by digest (redwoodjs#11395) ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It is considered a best practice to pin github actions by the actual digest rather than by tag - given that tags are mutable.
There's a convenient tool pin-github-action that has a CLI that can take a file and do this for us. I used this here and ensured that I had the comments in the form that renovate will understand. Renovate will trigger updates for the digest when a new version (based on the comment) is published (docs).
This might make working with actions slightly harder than it was before but we often use the same actions repeatedly so in that case just copy paste the digest from somewhere else. If you're adding a new one use the version tag and then run that tool mentioned above.